5 ms·

The moral issue aside, I can't even begin to fathom how their software would even work. How do you stealth install software to a random phone out in the wild? S

by bojo 10y ago

The moral issue aside, I can't even begin to fathom how their software would even work. How do you stealth install software to a random phone out in the wild? Social engineering, or purely technical?

urza 10y ago
I dont know about other devices, but it is possible to remotely and silently install software to android. You need your google account password for that, but I suppose they have some 0days for that..
c22 10y ago
You compel the cellco to load it through a backdoor in the baseband processor?
nyolfen 10y ago
iirc, the method they got caught using was an unsolicited sms with a link to a page with a mobile safari/webkit 0day that silently installed a jailbreak
McKayDavis 10y ago
The linked NYTimes article references 3 exploits dubbed the "Trident Exploit Chain" that are detailed in an excellent Lookout / Citizen Lab writeup [1] discussed on HN 8 days ago [2]. The target is sent an SMS containing a link to site that triggers the explot chain to remotely jailbreak the phone and clandestinely install the monitoring software. Ahmed Mansoor, a UAE journalist, was recently targeted with one of these SMS messages and was immediately suspicious. Instead of clicking the link he contacted Citizen Lab researchers who connected it back to NSO group. [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] https://news.ycombinator.com/item?id=12360662 https://news.ycombinator.com/item?id=12360662
- SturgeonsLaw 10y ago
  Anyone else think it's a bit of a joke that a $1M+ bug still relies on the user clicking a phishing sms to work?
  - andwur 10y ago
    Not particularly. Besides the fact that was only one of many possible delivery vectors available, e.g. XSS, direct compromise of a visited site etc, it's one with quite a high chance of succeeding* in the wild. * when the target isn't already paranoid due to previous attacks and the bait isn't quite so pathetic in its construction... Edit: I imagine they went with the SMS method due to its high accuracy and low risk of detection from third parties.
  - deleted 10y ago
    [deleted]
  - wepple 10y ago
    I'd suspect there's a disconnect between the group selling/providing the tools, and the group using them. A webkit 0day could've been delivered via a watering-hole attack or something even just a tiny bit more sophisticated (compromise a trusted contacts social media account, send the link from there) and succeeded. Whoever put the effort/time/money into developing the exploit chain is likely pissed off it got burnt via such an amateur delivery.

by bojo 10y ago

The moral issue aside, I can't even begin to fathom how their software would even work. How do you stealth install software to a random phone out in the wild? Social engineering, or purely technical?

urza 10y ago

I dont know about other devices, but it is possible to remotely and silently install software to android. You need your google account password for that, but I suppose they have some 0days for that..

c22 10y ago

You compel the cellco to load it through a backdoor in the baseband processor?

nyolfen 10y ago

iirc, the method they got caught using was an unsolicited sms with a link to a page with a mobile safari/webkit 0day that silently installed a jailbreak

McKayDavis 10y ago

The linked NYTimes article references 3 exploits dubbed the "Trident Exploit Chain" that are detailed in an excellent Lookout / Citizen Lab writeup [1] discussed on HN 8 days ago [2]. The target is sent an SMS containing a link to site that triggers the explot chain to remotely jailbreak the phone and clandestinely install the monitoring software. Ahmed Mansoor, a UAE journalist, was recently targeted with one of these SMS messages and was immediately suspicious. Instead of clicking the link he contacted Citizen Lab researchers who connected it back to NSO group. [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] https://news.ycombinator.com/item?id=12360662 https://news.ycombinator.com/item?id=12360662

SturgeonsLaw 10y ago
Anyone else think it's a bit of a joke that a $1M+ bug still relies on the user clicking a phishing sms to work?
- andwur 10y ago
  Not particularly. Besides the fact that was only one of many possible delivery vectors available, e.g. XSS, direct compromise of a visited site etc, it's one with quite a high chance of succeeding* in the wild. * when the target isn't already paranoid due to previous attacks and the bait isn't quite so pathetic in its construction... Edit: I imagine they went with the SMS method due to its high accuracy and low risk of detection from third parties.
- deleted 10y ago
  [deleted]
- wepple 10y ago
  I'd suspect there's a disconnect between the group selling/providing the tools, and the group using them. A webkit 0day could've been delivered via a watering-hole attack or something even just a tiny bit more sophisticated (compromise a trusted contacts social media account, send the link from there) and succeeded. Whoever put the effort/time/money into developing the exploit chain is likely pissed off it got burnt via such an amateur delivery.