3 ms·

I'm more interested in the "how" of this. Are these intentional backdoors, and what qualifies this group to be privy to the information flows to exploit them? W

I'm more interested in the "how" of this. Are these intentional backdoors, and what qualifies this group to be privy to the information flows to exploit them? What sort of connections do they have? Are these backdoors/bugs in the baseband or are they in userspace? If it's not an intentional backdoor, do they just have vastly superior technical ability? How did they hire such a talented pool of people, able to consistently find remotely exploitable 0days in every major smartphone brand? This group isn't new, they've been around for over a decade doing this. I doubt they've monetized a single exploit for 10 years. They're adapting. If I had to bet, I'd bet on the former, but I'm curious what everyone else thinks. It just seems unreasonable to me that there exists such a talented pool of exploiters, all aggregated in the same place, able to consistently find 0days that nobody else seems to be able to find.

bagomips 5y ago
My own take is that some exploits initially fall through the cracks in a social way when being triaged or getting somewhat inadequate fixes. It becomes harder to go back and correct the initial triage. At the same time, some people in the company might be connected to their governments and help that bug stay in the grey zone probably not for the NSO group but maybe for the NSA. (Of course this only applies if the exploit is one the government identified and decided to use offensively and doesn't think is being used in the wild.) Now when you are examining images as a company updates them, you are reviewing what's notable in the fixes in the very least to know how to attack older OSes. You might happen to have the perspective that understands how the triage was wrong. With enough bugs like this it is inevitable that sometimes you will if you can afford to analyze every fix.

bagomips 5y ago

My own take is that some exploits initially fall through the cracks in a social way when being triaged or getting somewhat inadequate fixes. It becomes harder to go back and correct the initial triage. At the same time, some people in the company might be connected to their governments and help that bug stay in the grey zone probably not for the NSO group but maybe for the NSA. (Of course this only applies if the exploit is one the government identified and decided to use offensively and doesn't think is being used in the wild.) Now when you are examining images as a company updates them, you are reviewing what's notable in the fixes in the very least to know how to attack older OSes. You might happen to have the perspective that understands how the triage was wrong. With enough bugs like this it is inevitable that sometimes you will if you can afford to analyze every fix.