4 ms·
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iph
by fh9302 3y ago
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
> Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.
And since the initial bug appears to be in Google's webp library other programs are also vulnerable.
- irundebian 3y agoOkay, but I mean the initial finders of the vulnerability. If they are conducted manual code reviews, automatic static analyses or fuzzing.
- tadfisher 3y agoVisit the link in the comment to which you're replying.
- hannob 3y agoI think he is talking about NSO group, or whoever sold it to them. However, obviously that's unlikely to get revealed.
- insanitybit 3y agoI have to imagine that NSO group just watches the commit log for "I optimized webp" lol it's free CVEs
- saagarjha 3y agoAll of the above.