NSO Group, an Israeli spyware company, has been shocking the international security community in the past with strong and efficient hacking tools that can attack both Android and iOS gadgets. Consumers have misused NSO Group’s products to the point where the organization now confronts penalties, high-profile lawsuits, and an unpredictable future.

However, a new study of the spyware developer’s ForcedEntry iOS exploits — which has been used in a variety of targeted attacks this year against protestors, opposition figures, and journalists — issues a more crucial warning: private companies can produce spyware with the technological innovation and complexity of the most elite government-backed development groups.

ForcedEntry was examined by Google’s Project Zero bug-hunting team using a sample provided by Citizen Lab researchers from the University of Toronto, who reported substantially this year on targeted attacks exploiting the vulnerability. This year, Amnesty International researchers performed extensive investigations on the hacking tool. The exploit uses a zero-click, or interaction-less, assault, which means that victims are not required to click on a link or gain authorization for the exploit to proceed. ForcedEntry utilized a number of devious ways to target Apple’s iMessage service, circumvent defenses installed in recent years to make such attacks harder, and quickly take over iPhones to install NSO’s famous spyware payload Pegasus, according to Project Zero.

In September and October, Apple deployed a number of fixes to prevent the ForcedEntry exploit and strengthen iMessage from further, similar assaults. However, according to the Project Zero researchers, ForcedEntry is still one of the most highly sophisticated attacks ever encountered. The NSO Group claims to have reached a level of creativity and sophistication originally assumed to be confined to a small group of nation-state hackers.

Following Project Zero’s study on the potential of zero-click threats, Apple implemented an iMessage safeguard dubbed BlastDoor in 2020’s iOS 14. BlastDoor appears to have succeeded in making interactionless iMessage assaults far more challenging to execute, according to Beer and Groß. “It’s part of the strategy to make zero-day difficult by forcing hackers to work harder and take more risks.” However, NSO Group eventually figured out a way out.

ForcedEntry exploits flaws in the way iMessage accepts and interprets files such as GIFs to mislead the system into launching a malicious PDF without the recipient having to do anything. The assault took the use of a flaw in a vintage compression technology that was used to process text in photos from a physical scanner, allowing NSO Group clients to entirely control an iPhone.

It doesn’t stop there. Even though many assaults rely on a command-and-control server to deliver commands to malware that has been installed, ForcedEntry creates its very own virtualization layer. The attack’s entire system can be established and operated within a unique region of iMessage, making it even more difficult to discover.

Despite years of debate, it appears that legislative will is emerging to call out private spyware companies. For instance, as originally reported by Reuters, a coalition of 18 US congressmen issued a letter to the Treasury and State Departments on Tuesday, urging the authorities to sanction NSO Group and three other multinational surveillance firms.