4 ms·

How were they able to install spyware on iOS devices?

deleted 8y ago
[deleted]
xenospn 8y ago
Since there's no version information available, I think it's safe to assume they haven't been doing it on iOS for several years.
- thinkling 8y ago
  It's not clear to me if you're right, but I would rephrase the issue this way: If there's a vulnerability in Whatsapp, the injected code should only affect Whatsapp. Otherwise, it's (also) a vulnerability in iOS.
  - 6nf 8y ago
    That might be enough for what they are doing. At least it will allow them to spy on whatsapp messages and parts of the system that Whatsapp can access (contacts etc)
    - Moru 8y ago
      Ofcourse the whole point of Whatsapp is secure communications and I guess the exploit makes that pointless.
askvictor 8y ago
Or Android devices for that matter; app code is sandboxed and signed, and requires user interaction to download any non store code
- wahern 8y ago
  The secure enclaves on Android smartphones have a poor track record. Even the top-of-the-line manufacturers have seen published hacks of their TEE environments, and those are usually just the tip of the iceberg. Android is incomparable to Apple's platform in this regard. (I'm not trying to argue the iPhone is unhackable, though.) FWIW, I'm an Android user.
  - jtl999 8y ago
    The Pixel 3 has a "Titan M" chip with much reduced attack surface compared to the TEE. Don't otherwise know much about it.
    - jplayer01 8y ago
      Still leaves 99,9999% of the Android market vulnerable.
      - jtl999 8y ago
        I still agree that's an issue and I'm wondering if the Titan M chip is going to be a Google exclusive or if it's going to be licensed to other OEM's at some point.
nvr219 8y ago
right?
snowwrestler 8y ago
Most likely by exploiting an iOS vulnerability . (Which might be unrelated to the WhatsApp bug, other than using it as a vector.)
- deleted 8y ago
  [deleted]
kristofferR 8y ago
The spyware is only inside the WhatsApp sandbox.
floatingatoll 8y ago
No one has confirmed whether they were able to install anything beyond the confines of the app on iOS. The press are not particularly qualified to evaluate that consideration and have been doing a poor job of blurring what’s unlikely/impossible on iOS with what’s likely/possible on Android.

deleted 8y ago

[deleted]

Since there's no version information available, I think it's safe to assume they haven't been doing it on iOS for several years.

thinkling 8y ago
It's not clear to me if you're right, but I would rephrase the issue this way: If there's a vulnerability in Whatsapp, the injected code should only affect Whatsapp. Otherwise, it's (also) a vulnerability in iOS.
- 6nf 8y ago
  That might be enough for what they are doing. At least it will allow them to spy on whatsapp messages and parts of the system that Whatsapp can access (contacts etc)
  - Moru 8y ago
    Ofcourse the whole point of Whatsapp is secure communications and I guess the exploit makes that pointless.

askvictor 8y ago

Or Android devices for that matter; app code is sandboxed and signed, and requires user interaction to download any non store code

wahern 8y ago
The secure enclaves on Android smartphones have a poor track record. Even the top-of-the-line manufacturers have seen published hacks of their TEE environments, and those are usually just the tip of the iceberg. Android is incomparable to Apple's platform in this regard. (I'm not trying to argue the iPhone is unhackable, though.) FWIW, I'm an Android user.
- jtl999 8y ago
  The Pixel 3 has a "Titan M" chip with much reduced attack surface compared to the TEE. Don't otherwise know much about it.
  - jplayer01 8y ago
    Still leaves 99,9999% of the Android market vulnerable.
    - jtl999 8y ago
      I still agree that's an issue and I'm wondering if the Titan M chip is going to be a Google exclusive or if it's going to be licensed to other OEM's at some point.

nvr219 8y ago

right?

snowwrestler 8y ago

Most likely by exploiting an iOS vulnerability . (Which might be unrelated to the WhatsApp bug, other than using it as a vector.)

deleted 8y ago
[deleted]

kristofferR 8y ago

The spyware is only inside the WhatsApp sandbox.

floatingatoll 8y ago

No one has confirmed whether they were able to install anything beyond the confines of the app on iOS. The press are not particularly qualified to evaluate that consideration and have been doing a poor job of blurring what’s unlikely/impossible on iOS with what’s likely/possible on Android.