• @jet@hackertalks.com
    link
    fedilink
    English
    429 days ago

    Not necessarily true. It could be a buffer overflow in text message processing, it’s still requires a text message to be sent to the phone.

    It could be a Wi-Fi or Bluetooth exploit, which requires locality.

    It could be a browser, webview, certificate exploit that requires a sophisticated chain of events with a low probability to intercept a web page and get the user to do something that isn’t guaranteed.

    The exploit might display itself to a user on the phone, so every time it’s applied there’s a risk of discovery.

    Not to mention many advanced persistent threats do not want their exploits to be analyzed, so they will not leave them sitting around to be collected, just waiting for the device to need a reinfection. That’s valuable signals capability that you give to your adversary they just need to analyze it.