4 ms·
>"as @AmnestyTech observed and we @citizenlab can confirm, NSO Group's Pegasus spyware delivered via 0-click exploits is no longer "persistent" in the strict se
by Dah00n 5y ago
>"as @AmnestyTech observed and we @citizenlab can confirm, NSO Group's Pegasus spyware delivered via 0-click exploits is no longer "persistent" in the strict sense of the word (i.e., doesn't come back when you reboot). Persistence is achieved via firing the 0-click again. Because the 0-clicks they're using appear to be quite reliable, the lack of traditional "persistence" is a feature, not a drawback of the spyware. It makes the spyware more nimble, and prevents recovery of the "good stuff" (i.e., the spyware and exploits) from forensic analysis."
Oh that's bad.
- arkadiyt 5y agoOn the plus side, having persistence means attackers retain access through iOS updates. Their "persist-less" exploits will eventually be patched by Apple, at which point anyone who applies the update has a clean device.
- sjtgraham 5y agoAll exploits stop working once they're patched.
- colejohnson66 5y agoIt’s a reference to bootrom-level exploits. The bootrom is burned into the silicon and can’t be updated. If one finds an exploit in there, Apple can’t patch it without new chips.
- saurik 5y agoBut those still might or might not be persistent. If you need to once again obtain physical access to use your exploit every time the user reboots, it isn't persistent even if the involved exploits are are unpatchable.
- WatchDog 5y agoIf they have a shell on the device, they can choose to persist it whenever they like. Should an ios update be released that patches their exploit, chances are, they can persist the exploit before the device installs the newest version.
- gjsman-1000 5y agoNot really. When the device reboots, hardware root of trust takes over and the bug must be manually, externally exploited to regain control. There has not been a single known bug granting persistent loading across a reboot since iOS 9.
- koolba 5y agoDoes that mean people should be rebooting their phones every week / day / hour?
- Twisell 5y agoI guess it mean it never hurt if you have any doubt. In this case however, It wouldn't have been sufficient as the virus will reinstall quickly through the command center. If not data for a tracked device show up after a set timeout, the command center will resend a corrupted iMessage to reinfect. In all case apply security update asap and regularly, they imply reboot and patch as much exploit as possible.
- tomjen3 5y agoThat means if we can find an active device being exploited, we can cause them to send the attack to any device of our choosing and so find the zero-day. And the command center.
- Leparamour 5y ago>cause them to send the attack to any device of our choosing Can you explain what you mean? Can you clone/simulate an Apple device?
- swiley 5y agoI'm sure the affected people are glad to know other people won't have their secrets divulged.
- saurik 5y agoThat isn't how that word is normally used, AFAIK? Even most "persistent" attacks are thwarted by device updates on iOS; to get persistence through an update that fixes the underlying exploit you are using would involve messing with the update mechanism itself and refusing to update at least that part and then like, trying to simulate the update to look like it was still updated... and due to how Apple's software architecture tends to assume everything is updated at once, trying to show the user a new userland (what the user will experience) but with an old kernel (a prerequisite to maintain access if your bugs came in userland as otherwise the new kernel will refuse to run the old exploitable code)--particularly as your attack might not give you the ability to modify much kernel behavior--is actually quite difficult. (Also, the firmware update process on iOS has different ways of being kicked off: if you do it over USB from iTunes, you might not have an opportunity to mess with the process at all.)
- gjsman-1000 5y agoIt also means journalist should probably get in the habit of frequent device reboots, which will erase any malware.
- Leparamour 5y agoIt's probably better than doing nothing but it doesn't sound very effective. With zero-click they'd just reinfect the device immediately.
- tomjen3 5y agoIf they have that many good zero-days, we need to rake Apple over some (metaphorical) coals until they get their shit together. I am not sure rewriting iMessage in rust would be the answer, but it would be a start. Another start would be to refuse to sell iPhones to Israel as long as they do this.