Apple threat notifications prompt Thai government talks

Apple threat notifications sent to iPhone users in more than 150 countries have prompted talks between Thailand's Digital Economy and Society (DES) Ministry and the company, and officials say there is no confirmed evidence yet that the latest campaign involves Pegasus spyware. DES Minister Chaichanok Chidchob gave the update after meeting Apple executives on Wednesday, the Bangkok Post reported.

He said Apple is preparing a further public statement to explain the situation to Thai users and give advice on how to protect their devices.

Why the government asked about Apple threat notifications

The meeting followed a National Security Council session at which Prime Minister Anutin Charnvirakul raised concern about growing cyberthreats worldwide. He told the ministry and other agencies to assess the situation and prepare a response.

Mr Chaichanok said Thailand was among the first countries to discuss the incident with Apple after the alerts appeared. The case adds to a run of cyber stories in the kingdom, including the recent Thailand cyber alert and the Thai Airways data breach.

What Apple told the ministry

According to the minister, Apple explained that its Threat Notification system had detected signs of attempted cyberattacks through technical metadata. It then sent warnings to accounts that might have been targeted.

Under its privacy policy, Apple cannot identify the owners of the devices involved or confirm whether the attempted attacks succeeded. The company also has not said how many people in Thailand received the alerts.

Mr Chaichanok said the alerts mentioned Pegasus to help users understand how serious the threat is, because that spyware is known worldwide for advanced surveillance. Pegasus is linked to so-called zero-click attacks, in which a phone can be compromised without the user clicking a link, opening a file or doing anything at all. Apple stressed that it has no confirmed information on whether this incident involved Pegasus or any other specific spyware.

How users can get their phones checked

Maj Gen Theerawut Witthayakorn, secretary-general of the National Cyber Security Agency (NCSA), said people who received an alert and fear their device has been compromised can:

• submit their phone to the NCSA for examination;
• ask trusted outside specialists for help;
• hand system logs to NCSA officials for technical analysis.

He said the agency has tools to find suspicious software and identify connections to attackers' command-and-control (C2) systems. A forensic check can trace suspicious installations, connections to IP addresses and data that may have been sent out of a device.

Wider talks with the tech industry

The DES Ministry plans to widen its cybersecurity discussions to include digital platform operators, software and hardware companies, and telecom providers. The talks will cover attack methods, preventive measures and coordination with the government, with the aim of strengthening Thailand's overall response to cyberthreats.

The ministry will also look at possible threats aimed at the Android operating system. Financial regulators have been working on the same issue, as covered in our story on Bank of Thailand cyber defences.

What iPhone users in Phuket should do

Anyone on the island who receives an alert should take it seriously but stay calm. Keeping iOS up to date and contacting the NCSA if in doubt are the steps officials have pointed to so far. Apple's promised statement for Thai users should give more detail.

Apple's own support pages also describe Lockdown Mode, an optional iPhone setting designed for people who may be personally targeted by highly sophisticated attacks. It limits some features in exchange for stronger protection, and users who are worried may want to read about it before deciding whether to switch it on.

Image: an Apple iPhone of the kind that received Apple threat notifications. Photo by OneTrueKingLives via Wikimedia Commons, released under CC0.