4 ms·
To me the report sounds like an amateur job TBH and there's nothing in it to tie anything to anybody conclusively. They don't have the malware. They don't know
by m0zg 7y ago
To me the report sounds like an amateur job TBH and there's nothing in it to tie anything to anybody conclusively. They don't have the malware. They don't know which data was exfiltrated or where it went. They don't know how the supposed "malware" achieved persistence. They don't know how it worked around Apple's (rather elaborate) encryption and sandboxing.
Basically if you read the report all they really have is "Bezos received a video, and the phone started sending a bunch of data afterwards, we don't know to who, what data, or how any this was done. That'll be one million dollars in fees, Jeff, thank you very much". Maybe Bezos was just sending a bunch of dick pics to his girlfriend? Have they considered this possibility?
Could an actual, prominent security researcher take a look and confirm/disprove my suspicions?
- deleted 7y ago[deleted]
- MiroF 7y agoIf the video contains an encrypted binary as suggested in the report, then that is telling..
- m0zg 7y ago"Encrypted binary" is something that you'd say if you wanted to impress the mainstream media who can't tell a cipher from a hole in the ground. It can't run if it's fully encrypted. It'd have to decrypt itself somehow. If it can do it, it can be done outside the device, too.
- MiroF 7y agoAll I'm saying is that it is evidence that the file was in some way malicious.
- szc 7y agoThe code signing system on iOS doesn't let you dynamically add code to your app. I am also very curious about what "it is a downloader" means - if the architecture of WhatsApp means that it has a built in; externally accessible / triggerable, network capable scripting engine then that is really, really bad. I would be really worried about that app if it is true. [added] The report writer may not have chosen the best way to phrase this. What it might mean is that the investigators believe that the "malicious" payload that compromises WhatsApp is in that part of the message, not in the video. As they weren't able to get that piece, they weren't able work out how the exploit worked.
- m0zg 7y agoIt probably isn't true though. The whole document is full of red flags to me from just purely a position of a computer literate person, and I'm not even an expert at this.
- szc 7y agoSorry, I added some additional text after you replied. I now think the report is just poorly phrased and it should have said "exploit" instead of "downloader". It is very likely the exploit, once run, did download more stuff.