Motherboard:
Hackers have been breaking into iPhones allegedly using a powerful spy tool sold to governments and taking advantage of a previously unknown vulnerability in the popular messaging app WhatsApp.
The hacking tool, as well as the WhatsApp exploit, were made by the infamous Israeli hacking and surveillance tool vendor NSO Group, according to The Financial Times, which first reported the story on Monday.
And:
“The simple reality is there are so many 0-day exploits for iOS,” Stefan Esser, a security researcher that specializes in iOS, wrote on Twitter. “And the only reason why just a few attacks have been caught in the wild is that iOS phones by design hinder defenders to inspect the phones.”
And:
As of today, there is no specific tool that an iPhone user can download to analyze their phone and figure out if it has been compromised. In 2016, Apple took down an app made by Esser that was specifically designed to detect malicious jailbreaks. Moreover, iOS is so locked down that without hacking or jailbreaking it first, even a talented security researcher can do very little analysis on it.
Not clear to me if that “0-day exploits” comment is true. After all, if you don’t have the tools to break in, how would you know. But the article does make interesting points. Are there exploit-detecting tools running behind the scenes on iOS, reporting back to Apple if anything is amiss? Or is it more like, the vault is so secure we don’t need guards?
“FUD is my business” said the security researcher…
The idea that there are a lot of hacked iOS devices out there but we never hear about them is… um… unprovable. And self-serving. And good for their business.
I still remember the I Love You virus of the early 2000s… I was using a BlackBook and watching all my Windows colleagues freak out. I’d get these emails with these cute little things attached that couldn’t run on my Mac. People kept saying it was just time… but oddly enough though there were minor outbreaks, my Macs have never been infected. Now people are trying to scare me about my iOS devices… go fix Android, guys. I’m fine.
Unprovable FUD. Looks like a perfect subject for Bloomberg…
what a load of bollocks – there’s no tool to do the thing the tool is meant to alert you to. “There’s no lock pick to unlock the phone so I can see if someone else has used a lock pick”
It’s bullshit. Insecure or intentionally malicious apps are one thing; hacking the OS is something else. it’s not impossible, of course, but the level of hand-wringing and panic inducing here is very much intentional and not at all supported.
What is true is the continuing fantasy that iOS is more inherently secure than Android.
Their arguments are non sequiturs. Zero evidence exploit.
And the fact that it is true is a fantasy. It’s been demonstrated over and over and over. iOS is far from perfect. But like the two guys running from the bear, one guy says, “How do we outrun a bear?” And the guy replies, “I don’t have to be faster than the bear, just faster than you.”
You don’t need to keep telling us you value your ignorance more than our knowledge. By now even the slowest of us surely get it.