3 ms·
I think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsAp
by chatmasta 7y ago
I think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsApp exploit. So, the obvious question: which operating systems were specifically targeted?
Another comment mentions Pegasus... that was an iOS exploit patched in 9.3.5 (3 years ago). Does that line up with the timeline of this article?
Given that Android exploits are far more common than iOS, I would expect they had one of those too.
But then, where are Apple and Google in this case? It wasn't solely Facebook who was exploited; their app was just the initial vector to escalate to an attack on the OS. NSO probably could have achieved the same with dozens of other apps, but WhatsApp was chosen because of ease of deliverability (messaging) and popularity.
- lol768 7y ago>Given that Android exploits are far more common than iOS, I would expect they had one of those too. The Pixel was the only device that was not pwned in the 2017 Mobile Pwn2Own competition - the iPhone, running iOS 11.1, was exploited 4 times via both WiFi and Safari. I'd be incredinly surprised if NSO were able to compromise an up to date Pixel phone.
- chatmasta 7y agoThat’s great for the Pixel. But what percent of Android phones are the Pixel, and not one of the hundreds of other varieties with varying patch schedules? (That’s not entirely snark. I do wonder how high risk individuals are choosing which devices they use for communication.)
- NPC32419419 7y agoWhat about Android One devices with their monthly patches from Google?
- saagarjha 7y agoThat by itself doesn’t mean much; very few people use Pixel devices and there’s significantly less attention put on it.