4 ms·

This is a good reminder for why to not download random PDFs. One of the mechanisms of the Pegasus spyware was emulating a computer inside a PDF. https://en.wik

This is a good reminder for why to not download random PDFs. One of the mechanisms of the Pegasus spyware was emulating a computer inside a PDF. https://en.wikipedia.org/wiki/Pegasus_(spyware)#Vulnerabilities https://en.wikipedia.org/wiki/Pegasus_(spyware)#Vulnerabilit...

geor9e 2y ago
A tetris PDF could be in a 1 pixel iframe right on this page and you'd never know it. So it doesn't require any user action to download one.
- sexy_seedbox 2y ago
  That's why you run NoScript along side with UBO
  - geor9e 2y ago
    I'm pretty sure noscript will break 90% of the webpages I visit. I just rawdog the internet. If Chrome gets 0day'd then a lot of us are going down - at least I'll have company.
    - throwaway2037 2y ago
      > If Chrome gets 0day'd then a lot of us are going down If anything, Google would have the correct incentive to protect itself from a zero-day exploit. I guess they could release a patched version internally only, but I doubt it. I do think they want the image of Chrome to be relatively positive and giant security hole (patched slowed) would do them no favours.
  - grgergo 2y ago
    This PDF still runs with JS disabled in both of those, and in Firefox about:config...
poincaredisk 2y ago
The vulnerability was in images parsing, and exploit was distributed by sending an imessage to the target. So don't open any images, and don't read imessages. They are also known to use browser exploits, so don't visit random websites. That was sarcasm, in case it's not clear over the internet. Telling people to avoid "suspicious" pdfs/websites is common but ultimately not very useful advice. The real takeaway is: don't become a target of a nation state intelligence agency. If you own a phone, they can take over it, and there's nothing you can do.
- cess11 2y ago
  The Pegasus Project has shown that pretty much anyone could be targeted. It's enough to know someone in a publicly owned company or publicly say something negative about corruption or just be in the wrong place at the wrong time. Nothing you do will guarantee that the state won't come after you.
- sgerenser 2y ago
  If you’re really worried about this and you use an iPhone, then you should be using Lockdown Mode: https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120

geor9e 2y ago

A tetris PDF could be in a 1 pixel iframe right on this page and you'd never know it. So it doesn't require any user action to download one.

sexy_seedbox 2y ago
That's why you run NoScript along side with UBO
- geor9e 2y ago
  I'm pretty sure noscript will break 90% of the webpages I visit. I just rawdog the internet. If Chrome gets 0day'd then a lot of us are going down - at least I'll have company.
  - throwaway2037 2y ago
    > If Chrome gets 0day'd then a lot of us are going down If anything, Google would have the correct incentive to protect itself from a zero-day exploit. I guess they could release a patched version internally only, but I doubt it. I do think they want the image of Chrome to be relatively positive and giant security hole (patched slowed) would do them no favours.
- grgergo 2y ago
  This PDF still runs with JS disabled in both of those, and in Firefox about:config...

poincaredisk 2y ago

The vulnerability was in images parsing, and exploit was distributed by sending an imessage to the target. So don't open any images, and don't read imessages. They are also known to use browser exploits, so don't visit random websites. That was sarcasm, in case it's not clear over the internet. Telling people to avoid "suspicious" pdfs/websites is common but ultimately not very useful advice. The real takeaway is: don't become a target of a nation state intelligence agency. If you own a phone, they can take over it, and there's nothing you can do.

cess11 2y ago
The Pegasus Project has shown that pretty much anyone could be targeted. It's enough to know someone in a publicly owned company or publicly say something negative about corruption or just be in the wrong place at the wrong time. Nothing you do will guarantee that the state won't come after you.
sgerenser 2y ago
If you’re really worried about this and you use an iPhone, then you should be using Lockdown Mode: https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120