Re:Meduza co-founder's phone infected with Pegasus
by astrange on Wednesday September 13, 2023 @02:41PM
(#37500091)
> If you are a competitor to Apple spending $10M to completely destroy the $2.7T Apple is literal pocket change; too small to even show up on your financials.
You're comparing two near completely unrelated numbers here. That's not what enterprise value means; it doesn't mean much of anything really.
Re:Meduza co-founder's phone infected with Pegasus
by coderedart on Thursday September 14, 2023 @04:44AM
(#37506446)
> All they need to do is send you a message and you are compromised.
How does that even work?
Re:Meduza co-founder's phone infected with Pegasus
by filleokus on Thursday September 14, 2023 @05:46AM
(#37506858)
For example by finding an exploit in parsers of media "attachments": https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
Re:Meduza co-founder's phone infected with Pegasus
by Muromec on Thursday September 14, 2023 @06:04AM
(#37506967)
It works the usual way -- you make a payload that, when processed by a buggy code, executes itself. If the buggy code happens to be SMS packet parser, image decoder, text rendering, blocklist check or another 2 millions of things that happen to show you incoming SMS (or even better, flash message, or something not visible to user), then you don't have to click on it.
I mean if the bug in the browser, you have to visit the page to have the payload get to you, but it's a phone. A device for other people to contact you.
Re:Meduza co-founder's phone infected with Pegasus
by nwsm on Thursday September 14, 2023 @10:28AM
(#37509512)
Here's an example of a real iOS SMS bug exploit delivered by SMS-
https://www.forbes.com/sites/amitchowdhry/2015/05/29/apple-e...
They presumably also configure their command and control to only persist if it is one of the designated targets and wipe all traces if it is not, so even forwarding the attack payload would probably not do anything.
You would need to determine you have been compromised and then reverse engineer the exploit so you could replace the command payload with a irreversible bricking operation to do what you suggest.
At that point you might as well spend the $5M-$10M to develop the entire attack yourself. If you are a competitor to Apple spending $10M to completely destroy the $2.7T Apple is literal pocket change; too small to even show up on your financials.