4 ms·
It does have reboot persistence. That's what untethered usually means.
by 0x0 10y ago
It does have reboot persistence. That's what untethered usually means.
- wepple 10y agoyeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
- 0x0 10y agoWhat's the difference? :) It's explained in detail here: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... Apparently it overwrites a system binary that's launched on boot with another apple-signed binary "jsc" (a console javascript interpreter), which will evaluate some sort of .js that re-exploits everything. Pretty clever to re-use apple-signed binaries for nefarious purposes. (The binary must be apple-signed because when booting the kernel isn't exploited yet and so it enforces code signing, obviously).