Findmypwn

FINDMYPWN is a zero-click exploit that was used against iOS 15 starting from June 2022. This two-step vulnerability targets the iPhone's Find My feature and iMessage, allowing for unauthorized access and control of the device. It has been observed being deployed as zero-days against iOS versions 15.5, 15.6, and 16.0.3. In 2022, there were at least two recorded instances of devices being infected by the FINDMYPWN exploit. However, it remains unclear which specific security vulnerabilities FINDMYPWN has been exploiting, though it may be related to CVE-2022-42827, a remote code execution bug in the OS kernel. The surveillance firm also used another zero-click exploit, dubbed PWNYOURHOME, against iOS 15 and iOS 16. This exploit involves the HomeKit functionality built into iPhones and can operate even if the victim has never configured a "Home" inside HomeKit. A third zero-click exploit, LATENTIMAGE, was active in January 2022 on iOS 15 and might have also involved the iPhone's Find My feature, but it represents a different exploit chain than FINDMYPWN. Citizen Lab's investigation concluded that NSO Group's Pegasus spyware continues to pose a threat as their attack techniques evolve. PWNYOURHOME and FINDMYPWN are the first observed zero-click exploits that utilize two separate remote attack surfaces on the iPhone. Despite these threats, the exact security vulnerabilities exploited by FINDMYPWN remain uncertain, necessitating further research and analysis to develop effective countermeasures.