FORCEDENTRY
FORCEDENTRY, also capitalized as ForcedEntry, is a security exploit allegedly developed by NSO Group to deploy their Pegasus spyware. It enables the "zero-click" exploit that is prevalent in iOS 13 and below, but also compromises recent safeguards set by Apple's "BlastDoor" in iOS 14 and later. In September 2021, Apple released new versions of its operating systems for multiple device families containing a fix for the vulnerability.
Exploit
The exploit was discovered by Citizen Lab, who reported that the vulnerability has been used to target political dissidents and human rights activists. FORCEDENTRY appears to be the same as the attack previously detected and named "Megalodon" by Amnesty International.
The exploit uses PDF files disguised as GIF files to inject JBIG2-encoded data to provoke an integer overflow in Apple's CoreGraphics system, circumventing Apple's "BlastDoor" sandbox for message content. BlastDoor was introduced as part of iOS 14 to defend against KISMET, another zero-click exploit. The FORCEDENTRY exploit has been given the CVE identifier CVE-2021-30860. In December 2021, Google's Project Zero team published a technical breakdown of the exploit based on its collaboration with Apple’s Security Engineering and Architecture (SEAR) group.
The exploit was described by Project Zero team:
According to Citizen Lab, the FORCEDENTRY vulnerability exists in iOS versions prior to 14.8, macOS versions prior to macOS Big Sur 11.6 and Security Update 2021-005 Catalina, and watchOS versions prior to 7.6.2.
Apple lawsuit
In November 2021, Apple Inc. filed a complaint against NSO Group and its parent company Q Cyber Technologies in the United States District Court for the Northern District of California in relation to FORCEDENTRY, requesting injunctive relief, compensatory damages, punitive damages, and disgorgement of profits but in 2024 asked the court to dismiss the lawsuit.