Pwnyourhome

The "PWNYOURHOME" vulnerability is a significant flaw in software design or implementation that was used against iPhones running iOS 15 and iOS 16 starting in October 2022. Identified by Citizen Lab, it is one of three zero-click exploits that were used to deploy the Pegasus spyware on target iPhones by NSO Group's clients. The vulnerability, which first targets the HomeKit process and then the iMessage service, is a novel two-step zero-click exploit. It was deployed as zero-days against iOS versions 15.5 and 15.6 (FINDMYPWN), and 16.0.3 (PWNYOURHOME). The attack process involved in PWNYOURHOME is similar to previous Pegasus attack vectors, as observed by both Citizen Lab and Amnesty’s Security Lab. Notably, the infection was conducted via a zero-click exploit, with forensic evidence suggesting moderate confidence that it was achieved through the PWNYOURHOME exploit targeting Apple's HomeKit and iMessage. However, neither Citizen Lab nor Access Now attributed the attack to any specific nation-state actor. Unfortunately, the NSO Group may have improved its exploit to avoid real-time warnings, although researchers have not seen PWNYOURHOME successfully used against any devices where Lockdown Mode is enabled. While Lockdown Mode does not provide protection for iOS 15, it did offer some protection against the PWNYOURHOME exploit, with device owners receiving real-time warnings when threat actors attempted to use the exploit. Despite the possibility of NSO Group devising a workaround for this real-time warning, no successful use of PWNYOURHOME has been observed on devices with Lockdown Mode enabled, according to Citizen Lab.