Rapid Security Update Fixes an Elusive Vulnerability

On September 7th, 2023, Apple rolled out a rapid security update for most current models of iPhone, iPad, Mac, and Apple Watch. It’s easy to get these updates, they don’t cost us anything to install, and they won’t slow down your device.

The Problem: Have you heard of the NSO Group? It’s been in the news a fair bit. NSO Group is a company that makes spy tools and sells them to governments, in particular, a piece of software called Pegasus. Pegasus is spyware—that is, once installed on an iPhone, it spies on the user—but not the day-to-day kind of spyware you might get by accidentally installing a malicious browser extension. Pegasus is a bit like James Bond’s car, an elite and expensive tool, built from technology only the most cutting-edge researchers can access. Pegasus is capable of remotely breaking into almost any iPhone, tracking its location, accessing its message history, and more, all without the user ever knowing. Spooky stuff, and it’s meant for spooks: spies and law enforcement agents.

NSO Group presents itself as a legitimate company selling a tool that law enforcement and spy agencies need in order to catch the bad guys, and they say they’re careful who they sell it to. But the Pegasus software has been found on the phones of journalists and activists all over the world including in the United States, but also in places with dangerous authoritarian regimes, on the phones of people investigating government corruption and the phones of their families.

Efforts to rain on NSO Group’s parade have gotten them soggy, but they march on. The Biden administration placed NSO Group on a commerce department blacklist, forbidding American companies from doing business with them. This had the intended chilling effect, and the company had to downsize, yet Pegasus infections are still turning up in ethically questionable places.

The Fix: Now let me introduce you to The Citizen Lab, a non-profit research institution at the University of Toronto, devoted to protecting regular people from exactly this kind of threat. In early September of 2023 (last week, as of this writing) they were approached by a “member of civil society” based out of Washington DC, who had concerns about their own iPhone.

The Citizen Lab was able to determine that the phone had been infected with Pegasus, but more than that, how the infection was achieved. They notified Apple, and within a few days, Apple rolled out this patch, which fixes the weakness in iPhone security that made it possible for Pegasus to infect that phone. You can read the whole story in Citizen Lab’s announcement.

Repairing this weakness forces NSO Group to find a new way to infect iPhones with Pegasus, and that is not easy. It’s expensive and time-consuming. Hopefully, they will not succeed.

There is something olympian about the last few security updates: possible espionage against Russia in August and now, in September, a rebuff of a mercenary spy company selling tools to be unleashed across the cell networks. Both may sound like distant thunder in celestial spheres. Most of us are not targets for Pegasus spyware: it’s expensive, and exclusive. If you happen to be a journalist or activist annoying someone powerful, then this update may help you sleep a little better. But, even if you’re not, downloading and installing the fix is a rebuke of NSO Group and a small vote for a slightly better world.

The Bottom Line: If you haven’t already, head over to Settings > General > Software Update on your iPhones and iPads, or Apple Menu > System Settings > General > Software Update on your Mac to download the update. Once it’s downloaded, you may have to go back to that menu to install it. If you don’t see it, check this list from Apple of devices the fix is available for.