iiinova — where your digital self keeps evolving

We were also able to identify a second (unpublished) iOS threat actor (not NSO) who likely used the same persistence exploit *code* (shared strings), and a third (unpublished) iOS threat actor who likely used the same telemetry-disablement *code* as both.

020

Not to spoil too much, but the underlying issue was a type confusion vulnerability in Foundation during NSKA deserialization of "StrideCalibrationDataBins" in locationd's "user.plist" file that it loads on start. Silently patched in 10.3.3.

100

Watch the video to learn about @droethlisberger.bsky.social's hard-core reverse engineering: he essentially wrote an emulator for a significant chunk of iOS 10 internals to reveal the exploit's secrets!

100

Of course, there's ~no capital-P persistence on iOS (i.e., you can't "just launch" your malicious binary on reboot), so the game is reinfect-on-reboot, either by pushing a remote exploit, or by causing the phone to pull/process an exploit on reboot.

100

Recon 2025 - A Trip to Ancient BABYLON: Unearthing a 2017 Pegasus Persistence Exploit

The video of @droethlisberger.bsky.social and my @reconmtl.bsky.social 2025 talk, "A Trip to Ancient BABYLON", is now online! It's a fun story about a 2017-era iOS persistence exploit that we found in a Pegasus sample -- on VT (!!)

youtube.com

YouTube video by Recon Conference

164

Reposted by Bill Marczak

eileen chengyin chow @chowleen.bsky.social · 27/09/2025

The South Korean Ministry of Defense has awarded medals of merit to 11 officers for disobeying direct orders of superiors during the martial law fiasco, orders that they deemed to be contrary to the constitution and endangerment to democracy. www.chosun.com/english/nati...

chosun.com

National Defense Ministry Honors 11 Soldiers for Refusing Illegal Orders

National Defense Ministry Honors 11 Soldiers for Refusing Illegal Orders Honored for rejecting illegal orders during martial law, Marine death probe

392197596106

Bill Marczak @billmarczak.org · 29/08/2025

Was a big mystery as to how/why CVE-2025-43300 came to be the only part of the chain that was patched on iOS. Now we know: it was actually a WhatsApp attack!

050

Bill Marczak @billmarczak.org · 29/08/2025

WhatsApp just announced they patched a very fun zero-click bug (CVE-2025-55177)! WhatsApp assesses that it was used partially in conjunction with the iOS RawCamera DNG vulnerability (CVE-2025-43300). www.whatsapp.com/security/adv...

1103

Bill Marczak @billmarczak.org · 29/06/2025

Excited to talk today at @reconmtl.bsky.social with @droethlisberger.bsky.social about a 2017 iOS persistence exploit used by NSO's Pegasus (and, interestingly, other threat actors too)! 10:00AM in the Grand Salon cfp.recon.cx/recon-2025/t...

0115

Bill Marczak @billmarczak.org · 20/06/2025

Remember when Meta published about an ITW FreeType OOB write vuln (CVE-2025-27363) in March? Turns out, Meta links this vuln to an exploit from spyware vendor Paragon www.securityweek.com/freetype-zer...

securityweek.com

FreeType Zero-Day Found by Meta Exploited in Paragon Spyware Attacks

WhatsApp told SecurityWeek that it linked the exploited FreeType vulnerability CVE-2025-27363 to a Paragon exploit.

099

This means if we see two devices targeted by the same Paragon attacker account (e.g., ATTACKER1), we can surmise that both targets were targeted by the _same_ Paragon customer/operator, as in this case.

020

Based on our understanding of typical mercenary spyware operations, a spyware company (e.g., Paragon) will register the attack accounts (e.g., ATTACKER1) and distribute credentials for a given account only to infrastructure exclusive to a single customer/operator.

We found the ATTACKER1 account present on the second journalist’s phone, i.e., the phone of Fanpage.it journalist Ciro Pellegrino. The steps of our attribution argument are outlined in our diagram:

Anyhoo, around the same time this same phone was making these requests, it was silently communicating with an iMessage account (which we redact as "ATTACKER1"). We conclude that ATTACKER1 deployed a sophisticated zero-click attack against the device. Apple (silently) mitigated it in iOS 18.3.1:

And there’s a clear chain of shared behavior leading from Fingerprint P1 back to other IPs that previously returned pages entitled "Paragon" and a TLS certificate with the terms "Graphite" and "installerserver".

130

Raph Levien @raphlinus.bsky.social · 19/03/2025

Basically, one of the phones sent multiple requests to IP 46.183.184[.]91, an IP that we linked with high confidence to Paragon’s Graphite spyware infrastructure. We were able to make this link because 46.183.184[.]91 matched our Fingerprint P1 (seen here in Censys search syntax)

150

Reposted by Bill Marczak

New blog post up on the Rust font loader now shipping in Chrome. I only had a small part in this personally but am proud of the team's work. developer.chrome.com/blog/memory-...

developer.chrome.com

Memory safety for web fonts | Blog | Chrome for Developers

Learn how and why the Chrome team has replaced FreeType with Skrifa.

310726

Bill Marczak @billmarczak.org · 19/03/2025

Check out our new @citizenlab.ca report today on Paragon! We got a tip from a collaborator, used it to map out Paragon's infrastructure, and shared with Meta. WhatsApp was able to capture & burn a zero-click, and sent out notifications to targets citizenlab.ca/2025/03/a-fi...

citizenlab.ca

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations - The Citizen Lab

In our first investigation into Israel-based spyware company, Paragon Solutions, we begin to untangle multiple threads connected to the proliferation of Paragon's mercenary spyware operations across t...

0123

Bill Marczak @billmarczak.org · 28/02/2025

Nice work by Amnesty Security Lab & Google TAG patching three vulnerabilities in Android/Linux kernel USB device drivers that Cellebrite was using to unlock Android devices. Also, it's *scandalous* that Android doesn't have a USB restricted mode like iPhone... securitylab.amnesty.org/latest/2025/...

securitylab.amnesty.org

Cellebrite zero-day exploit used to target phone of Serbian student activist - Amnesty International Security Lab

Amnesty International’s Security Lab uncovers sophisticated Cellebrite zero-day exploit, impacting billions of Android devices.

0196

Bill Marczak @billmarczak.org · 10/02/2025

Update your iPhones.. again! iOS 18.3.1 out today with a fix for an ITW USB restricted mode bypass (via Accessibility) support.apple.com/en-us/122174

35634

Reposted by Bill Marczak

Vas Panagiotopoulos @vaspanagiotopoulos.com · 08/01/2025

NSO Group co-founder & owner Omri Lavie speaks about the recent US judge's WhatsApp ruling, the acquisition of competitor Paragon Solutions by AE Industrial Partners & the US-blacklisting of Pegasus spyware maker, amidst shifting 🇺🇸policy under Trump. 👇 vaspanagiotopoulos.substack.com/p/nso-group-...

vaspanagiotopoulos.substack.com

NSO Group owner: “We will appeal, justice was not served.”

NSO Group co-founder and majority owner Omri Lavie breaks silence amid legal battles and anticipated US policy shift under Trump.

184

Bill Marczak @billmarczak.org · 29/12/2024

One interesting detail about our guy Rinson Jose in the new NYTimes article on the pager operation: Israel pressured the US to let Jose flee (though unclear anyone would have stopped him). Still no word on to what extent Jose was aware of the operation.

131

Reposted by Bill Marczak

Kirsten Han 韩俐颖 @kirstenhan.com · 23/12/2024

Happy holidays to me, I guess

54517

Still no detail on the supply chain for the non-exploding pager components (do we really believe Mossad has a facility to manufacture circuit boards, etc., for pagers?) and not much color on the roles of the various shell companies beyond BAC, whose purpose was said to have been to dupe Gold Apollo

020

Another interesting bit of color: when the guy who developed the exploding pager took it to the Mossad director, the director rejected it, thinking no one would buy it because it was too bulky/ugly. But, turns out, it was just barely good enough that Hezbollah didn't think to ask too many questions.

One slightly new detail: the Taiwanese saleswoman (whose name was published in Taiwanese media) was apparently selling (non-exploding) pagers to Hezbollah even before the Mossad (covertly) recruited her (!) Also, she gave Hezbollah the first batch of the (exploding) AR-924 pagers for free.

110