3 ms·
it likely doesn't have persistence due to secure boot chain, so it could get worse. or attacks against Secure Enclave.
by wepple 10y ago
it likely doesn't have persistence due to secure boot chain, so it could get worse.
or attacks against Secure Enclave.
- 0x0 10y agoIt does have reboot persistence. That's what untethered usually means.
- wepple 10y agoyeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
- 0x0 10y agoWhat's the difference? :) It's explained in detail here: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... Apparently it overwrites a system binary that's launched on boot with another apple-signed binary "jsc" (a console javascript interpreter), which will evaluate some sort of .js that re-exploits everything. Pretty clever to re-use apple-signed binaries for nefarious purposes. (The binary must be apple-signed because when booting the kernel isn't exploited yet and so it enforces code signing, obviously).