<story><title>Journalist’s phone hacked: all he had to do was visit any website</title><url>https://www.thestar.com/news/canada/2020/06/21/journalists-phone-hacked-by-new-invisible-technique-all-he-had-to-do-was-visit-one-website-any-website.html</url></story><parent_chain><item><author>roblabla</author><text>A code execution vulnerability isn&amp;#x27;t enough. To work on truly any website, they need:&lt;p&gt;- A remote code execution vulnerability. There are almost certainly multiple vulnerabilities at play here, since long gone are the days where a single vuln gave arbitrary code execution.&lt;p&gt;- a way to bypass the encryption&amp;#x2F;https, unless the remote code execution was on a layer before encryption (which seems unlikely). EDIT: Apparently the hack only works on non-encrypted websites.&lt;p&gt;- Once remote code is achieved, they most certainly need a way to elevate privileges in order to make the hack more persistent and tap into other apps.&lt;p&gt;There are most likely several CVEs at play here. The amount of effort that went into this hack is, frankly, terrifying.</text></item><item><author>hn_throwaway_99</author><text>I saw this discussed on reddit, and I was surprised that there was so much confusion about how this happened. It wasn&amp;#x27;t just &amp;quot;network injection&amp;quot; - quite clearly (unfortunately very poorly described in the article) there was a vulnerability in iOS&amp;#x2F;Safari that allowed remote code execution; network injection alone wouldn&amp;#x27;t have been enough. Does anyone know what the CVE was that allowed this?</text></item></parent_chain><comment><author>afuchs</author><text>From my understanding, it is easy enough to bypass HTTPS encryption if you need to intercept traffic for an attack like this. You only need to intercept and modify the traffic for &lt;i&gt;a&lt;/i&gt; website, not a specific website.&lt;p&gt;There are still websites that don&amp;#x27;t use HTTPS.&lt;p&gt;For websites that do use HTTPS, if they haven&amp;#x27;t configured something like HSTS, HPKP or Expect-CT, typing example.com into a web browser will make it will send an unencrypted HTTP request to &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.com&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.com&lt;/a&gt;. If the website&amp;#x27;s content is served only HTTPS, the server will most likely respond with something that redirects the web browser to the HTTPS version of the website (most likely a HTTP 301 or 302 status code). The initial unencrypted HTTP request can be intercepted and modified.</text></comment>
<story><title>Journalist’s phone hacked: all he had to do was visit any website</title><url>https://www.thestar.com/news/canada/2020/06/21/journalists-phone-hacked-by-new-invisible-technique-all-he-had-to-do-was-visit-one-website-any-website.html</url></story><parent_chain><item><author>roblabla</author><text>A code execution vulnerability isn&amp;#x27;t enough. To work on truly any website, they need:&lt;p&gt;- A remote code execution vulnerability. There are almost certainly multiple vulnerabilities at play here, since long gone are the days where a single vuln gave arbitrary code execution.&lt;p&gt;- a way to bypass the encryption&amp;#x2F;https, unless the remote code execution was on a layer before encryption (which seems unlikely). EDIT: Apparently the hack only works on non-encrypted websites.&lt;p&gt;- Once remote code is achieved, they most certainly need a way to elevate privileges in order to make the hack more persistent and tap into other apps.&lt;p&gt;There are most likely several CVEs at play here. The amount of effort that went into this hack is, frankly, terrifying.</text></item><item><author>hn_throwaway_99</author><text>I saw this discussed on reddit, and I was surprised that there was so much confusion about how this happened. It wasn&amp;#x27;t just &amp;quot;network injection&amp;quot; - quite clearly (unfortunately very poorly described in the article) there was a vulnerability in iOS&amp;#x2F;Safari that allowed remote code execution; network injection alone wouldn&amp;#x27;t have been enough. Does anyone know what the CVE was that allowed this?</text></item></parent_chain><comment><author>titanomachy</author><text>A huge amount of effort went into &lt;i&gt;developing&lt;/i&gt; this hack. Then the company NSO productized the hack and sold it to governments.</text></comment>