3 ms·

Don’t we live in a world where zero click exploits are a thing? I thought the target didn’t have to click the links just receive them

• PaywallBuster 2y ago
  not all of them are zero click :)
• xn7 2y ago
  Zero click exploits are a thing, but they are very expensive and have limited shelf life (once they have been used a few times, they tend to get found out and patched). Most actors won’t use one, unless it is a very, very high value target. It seems that the EU parliament member was not high value enough, and got lucky.
• trueismywork 2y ago
  That's why I disable HTML in emails
  • seanhunter 2y ago
    Just to be aware that's a start but it's not a full mitigation. Some of the prominent zeroclick exploits have been "rich content" in messaging products such as whatsapp[1] and imessage[2]. Definitely not an expert but I'm presuming they take advantage of the "helpful" behaviour those apps have to preview content and then pair that with some sort of exploit in the library that parses/displays the content. So say they have an exploit in a jpeg library that whatsapp uses then they send a specially-crafted jpeg via whatsapp, whatsapp "previews" the image and that triggers the exploit to compromise the jpeg library and pwn the user. [1] https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... [2] https://appleinsider.com/articles/23/06/01/zero-click-ios-malware-attack-through-imessage-is-actively-infecting-iphones https://appleinsider.com/articles/23/06/01/zero-click-ios-ma...