5 ms·
An untethered stealth jailbreak that installs without user interaction from a webview, that's almost as bad as it gets. And for iOS 7.0.0 - 9.3.4 inclusive. And
by 0x0 10y ago
An untethered stealth jailbreak that installs without user interaction from a webview, that's almost as bad as it gets. And for iOS 7.0.0 - 9.3.4 inclusive. And with exfiltration of audio, video, whatsapp, viber, etc etc. So thorough and so bad :-/
- api 10y agoI wonder if you can hit this via 4G/LTE networks? I also wonder if it works over VPNs? Or is hardware L2 adjacency (WiFi) required?
- 0x0 10y agoIt would affect anything capable of rendering html.
- drewbug 10y agoReminds me of https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
- mi100hael 10y agoI remember going into the Apple store and every iPhone on the display tables being jailbroken due to that site.
- koolba 10y ago> An untethered stealth jailbreak that installs without user interaction from a webview, that's almost as bad as it gets. And for iOS 7.0.0 - 9.3.4 inclusive. And with exfiltration of audio, video, whatsapp, viber, etc etc. So thorough and so bad :-/ Short of being triggered completely in the background by an UDP packet, what's worse than this?
- daeken 10y agoChaining this with some form of SMS/MMS bug (a la Stagefright) would make this unbelievably powerful. That's essentially the worst case scenario I can imagine for mobile security.
- throwanem 10y agoOr this, from the detailed writeup linked elsewhere on this page: > To use NSO Group’s zero-click vector, an operator instead sends the same link via a special type of SMS message, like a WAP Push Service Loading (SL) message. A WAP Push SL message causes a phone to automatically open a link in a web browser instance, eliminating the need for a user to click on the link to become infected. It goes on to say that messages of this type are increasingly restricted by service providers and newer phone OSes, but that's still pretty horrifying to read.
- bonaldi 10y agoI wonder if it can be triggered from the webview it automatically pops up when a captive wifi portal is accessed. Needs proximity to the user, but still straightforward.
- toyg 10y agoLikely. Then again, good opsec would imply that you don't join untrusted networks, period.
- jakobegger 10y agoIf the attacker controls the wifi, he doesn't need to put it in the captive portal page; he can intercept any non-secure http page and put his exploit there. You really shouldn't connect to untrusted networks at all if you want to be safe from this kind of attack.
- psykpsyk 10y agoUh... I can send those WAP push SL messages from my rooted android with an app that costed like 5USD.
- wepple 10y agoit likely doesn't have persistence due to secure boot chain, so it could get worse. or attacks against Secure Enclave.
- 0x0 10y agoIt does have reboot persistence. That's what untethered usually means.
- wepple 10y agoyeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
- 0x0 10y agoWhat's the difference? :) It's explained in detail here: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... Apparently it overwrites a system binary that's launched on boot with another apple-signed binary "jsc" (a console javascript interpreter), which will evaluate some sort of .js that re-exploits everything. Pretty clever to re-use apple-signed binaries for nefarious purposes. (The binary must be apple-signed because when booting the kernel isn't exploited yet and so it enforces code signing, obviously).
- daxorid 10y agoNot really without user interaction. The target in this case would have had to visit the exploit site.
- redwards510 10y ago>We recognized the links as belonging to an exploit infrastructure connected to NSO Group So they were re-using $3 domains to send out a million dollar exploit? Am I reading this right?!
- r00fus 10y agoWould something like proofpoint help?