Pwnyourhome

Vulnerability Profile Updated 2 months ago
Download STIX
Preview STIX
The "PWNYOURHOME" vulnerability is a significant flaw in software design or implementation that was used against iPhones running iOS 15 and iOS 16 starting in October 2022. Identified by Citizen Lab, it is one of three zero-click exploits that were used to deploy the Pegasus spyware on target iPhones by NSO Group's clients. The vulnerability, which first targets the HomeKit process and then the iMessage service, is a novel two-step zero-click exploit. It was deployed as zero-days against iOS versions 15.5 and 15.6 (FINDMYPWN), and 16.0.3 (PWNYOURHOME). The attack process involved in PWNYOURHOME is similar to previous Pegasus attack vectors, as observed by both Citizen Lab and Amnesty’s Security Lab. Notably, the infection was conducted via a zero-click exploit, with forensic evidence suggesting moderate confidence that it was achieved through the PWNYOURHOME exploit targeting Apple's HomeKit and iMessage. However, neither Citizen Lab nor Access Now attributed the attack to any specific nation-state actor. Unfortunately, the NSO Group may have improved its exploit to avoid real-time warnings, although researchers have not seen PWNYOURHOME successfully used against any devices where Lockdown Mode is enabled. While Lockdown Mode does not provide protection for iOS 15, it did offer some protection against the PWNYOURHOME exploit, with device owners receiving real-time warnings when threat actors attempted to use the exploit. Despite the possibility of NSO Group devising a workaround for this real-time warning, no successful use of PWNYOURHOME has been observed on devices with Lockdown Mode enabled, according to Citizen Lab.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Findmypwn
3
FINDMYPWN is a zero-click exploit that was used against iOS 15 starting from June 2022. This two-step vulnerability targets the iPhone's Find My feature and iMessage, allowing for unauthorized access and control of the device. It has been observed being deployed as zero-days against iOS versions 15.
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Exploit
Ios
NSO Group
Spyware
Imessage
Exploits
Zero Day
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
PegasusUnspecified
2
Pegasus is a highly sophisticated malware developed by the NSO Group, known for its advanced and invasive capabilities. It is classified as mercenary spyware, often used by governments to target individuals such as journalists, political activists, and others of interest. Pegasus is particularly not
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
LatentimageUnspecified
1
LatentImage is a software vulnerability discovered by Citizen Lab, identified as the third zero-click exploit used by NSO Group in 2022. This flaw was found on a single target's phone and is believed to be the first new exploit deployed by the NSO Group that year. Similar to two other exploits uncov
Source Document References
Information about the Pwnyourhome Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
7 months ago
Is Pegasus spyware targeting journalists in India? 
CERT-EU
10 months ago
Zero-Click iPhone Exploit Drops Spyware on Exiled Russian Journalist
Securityaffairs
10 months ago
The iPhone of a Russian journalist was infected with the Pegasus spyware
Securityaffairs
a year ago
PWNYOURHOME, FINDMYPWN, LATENTIMAGE: 3 iOS Zero-Click exploits used by NSO Group in 2022
DARKReading
a year ago
NSO Group is Back in Business With 3 New iOS Zero-Click Exploits
Malwarebytes
a year ago
iOS Lockdown Mode effective against NSO zero-click exploit
CERT-EU
a year ago
NSO's Pegasus spyware uses 3 zero-click iOS exploit to hack iPhones