Apple's latest security update for its iOS mobile operating system patches a serious flaw that allowed malware to spy on a user's phone calls and text messages, according to a human rights watchdog.
Citizen Lab, a Canadian research group that analyzes cyber security, published a report this week claiming that a prominent human rights activist received a text message from a "cyber war" company with a link to malware that would have jailbroken his iPhone and installed surveillance software.
The activist, Ahmed Mansoor, did not tap on the link, and instead forwarded it to Citizen Lab. Working with a US mobile security company, researchers there identified it as an exploit connected to NSO Group, an Israeli company best known for selling a government-exclusive "lawful intercept" spyware product called Pegasus.
Had Mansoor activated the malware, it would have remotely jailbroken Mansoor's iPhone and allowed NSO to use the camera and microphone to snoop on his activity, according to Citizen Lab. His WhatsApp and Viber calls would have been vulnerable, in addition to the location recorded by the phone's GPS.
Highlighting the rare nature of the exploit, Citizen Lab wrote in its report that "[w]e are not aware of any previous instance of an iPhone remote jailbreak used in the wild as part of a targeted attack campaign."
Apple on Thursday released the latest version of iOS, 9.3.5, which it described as fixing issues identified by Citizen Lab. The update includes two improvements to how iOS devices access memory, as well as a patch that prevents visits to a "maliciously crafted website" from remotely executing arbitrary code.