4 ms·
yeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
by wepple 10y ago
yeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
- 0x0 10y agoWhat's the difference? :) It's explained in detail here: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... Apparently it overwrites a system binary that's launched on boot with another apple-signed binary "jsc" (a console javascript interpreter), which will evaluate some sort of .js that re-exploits everything. Pretty clever to re-use apple-signed binaries for nefarious purposes. (The binary must be apple-signed because when booting the kernel isn't exploited yet and so it enforces code signing, obviously).