​In ClearPass it is very easy to follow and deep-dive into the information of all access request attempts using the Access Tracker. Access Tracker can be accessed from Monitoring —> Live Monitoring in the left hand navigation menu. Access Tracker has a wealth of information which can be viewed in multiple ways and is so important to a ClearPass administrator that it deserves its very own browser tab when you are making changes to and testing new configuration in ClearPass.

Here is another access event showing the same user “matt” requesting access but being denied. The domain account for “matt” was disabled. You can see the authentication source is AD but the Authorisation source is not used this time as the process does not progress beyond the rejected authentication attempt.

The security vulnerability researchers involved (from Citizen Lab and Lookout) suspect the vulnerabilities may have been known to the initial finders as far back as iOS 7 (2013). Citizen Lab have called out Israeli company NSO Group as the developers of Pegasus which is thought to be the name of the software within which the exploits can be launched.

While it may seem unlikely that you would become a target of such an underground and probably extraordinarily expensive hacking tool, unless you have ties to government, extreme wealth or a multinational company with high value intellectual property, now that the vulnerabilities have been announced they are more likely to be researched widely by a larger security research base, including organisations who profit from crime. The fact is that these are zero-day vulnerabilities which by definition were unknown (other than by presumably the NSO Group, and their clients) and un-patched until now.

In the case of the UAE target the story goes that social engineering or phishing attempt was made through a message to his or her mobile phone. The unknown sender left the recipient suspicious so they passed it on to Citizen Lab to investigate. Had they unwittingly followed the link they would have opened a pathway to all the data and communication from their phone to be viewed by an unknown party. This includes communciation from applications such as WeChat, Facebook Messenger, Skype, WhatsApp, Viber, Gmail, Apple's iMessage and more.

The rest is history, yet we now live in a world where this is the future. Cyber crime and espionage is the new norm - with governments and criminals playing the same game. Of course money and power are at the centre of it all...

In 2015 a privately held cyber-security research company Zerodium offered to pay $1 million for information about a Zero Day Bug in Apple's iOS 9. The reason Zerodium is forking out so much for information on these bugs is because it then on-sells that information, including "protective measures and security recommendations, to its clients". The clients are touted as Government and Corporate, yet only a "limited number of organisations" will have access to the solutions and capabilities - which likely drives up the price due to exclusivity.