4 ms·
Anyone else think it's a bit of a joke that a $1M+ bug still relies on the user clicking a phishing sms to work?
by SturgeonsLaw 10y ago
Anyone else think it's a bit of a joke that a $1M+ bug still relies on the user clicking a phishing sms to work?
- andwur 10y agoNot particularly. Besides the fact that was only one of many possible delivery vectors available, e.g. XSS, direct compromise of a visited site etc, it's one with quite a high chance of succeeding* in the wild. * when the target isn't already paranoid due to previous attacks and the bait isn't quite so pathetic in its construction... Edit: I imagine they went with the SMS method due to its high accuracy and low risk of detection from third parties.
- deleted 10y ago[deleted]
- wepple 10y agoI'd suspect there's a disconnect between the group selling/providing the tools, and the group using them. A webkit 0day could've been delivered via a watering-hole attack or something even just a tiny bit more sophisticated (compromise a trusted contacts social media account, send the link from there) and succeeded. Whoever put the effort/time/money into developing the exploit chain is likely pissed off it got burnt via such an amateur delivery.