Invisible 'Kismet' iMessage exploit used to hack journalists' iPhones

A group of 37 journalists has fallen prey to an iMessage vulnerability, one that has existed for a year, enabling bad actors supposedly working for governments to spy on the journalists' activities.

A report from the University of Toronto's Citizen Lab claims to have uncovered an operation that took place during July and August of 2020, one conducted by government operatives. The campaign attacked 37 iPhones owned by journalists, producers, anchors, and executives at news-gathering organizations, with the main target being Al Jazeera.

The attacks used Pegasus spyware from NSO Group, specifically a vulnerability referred to as "Kismet." It is believed the vulnerability was an "invisible zero-click exploit in iMessage," and was a zero-day exploit against iOS 13.5.1 and possibly other releases.

Logs of compromised iPhones gathered by Citizen Lab indicate a number of NSO Group customers also used the same exploit between October and December 2019, suggesting it is one that wasn't detected or fixed for a considerable length of time.

The group were attacked by four Pegasus operators, including one known as "Monarchy" that was attributed to Saudi Arabia, while "Sneaky Kestrel" was thought to have performed attacks on behalf of the UAE.

It is likely that the operators were connected to the crown princes of the two countries, as a lawsuit from one Al Jazeera anchor blamed the pair for hacking her iPhone, and disseminating doctored photographs of the victim.

Once attacked, a target's iPhone would start to upload large amounts of data, sometimes totaling hundreds of megabytes, without the user's knowledge. It is thought the data that was being transferred included ambient audio recorded by the microphone, the content of encrypted phone calls, photographs taken by the camera, the device's location, and potentially any stored passwords or account credentials.

A statement from Apple seen by The Guardian calls the attacks "highly targeted by nation-states" against individuals. "We always urge customers to download the latest version of the software to protect themselves and their data," Apple added, though also advising it couldn't independently verify the analysis of Citizen Lab.

It seems that the attack vector doesn't work for iPhones updated to run iOS 14 or later, which may mean devices using the operating system are currently safe.

Latest Exclusives

Latest comparisons

10 Comments

GeorgeBMac 11421 comments · 8 Years

About 3 years ago

This is not the first time these countries have been caught cyberhacking. It's not ONLY Russia leading these efforts.

Cyberhacking along with its close cousin, disinformation, has become a new form of warfare and the U.S. needs to step up its response to it. A lot.

Democracy depends on the people knowing the truth -- and these cybercrimes are undermining that foundation.

doggone 400 comments · 18 Years

It would be good to understand how this exploit works. Does "invisible zero-click exploit in iMessage" mean that the user never had to click on link to get infected? That is pretty scary especially for iPhones. I also think Apple needs to be more transparent with these exploits to really drive home that the updates are very important to install.

9secondkox2 3134 comments · 8 Years

Apple... please no more revolving back doors.

We will just read a similar article next year. But it will be due to a different “vulnerability” that somehow acts just like back door.

It’s not just our government that will “exploit” it.

dewme 5746 comments · 10 Years

doggone said:

It would be good to understand how this exploit works. Does "invisible zero-click exploit in iMessage" mean that the user never had to click on link to get infected? That is pretty scary especially for iPhones. I also think Apple needs to be more transparent with these exploits to really drive home that the updates are very important to install.

By definition, zero-day exploits are ones that the platform owner knows nothing about. About the only honest statement Apple could make in regard to these types of exploits is: "We don't know what we don't know."

Keep in mind that there is a thriving market for zero-day exploits. These exploits are very highly sought after by both the "good guys" and the "bad guys." Who is considered a good-guy and who is considered a bad-guy is often subject to debate, whose side you're on, and can vary or flip based on any given situation. There are no simple answers.

gatorguy 24615 comments · 13 Years

doggone said:

It would be good to understand how this exploit works. Does "invisible zero-click exploit in iMessage" mean that the user never had to click on link to get infected? That is pretty scary especially for iPhones.

Correct.