3 ms·

Well, it wasn’t phishing. If the claims are correct, just opening the link would have compromised the phone. If that’s true, I find it try extraordinary. Phish

Well, it wasn’t phishing. If the claims are correct, just opening the link would have compromised the phone. If that’s true, I find it try extraordinary. Phishing is just having a fake webpage asking for credentials, right? Infecting a phone with spyware just by visiting a webpage is much harder and much worse.

bawolff 2y ago
Spear phishing is usually inclusive of attacks from an email that involve tricking the user into doing something unsafe. E.g. see definition https://www.trendmicro.com/vinfo/us/security/definition/spear-phishing https://www.trendmicro.com/vinfo/us/security/definition/spea... > If the claims are correct, just opening the link would have compromised the phone I'm not sure if that is being claimed. The twitter post just said the link would have "exposed" them to spyware. One possible interpretation is that simply viewing the link in a web browser would be enough, but i think another interpretation is that the link contained some sort of malicious download. No way to know with the info we are given. I agree that a zero-day in a web browser would certainly be more interesting, i'm just not sure that is the case here.
- paulmd 2y ago
  this is exactly the kind of scenario where you’d expect to find a high-value zero-day deployed (state-level actor against a known, high-value target) so I see no reason to disregard the actual claim in favor of a lesser one. yes, this class of exploits definitely exists (a while ago there was one that worked just receiving a text message!) and is the primary reason why apple offers the lockdown mode for these sorts of people who actually might be the target of these advanced threats. Lockdown mode severely reduces the amount of “auto” shit that happens in the background, which ruins the experience but is also more secure against this style of attack.
  - talldayo 2y ago
    Most importantly, it saves the real backdoors for American intelligence partners and the Chinese government. That way, it's only the citizens being spied on and not the puritan parliament members or Congresspeople. The first rule of iPhone security is that you do not control the attack surface against a sufficiently large government.

bawolff 2y ago

Spear phishing is usually inclusive of attacks from an email that involve tricking the user into doing something unsafe. E.g. see definition https://www.trendmicro.com/vinfo/us/security/definition/spear-phishing https://www.trendmicro.com/vinfo/us/security/definition/spea... > If the claims are correct, just opening the link would have compromised the phone I'm not sure if that is being claimed. The twitter post just said the link would have "exposed" them to spyware. One possible interpretation is that simply viewing the link in a web browser would be enough, but i think another interpretation is that the link contained some sort of malicious download. No way to know with the info we are given. I agree that a zero-day in a web browser would certainly be more interesting, i'm just not sure that is the case here.

paulmd 2y ago
this is exactly the kind of scenario where you’d expect to find a high-value zero-day deployed (state-level actor against a known, high-value target) so I see no reason to disregard the actual claim in favor of a lesser one. yes, this class of exploits definitely exists (a while ago there was one that worked just receiving a text message!) and is the primary reason why apple offers the lockdown mode for these sorts of people who actually might be the target of these advanced threats. Lockdown mode severely reduces the amount of “auto” shit that happens in the background, which ruins the experience but is also more secure against this style of attack.
- talldayo 2y ago
  Most importantly, it saves the real backdoors for American intelligence partners and the Chinese government. That way, it's only the citizens being spied on and not the puritan parliament members or Congresspeople. The first rule of iPhone security is that you do not control the attack surface against a sufficiently large government.