4 ms·

Sounds more like it missed. They sent him a link, and he was wise enough to not click on it.

throwawaydummy 2y ago
Don’t we live in a world where zero click exploits are a thing? I thought the target didn’t have to click the links just receive them
- PaywallBuster 2y ago
  not all of them are zero click :)
- xn7 2y ago
  Zero click exploits are a thing, but they are very expensive and have limited shelf life (once they have been used a few times, they tend to get found out and patched). Most actors won’t use one, unless it is a very, very high value target. It seems that the EU parliament member was not high value enough, and got lucky.
- trueismywork 2y ago
  That's why I disable HTML in emails
  - seanhunter 2y ago
    Just to be aware that's a start but it's not a full mitigation. Some of the prominent zeroclick exploits have been "rich content" in messaging products such as whatsapp[1] and imessage[2]. Definitely not an expert but I'm presuming they take advantage of the "helpful" behaviour those apps have to preview content and then pair that with some sort of exploit in the library that parses/displays the content. So say they have an exploit in a jpeg library that whatsapp uses then they send a specially-crafted jpeg via whatsapp, whatsapp "previews" the image and that triggers the exploit to compromise the jpeg library and pwn the user. [1] https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... [2] https://appleinsider.com/articles/23/06/01/zero-click-ios-malware-attack-through-imessage-is-actively-infecting-iphones https://appleinsider.com/articles/23/06/01/zero-click-ios-ma...
echoangle 2y ago
I wonder how that was supposed to work? Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? Chrome on Android and WebKit on iOS? That would be concerning, but how realistic is that?
- chmod775 2y ago
  Very. These companies pay good money for 0 days and invest considerable effort into finding their own. Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.
- spurgu 2y ago
  I would guess/assume that work phones of MEPs are restricted to a specific set of manufacturers and models, which makes targeting different from having to consider all options. They might also have specific software installed across most of them that could be part of the targeting.
- chatmasta 2y ago
  Yes, but the exploits are so valuable/expensive that they’ll only use them during targeted operations. Otherwise they risk burning the exploit. So just remain uninteresting and you should be safe.
- talldayo 2y ago
  > Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? This has been the reality of mobile phone security for almost a decade now. Any sufficiently-complex digital system will be rife with UB and exploits.
- Veserv 2y ago
  Would cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.

Don’t we live in a world where zero click exploits are a thing? I thought the target didn’t have to click the links just receive them

PaywallBuster 2y ago
not all of them are zero click :)
xn7 2y ago
Zero click exploits are a thing, but they are very expensive and have limited shelf life (once they have been used a few times, they tend to get found out and patched). Most actors won’t use one, unless it is a very, very high value target. It seems that the EU parliament member was not high value enough, and got lucky.
trueismywork 2y ago
That's why I disable HTML in emails
- seanhunter 2y ago
  Just to be aware that's a start but it's not a full mitigation. Some of the prominent zeroclick exploits have been "rich content" in messaging products such as whatsapp[1] and imessage[2]. Definitely not an expert but I'm presuming they take advantage of the "helpful" behaviour those apps have to preview content and then pair that with some sort of exploit in the library that parses/displays the content. So say they have an exploit in a jpeg library that whatsapp uses then they send a specially-crafted jpeg via whatsapp, whatsapp "previews" the image and that triggers the exploit to compromise the jpeg library and pwn the user. [1] https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... [2] https://appleinsider.com/articles/23/06/01/zero-click-ios-malware-attack-through-imessage-is-actively-infecting-iphones https://appleinsider.com/articles/23/06/01/zero-click-ios-ma...

echoangle 2y ago

I wonder how that was supposed to work? Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? Chrome on Android and WebKit on iOS? That would be concerning, but how realistic is that?

chmod775 2y ago
Very. These companies pay good money for 0 days and invest considerable effort into finding their own. Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.
spurgu 2y ago
I would guess/assume that work phones of MEPs are restricted to a specific set of manufacturers and models, which makes targeting different from having to consider all options. They might also have specific software installed across most of them that could be part of the targeting.
chatmasta 2y ago
Yes, but the exploits are so valuable/expensive that they’ll only use them during targeted operations. Otherwise they risk burning the exploit. So just remain uninteresting and you should be safe.
talldayo 2y ago
> Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? This has been the reality of mobile phone security for almost a decade now. Any sufficiently-complex digital system will be rife with UB and exploits.
Veserv 2y ago
Would cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.