pwn.watch: Zero-click incident updates

[high] Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones

Wed, 27 Dec 2023 00:00:00 GMT

Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

Status: closed · Patch: patched · Fixed in: CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD), CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD), CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)

Latest updates:

2023-12-27: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606 (source)
2023-07-24: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26 (source)
2023-06-21: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23 (source)

CVEs: CVE-2023-32434, CVE-2023-32435, CVE-2023-38606

[high] BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Mon, 11 Sep 2023 00:00:00 GMT

Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Status: closed · Patch: patched · Fixed in: iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, watchOS 9.6.2

Latest updates:

2023-09-11: CISA adds both CVEs to the KEV catalog
2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (source)

CVEs: CVE-2023-41064, CVE-2023-41061

[critical] Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)

Fri, 24 Mar 2023 00:00:00 GMT

A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.

Status: closed · Patch: patched · Fixed in: See vendor advisory (March 2023 security updates)

Latest updates:

2023-03-24: Microsoft publishes investigation guidance for CVE-2023-23397 (source)
2023-03-14: Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV (source)

CVEs: CVE-2023-23397