SAN FRANCISCO (CN) — Calling out an Israeli spyware firm for helping authoritarian governments hack into the phones of journalists and dissidents, global technology giant Apple sued NSO Group on Tuesday, less than three weeks after it was blacklisted by the United States.
“State-sponsored actors like the NSO Group spend millions of dollars on sophisticated surveillance technologies without effective accountability. That needs to change,” said Craig Federighi, Apple’s senior vice president of software engineering, in a statement Tuesday.
The lawsuit comes after the U.S. placed the maker of Pegasus spyware on a list of restricted companies, following revelations that it helped clients including Saudi Arabia, the United Arab Emirates, India and Morocco target journalists and political foes.
Despite reports that its software has been used to help authoritarian governments stifle dissent, an NSO Group spokesperson said Tuesday the technology has helped save thousands of lives around the world, presumably by assisting countries in targeting violent terrorists.
“Pedophiles and terrorists can freely operate in technological safe-havens, and we provide governments the lawful tools to fight it. NSO Group will continue to advocate for the truth,” the spokesperson said by email.
The company’s Pegasus spyware uses a malicious code hidden in text messages to invade a target’s device without detection. Once implanted, Pegasus can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example by scraping browser history and contacts, grabbing screenshots, and infiltrating communications.
In its 22-page lawsuit, Apple calls NSO Group Technologies and its affiliate Q Cyber Technologies “notorious hackers” and “amoral mercenaries” who have deployed destructive malware to target, attack and harm Apple users while earning hundreds of millions of dollars in profit.
The iPhone maker noted its efforts to cultivate a reputation as a company committed to state-of-the-art security and suggested NSO Group is harming its credibility by devising ways to bypass its security measures and hack into Apple devices.
“NSO is the antithesis of what Apple represents in terms of security and privacy,” Apple says in its lawsuit. “While Apple creates products to serve and protect its users, NSO targets and attempts to exploit those products to harm Apple and its users.”
Apple says it first received technical details on how NSO Group used an exploit known as FORCEDENTRY to deploy its spyware from Citizen Lab at the University of Toronto on Sept. 7. The company says it worked “around the clock” to patch the vulnerability with an update on Sept. 13.
The tech giant says it is notifying the small number of users that it discovered may have been targeted through the vulnerability.
“While these cybersecurity threats only impact a very small number of our customers, we take any attack on our users very seriously, and we’re constantly working to strengthen the security and privacy protections in iOS to keep all our users safe,” Federighi, Apple's vice president of software, said in a statement.
Apple reports it has incurred substantial costs and that its security team has spent thousands of hours working to counter NSO Group’s malicious software.
“Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades,” the company complains in its lawsuit.
Apple accuses NSO Group violating the Computer Fraud and Abuse Act and breaching the contract it agreed to when it signed up for and used more than 100 Apple IDs. It also accuses NSO Group of unjust enrichment and engaging in unlawful business practices in violation of California state law.
The Cupertino-based tech giant seeks a permanent injunction barring NSO Group and its affiliate from accessing Apple servers, software and devices and requiring it to purge all data swiped from Apple users through undetectable malware.
It also seeks a court order requiring NSO Group to identify all Apple users whose devices were compromised by the Pegasus software and to cease developing spyware and malware capable of penetrating Apple’s security measures.
This month, a Ninth Circuit panel ruled NSO Group’s work for foreign governments does not make it immune from a separate lawsuit brought by Facebook-owned WhatsApp claiming it misused the messaging platform to infect more than 1,000 users’ devices with spyware.
Security researchers also disclosed this month that the company’s spyware was found on the cellphones of six Palestinian human rights workers. NSO Group's spyware is also suspected of being used to hack into the phones of executed journalist and Saudi Arabia critic Jamal Khashogi’s fiancée, Hatice Cengiz, and former Amazon CEO Jeff Bezos.
Follow @NicholasIovino
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
Additional Reads
-
-
Los Angeles assistant prosecutor faces felony charges April 24, 2024
-
Taxing timeshares April 24, 2024 -
