←back to thread

ICE obtains access to Israeli-made spyware that hack phones and encrypted apps

(www.theguardian.com)
192 points pera | 3 comments | 02 Sep 25 18:12 UTC | HN request time: 0.001s | source
Show context
OutOfHere ◴[02 Sep 25 19:56 UTC] No.45108214[source]▶
There are three main categories of entry into a device via zero-days: WhatsApp/Signal, SMS/MMS, and Firefox/Chrome/Safari. If these can be isolated, entering a device could become harder.
replies(4): >>45108228 #>>45108305 #>>45109523 #>>45112057 #
1. upofadown ◴[02 Sep 25 21:47 UTC] No.45109523[source]▶
SMS is inherently plain text. I think a user would have to click on a link for an attack to work.
replies(2): >>45109586 #>>45110313 #
2. PieTime ◴[02 Sep 25 21:52 UTC] No.45109586[source]▶
They have developed zero click exploits before
3. OutOfHere ◴[02 Sep 25 23:11 UTC] No.45110313[source]▶
Link previews would do the trick, and let me confirm that the Google Messages app for SMS does show link previews with no way to disable them.

"Expressive animations" are yet another vector because their rendering can be exploited.

As for MMS, it is a known prominent risk.