Apple patches iPhone security after UAE activist targeted

Apple on Thursday released a security update to block spyware used to target an Emirati human rights activist which security experts say was developed by an Israeli “cyber-war” company.

Three flaws in Apple's iPhone software were discovered by security researchers Citizen Lab and Lookout after lawyer Ahmed Mansoor alerted them to several text messages he had received on 10 and 11 August promising to reveal details of torture victims in the UAE if he followed links in the message.

The links would have installed spyware which would have made the phone “a digital spy in his pocket,” Bill Marczak and John Scott-Railton, senior researchers at Citizen Lab, wrote in an extensive account of their investigation into the attempt to hack into Mansoor's phone.

“Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements,” they wrote.

“The attack on Mansoor is further evidence that 'lawful intercept' spyware has significant abuse potential, and that some governments cannot resist the temptation to use such tools against political opponents, journalists, and human rights defenders.”

The researchers said they believed the spyware had been created by NSO Group, an Israel-based company which has developed a government-exclusive “lawful intercept” spyware program called Pegasus. NSO Group is owned by a US venture capital firm, Francisco Partners Management.

A spokesperson for NSO Group told the Haaretz newspaper that the company could not confirm specific cases and said the company sold within export laws to government agencies which then operated the software.

“The agreements signed with the company's customers require that the company's products only be used in a lawful manner," he said. "Specifically, the products may only be used for the prevention and investigation of crimes."

Earlier this year Middle East Eye journalist Rori Donaghy described how he had been among more than 1,000 journalists and dissidents targeted in an attempt by the UAE to install spyware on their phones.

But Marczak and Scott-Railton said the technical sophistication of previous attacks “pales in comparison to the present attack”.

Mansoor is a prominent dissident in the UAE and last year won the Martin Ennals award, named after the former secretary general of Amnesty International, which has been described as the Nobel Prize for human rights.

Apple said in a statement: “We were made aware of this vulnerability and immediately fixed it with iOS 9.3.5. We advise all of our customers to always download the latest version of iOS to protect themselves against potential security exploits.”