10 ms·
> It's impossible to use this covertly. *Unless there's a zero-day that allows it.
by daveguy 1y ago
> It's impossible to use this covertly.
*Unless there's a zero-day that allows it.
- grishka 1y agoIf you're going to exploit a privilege escalation vulnerability from your app, why not just grab the most interesting parts of the /data partition while you're at it?
- daveguy 1y agoSure why not. I wasn't implying that a zero day that allows surreptitiously recording the phone screen is the only shitty thing that can be done with your phone with a zero day. Also, it is possible for a zero day to break specific privileges (like screen record without notification) rather than root.
- DrillShopper 1y agoYou could do both
- simonw 1y agoBurning a zero-day like that for targeted advertising seems extremely unlikely to me.
- deleted 1y ago[deleted]
- daveguy 1y agoI think you missed the point GP was making. I believe they meant the vector might come from that kind of SDK. Not that someone who had a zero day to allow surreptitiously recording phone screens would use it for that purpose.