FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild - The Citizen Lab

If you haven't updated your iPhone (and all iOS devices) recently you should stop reading and go update it. This article has some additional details about how this exploit was used by NSO Group to gain access to phones. It is one of those worrisome exploits that can be done entirely remote.

Citizen Lab forwarded the artifacts to Apple on Tuesday, September 7. On Monday, September 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS. They designated the FORCEDENTRY exploit CVE-2021-30860, and describe it as “processing a maliciously crafted PDF may lead to arbitrary code execution.”

Security gaps are not new, and the technology industry has a long-standing practice of letting the company with the vulnerability know of an issue, so that overall we have a safer environment. It has typically been the criminals that find these vulnerabilities and then exploit them for some gain. So what do we call companies and governments that find, exploit, and hide these exploits for their own use?