4 ms·
Chaining this with some form of SMS/MMS bug (a la Stagefright) would make this unbelievably powerful. That's essentially the worst case scenario I can imagine
by daeken 10y ago
Chaining this with some form of SMS/MMS bug (a la Stagefright) would make this unbelievably powerful. That's essentially the worst case scenario I can imagine for mobile security.
- throwanem 10y agoOr this, from the detailed writeup linked elsewhere on this page: > To use NSO Group’s zero-click vector, an operator instead sends the same link via a special type of SMS message, like a WAP Push Service Loading (SL) message. A WAP Push SL message causes a phone to automatically open a link in a web browser instance, eliminating the need for a user to click on the link to become infected. It goes on to say that messages of this type are increasingly restricted by service providers and newer phone OSes, but that's still pretty horrifying to read.
- bonaldi 10y agoI wonder if it can be triggered from the webview it automatically pops up when a captive wifi portal is accessed. Needs proximity to the user, but still straightforward.
- toyg 10y agoLikely. Then again, good opsec would imply that you don't join untrusted networks, period.
- jakobegger 10y agoIf the attacker controls the wifi, he doesn't need to put it in the captive portal page; he can intercept any non-secure http page and put his exploit there. You really shouldn't connect to untrusted networks at all if you want to be safe from this kind of attack.
- psykpsyk 10y agoUh... I can send those WAP push SL messages from my rooted android with an app that costed like 5USD.
- kchoudhu 10y agoWhen your service provider is owned by the state, all you can rely on is the OS provider. Maybe we should all just go back to carrying dumbphones.
- CameronBanga 10y agoThat's presuming you have more faith in your desktop/other computing systems to be safe in the long run. Personally, I'd take iOS over any alternative, if security was my biggest concern.
- qzio 10y agoI can recommend you to try qubes OS.
- jessaustin 10y agoWow this WAP Push SL thing seems egregious. It's understandable that somebody thought it would be useful, for like five minutes. But how could a standards body or any of the several different OS companies who have implemented it not have realized how monumentally unwise it is to just automatically run shit that randomly gets sent to a phone?
- nomercy400 10y agoNot everything that supports WAP has to be a phone. It could also be a standalone device, or sensor, or whatever. And with WAP push you can control it. For me the strange thing is that it is on by default on user phones.
- kalleboo 10y agoThis stuff was all designed by European mobile operators (many of them monopolies) in the mid-90's. Not exactly a peak period for security thinking.
- kobayashi 10y agoAnybody know if and what limitations iOS and/or Android put on WAP Push SLs?