5 ms·

No, they use zero-day exploits in common media formats. The spy sends you a message containing an image or pdf, your device parses it, is exploited, and then re

No, they use zero-day exploits in common media formats. The spy sends you a message containing an image or pdf, your device parses it, is exploited, and then removes the message, before there ever is a notification about it. You will never know that it ever happened. For example, see FORCEDENTRY, which is one of theirs, and the technical deep dive of it is about the most amazing piece of technical writing released last year: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

heavenlyblue 5y ago
I can't believe that all text messages aren't stored somewhere on the NSA (or equiv.) server (so it should be easy to quickly find the zero-day after a single attack). They probably just aren't motivated enough to expose the zero-days associated with it.
- alufers 5y ago
  How would you know how a message contains an exploit before you know such an exploit even exists? Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.
  - dogma1138 5y ago
    iPhones still can send and receive an SMS, it’s also not particularly difficult to send an crafted iMessage, a lot of these exploits also chain multiple exploits so an RCE in a 3rd party messaging app with a sandbox/privesc on the local device. And even without that if you get an RCE within the context of a messaging app you might be able to get most of what you need since you probably would be able to read / write arbitrary memory within the context of that process and interact with which ever APIs the app has permissions for which for messaging almost always includes microphone and camera and often location too. The only thing you don’t get from running an exploit within the context of a single app is usually persistence but if your exploit can survive the app being suspended then as most people rarely reboot their phones you can get pretty long lived sessions too.
- solarkraft 5y ago
  Why would the NSA be motivated to find these vulnerabilities? They already have access to Pegasus :-) ... you don't think they're interested in closing them, do you?
  - nisegami 5y ago
    Isn't the NSO on an entity list now? That should mean that the NSA no longer has access to Pegasus.
    - dogma1138 5y ago
      Do you really think that the NSA would be bound by sanctions? They’ll ping the Israeli government and ask for access if they need it and they won’t be turned down it would be just a matter of price. The NSO isn’t a state run outfit outright but it has been used by Israel to score foreign relationship wins just like any other export and specifically arms export are used by other governments. NSO is literarily the bargain bin option when it comes to SIGINT/COMINT, and for most of their clients they are pretty much the only option to get a high end targeted capability to compromise mobile devices.
bigbizisverywyz 5y ago
It was an amazing technical achievement that they pulled off, but also a lot of work instantly destroyed with one patch. Somebody's day got ruined when that was discovered. And kudos to the Google project zero guys for an amazing writeup.
- dannyw 5y ago
  Nobody's day is ruined; they'd certainly have multiple zero-click zero-days in the backburner.

heavenlyblue 5y ago

I can't believe that all text messages aren't stored somewhere on the NSA (or equiv.) server (so it should be easy to quickly find the zero-day after a single attack). They probably just aren't motivated enough to expose the zero-days associated with it.

alufers 5y ago
How would you know how a message contains an exploit before you know such an exploit even exists? Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.
- dogma1138 5y ago
  iPhones still can send and receive an SMS, it’s also not particularly difficult to send an crafted iMessage, a lot of these exploits also chain multiple exploits so an RCE in a 3rd party messaging app with a sandbox/privesc on the local device. And even without that if you get an RCE within the context of a messaging app you might be able to get most of what you need since you probably would be able to read / write arbitrary memory within the context of that process and interact with which ever APIs the app has permissions for which for messaging almost always includes microphone and camera and often location too. The only thing you don’t get from running an exploit within the context of a single app is usually persistence but if your exploit can survive the app being suspended then as most people rarely reboot their phones you can get pretty long lived sessions too.
solarkraft 5y ago
Why would the NSA be motivated to find these vulnerabilities? They already have access to Pegasus :-) ... you don't think they're interested in closing them, do you?
- nisegami 5y ago
  Isn't the NSO on an entity list now? That should mean that the NSA no longer has access to Pegasus.
  - dogma1138 5y ago
    Do you really think that the NSA would be bound by sanctions? They’ll ping the Israeli government and ask for access if they need it and they won’t be turned down it would be just a matter of price. The NSO isn’t a state run outfit outright but it has been used by Israel to score foreign relationship wins just like any other export and specifically arms export are used by other governments. NSO is literarily the bargain bin option when it comes to SIGINT/COMINT, and for most of their clients they are pretty much the only option to get a high end targeted capability to compromise mobile devices.

bigbizisverywyz 5y ago

It was an amazing technical achievement that they pulled off, but also a lot of work instantly destroyed with one patch. Somebody's day got ruined when that was discovered. And kudos to the Google project zero guys for an amazing writeup.

dannyw 5y ago
Nobody's day is ruined; they'd certainly have multiple zero-click zero-days in the backburner.