2 ms·
Did anyone grock how this is working? I just scanned the code quickly, for WhatsApp It looks like it’s extracting your message backups - basically recreating wh
by twobitshifter 5y ago
Did anyone grock how this is working? I just scanned the code quickly, for WhatsApp It looks like it’s extracting your message backups - basically recreating what a hack would do? I then assume that it compares these extracts to what’s leftover on the device and wasn’t cleaned up?
- dannyw 5y agoIt looks at various indicators of compromise that are linked to malicious compromise. As one specific example, Pegasus is known to try and hide its tracks by deleting some log files. Their deletion is incomplete and corrupts the log database though, so it produces a very traceable, "you have been hit by Pegasus" indicator. A (partial) list of Pegasus C&C servers is also known, and some iOS log files store hostnames you have connected to in the past. It's fairly standard IoC analysis -- lots of malware leave traces on the client endpoint in question.
- deleted 5y ago[deleted]