Blastpass

Blastpass is a significant software vulnerability that was revealed in September 2023 by Citizen Lab. The flaw, which resides in Apple's software design and implementation, has been exploited by attackers to infiltrate devices with Pegasus spyware. The exploit is particularly potent as it uses a zero-click mechanism, allowing an attacker to compromise a device without any user interaction. It was found being actively exploited in attacks on iPhones running the latest version of iOS (16.6), even if the device's software was updated. The Blastpass vulnerability was added to the Known Exploited Vulnerabilities Catalog by the US Cybersecurity and Infrastructure Security Agency (CISA). This move highlights the severity and widespread exploitation of the flaw. The individual associated with exploiting this vulnerability is known to use the Apple ID [email protected]. The Blastpass exploit has been linked to multiple cyberattacks over the past several decades, including the infamous Morris worm of 1988, due to its root cause: memory safety vulnerabilities. Anjana Rajan, Assistant National Cyber Director for Technology Security, emphasized the gravity of these memory safety vulnerabilities, citing high-profile cyberattacks like the Slammer worm of 2003, Heartbleed in 2014, Trident in 2016, and the recent Blastpass in 2023. These attacks have resulted in substantial real-world damage to systems that society relies on every day. Therefore, the elimination of memory-safety vulnerabilities is crucial to prevent such cyberattacks in the future.