Citizen Lab caught NSO's zero-click iPhone hacks by watching at-risk phones

By 2020, NSO Group's Pegasus spyware could take over an iPhone with zero clicks, and NSO customers were aiming it at journalists. New York Times correspondent Ben Hubbard, who reported on Saudi Arabia and was writing a book about Crown Prince Mohammed bin Salman, was targeted from June 2018 to June 2021. Complaints to NSO and public reporting by Hubbard and Citizen Lab did not stop it: his phone was hacked again with high confidence in July 2020 and June 2021.

Citizen Lab's counter was to watch the phones the attackers were actually aiming at. In December 2019 it began running VPNs on the devices of potentially targeted users, and it analyzed backups and logs for artifacts, because even a zero-click exploit must travel the network and touch the filesystem. In September 2021 the lab captured NSO's FORCEDENTRY exploit in the wild, recovered from a Saudi activist's iPhone backup, reverse-engineered it, and disclosed it to Apple.

The same lens turned Hubbard's silent infections into a dated public record: gaps in his DataUsage.sqlite file, a process named 'bh', deleted iMessage attachments, and the same delivery account used against the Saudi activist let Citizen Lab conclude with high confidence that his iPhone was hacked on July 12, 2020 and June 13, 2021. Apple shipped a patch for FORCEDENTRY in iOS 14.8 six days after the disclosure. The lab withheld some signatures, the HIPPOCRENE FACTOR, to preserve its visibility into NSO's spyware.

Instrument at-risk phones with VPNs to catch zero-click spyware in the act, then disclose it to the vendor

A zero-click attack still has to reach the phone over the network and touch its filesystem, so a VPN and backups show what the victim cannot: the attack arrives as dated evidence.

The phones belonged to people NSO's customers were genuinely targeting, so Citizen Lab caught real operational attacks and could tie the tool back to NSO with high confidence.

Disclosing the captured exploit gave Apple what it needed: FORCEDENTRY was patched in iOS 14.8 six days later, a fix no complaint, lawsuit, or public report had produced.

Keeping some detection signatures unpublished, such as the HIPPOCRENE FACTOR, meant the lab could keep spotting infections after going public with the rest of its methods.

Instrument the population an attacker targets: a VPN plus backup analysis turns an invisible zero-click attack into dated, attributable evidence, and disclosing it to the vendor gets the fix shipped.

Apple shipped iOS 14.8 six days after Citizen Lab's September 2021 disclosure, closing FORCEDENTRY. Citizen Lab and Amnesty went on to verify similar infections of Al Jazeera staff, journalists in France and Hungary, and editors of India's The Wire, and the Pegasus Project leak showed how widely NSO customers abused the tool. Hubbard's case showed the limits of disclosure: he was infected again in 2021 after going public in early 2020, and Citizen Lab concluded that NSO took no effective steps to stop the targeting of a prominent American journalist.