Apple notified State Department employees of phone hacking linked to NSO Group software
Foreign service officers in Uganda among those informed their iPhones were compromised in attack
US needs to 'find, fix and disrupt hacking groups': Former CIA Station Chief Hoffman
Former CIA Station Chief and Fox News contributor Dan Hoffman on how the Biden administration can combat recent cyber attacks, arguing 'we need to take the fight to the enemy.'
Apple Inc. last week notified 11 U.S. State Department employees in Uganda that their iPhones were hacked, and investigators have linked the attack to a tool developed by NSO Group, an Israeli technology company that was blacklisted by the Biden administration, according to a person familiar with the matter.
Some of the targeted State Department employees were foreign service officers who are U.S. citizens, while others appear to be locals working for the embassy, the person familiar with the matter said. The hacked phones were linked to State Department email addresses, the person said.
CYBERATTACKS: RESEARCH SHOWS WHICH COUNTRIES ARE MOST AT RISK
The alerts appear to be the first confirmed cases of NSO Group’s mobile hacking tool, known as Pegasus, being used to successfully target American officials.
The Biden administration last month placed NSO Group on an export prohibition list that restricts the firm from obtaining some types of technology from the U.S. That came after a recent series of articles published by a global consortium of journalism organizations alleged that Pegasus, one of NSO Group’s main software intrusion tools, has been used by dozens of law-enforcement and intelligence customers around the world to target and break into cellphones belonging to politicians, human-rights activists and journalists.
The Apple logo at an Apple Store, as Apple's new 5G iPhone 12 went on sale in Brooklyn, New York, U.S. Oct. 23, 2020. (REUTERS/Brendan McDermid/File Photo) (Reuters Photos)
"Once the inquiry was received, and before any investigation under our compliance policy, we have decided to immediately terminate relevant customers’ access to the system, due to the severity of the allegations," NSO Group said in a statement. "To this point, we haven’t received any information nor the phone numbers, nor any indication that NSO’s tools were used in this case."
NSO Group didn’t identify the customer or customers whose access to its tools were terminated and said it would cooperate with any relevant government authorities investigating the matter. Apple has a policy of notifying users it suspects have been targeted by state-sponsored attackers. Those notifications don’t include who was behind the effort. Reuters first reported that at least nine State Department employees had been hacked by an unknown NSO Group customer.
HACKERS DEMAND $70M TO RESTORE DATA HELD BY COMPANIES HIT IN CYBERATTACK: BLOG
The State Department declined to confirm the specific allegations, but said it closely monitors the cybersecurity conditions of its workers.
Apple last week sued NSO Group, alleging the company had engaged in "concerted efforts in 2021 to target and attack Apple customers, Apple products and servers and Apple through dangerous malware and spyware." The suit seeks to bar NSO Group from using Apple’s products. It follows a similar lawsuit that the WhatsApp messaging service brought in 2019 alleging NSO Group had sent malware to 1,400 of its users. WhatsApp is owned by Meta Platforms Inc., formerly known as Facebook Inc.
NSO Group has said its technology has been used to save lives around the globe by helping law enforcement and intelligence agencies in countries that respect privacy and the rule of law to pursue terrorists and other criminals. The company has also said it has terminated contracts with governments that have abused its software and taken steps to prevent abuse.
Cyber security IT engineer working on protecting network against cyberattack from hackers on internet. (iStock / iStock)
But that has not appeased the company’s critics, who have for years accused NSO Group of being one of the most prominent vendors in an expanding commercial marketplace for hacking tools. While some governments often develop their own hacking tools at intelligence agencies like the National Security Agency, others have increasingly sought to purchase digital surveillance tools from companies that specialize in building and selling them.
"Companies that enable their customers to hack U.S. government employees are a threat to America’s national security and should be treated as such by the government," Sen. Ron Wyden, a Democrat on the Senate Intelligence Committee who has advocated for a crackdown on hacking tool vendors like NSO Group, said Friday in response to news of the State Department notifications.
| Ticker | Security | Last | Change | Change % |
|---|---|---|---|---|
| AAPL | APPLE INC. | 169.02 | +2.20 | +1.32% |
| FB | n.a. | n.a. | n.a. | n.a. |
NSO Group has said that there are certain restrictions on the use of its tools, including that they are blocked from working on U.S. phone numbers. In its statement Friday, the firm acknowledged that "once the software is sold to the licensed customer, NSO has no way to know who the targets of the customers are, as such, we were not and could not have been aware of this case."
CLICK HERE TO READ MORE ON FOX BUSINESS
Pegasus spyware allows pervasive surveillance once a phone is compromised, essentially creating a silent spying device that can access a phone’s files and messages as well as its microphone and camera. To install it, the NSO Group has developed a number of sophisticated techniques, including one "zero-click" method discovered earlier this year that could infect an iPhone without requiring the owner to click a link or open a file, according to researchers who have studied the software.