4 ms·
I’ve always been curious to know .. with all of the random 0-days in mobile operating systems (iOS, for example) How do you know that an attacker is not persis
by ratg13 3y ago
I’ve always been curious to know .. with all of the random 0-days in mobile operating systems (iOS, for example)
How do you know that an attacker is not persisting in the system if you click a bad link before a patch gets applied?
- dmitrygr 3y agoPersisting in the fs is much harder than just getting code execution. Not impossible (nothing is) but much harder (and thus likely less common), due to signature checking
- _8j50 3y agoYou're assuming a click/tap is involved. Several iOS exploits are 0-click.
- ratg13 3y agoYour pedantry is noted, but this would not change the answer to the question at all.
- _8j50 3y agoPersistence is not needed when they can just access your device any time. That part was what addressed your question.
- ratg13 3y agoThanks for clearing that up. My question was meant more about after a device is patched.. how you can know it's secure.
- _8j50 3y agoForensic approach is to get a disk image(iOS just has backups) and analyze that. You can't ever be 100% sure. Can't prove a negative (no compromise) you can only prove positives based on the state of the device you can measure. Personally, I only use mobile devices for internet browsing and using apps like uber, I only have like one app I should probably stop using but to the most part I always assume any mobile device out there is or can readily be compromised.
- Gigachad 3y agoWould be pretty difficult to find an exploit that avoids the boot chain attestation features. Good reason why a lot of exploits require you to reapply them every reboot.