Flash Report: Apple issues patch for FORCEDENTRY 0-day

Flash Report: Apple issues patch for FORCEDENTRY 0-day

TLP: GREEN

On 13 September, 2021, security researchers disclosed an exploit targeted at Apple products that masquerades malicious Adobe PDF and PSD files as GIF files. The attack produces a condition that allows for arbitrary code execution. According to Apple, the vulnerability affects all iPhones with iOS versions prior to 14.8, all Mac computers with operating system versions prior to macOS Big Sur 11.6, Security Update 2021-005 Catalina, and all Apple Watches prior to watchOS 7.6.2. An update has been released from Apple, and can be found at https://support.apple.com/en-ca/HT212807.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Recommendations

• Pegasus' use of zero-click technology enables the malware to execute on the target device without user interaction, making it difficult to detect and prevent. If suspicious activity is observed on a device, report this activity to the appropriate security teams.
• Patch Apple devices with the following security updates:
  • iOS 14.8 and iPadOS 14.8
  • macOS Big Sur 11.6
  • Security Update 2021-005 Catalina
  • watchOS 7.6.2
  • Safari 14.1.2

Details

“FORCEDENTRY,” the designated name given to CVE-2021-30860, is the latest exploit in a string of 0-day, zero-click attacks targeting Apple devices, primarily weaponised by the threat actor NSO Group in deploying Pegasus malware. FORCEDENTRY gets its name from the ability to circumvent Apple's BlastDoor security system for iMessage, Apple's instant messaging service. Recent Pegasus attacks revealed that attackers compromised iOS devices through the iMessage application in highly targeted attacks.

The exploit itself is delivered via a payload of one or several PDF and PSD files via SMS, which may be obfuscated by changing file extensions to ‘.gif.' These files are specifically crafted to cause an IMTranscoderAgent crash on the device via an integer overflow, which leads to arbitrary code execution. This exploit chain was used to deliver Pegasus malware to specific targets.

Due to the nature of the payload distribution, targeted individuals are likely to have received multiple PDF or PSD files, possibly with a .gif extension, via SMS before infection, in order to trigger the exploit chain used with FORCEDENTRY. Once exploited, Pegasus malware is used to compromise the device.

Evidence of the exploit can be found via forensically examining an unencrypted backup of the Apple device and interrogating the device's Manifest.db files for specific indicators. Figure 1 is a screenshot of .gif files discovered on an iOS device compromised with Pegasus malware.

Figure 1: Forensic evidence from compromised device showing multiple malicious .gif files via SMS before infection. Source: Citizen Lab Research

Currently, there is limited technical information published on this security vulnerability. Additional technical details may become available after more Apple end-users apply the security updates. (ZeroFox Note: The recent Apple security updates contain fixes for CVE-2021-30860 and CVE-2021-30858. The latter update is for the Apple WebKit engine that is unrelated to FORCEDENTRY but still critical to patch.)

Further information on CVE-2021-30860 can be found within the ZeroFox vulnerability intelligence section. https://cloud.zerofox.com/intelligence/vulnerabilities/448318