Hacker News Reader

Comment by jacquesm | Hacker News Reader

I would totally expect this kind of thing to be already in the wild for the simple reason that people have been saying this sort of thing is possible for many years, it is just not the sort of thing that once the parties capable of doing it have found a practical exploit that they are then going to turn around and publish it to make the world a better place.

On the contrary, it will be hoarded and used against suitable targets.

An earlier hacker news thread around this theme:

https://news.ycombinator.com/item?id=10905643

View on HN

In the wild as in "being actively exploited" yes, that's quite possible, but it's not a practical exploit for large-scale hacks on devices.

The required firmware changes are likely to be somewhat different for each version of the radio hardware and firmware and each carrier's OS variants. That means that you'd either need a very sophisticated set of exploit code (which means complicated and bulky when you may not have a lot of space to play with and may be working in hand-optimized assembler) or that you need to narrow your focus to only specified handsets. Even after that, you then have to have a WiFi access point pushing this, so even if you're in a high-traffic area such as a city downtown or an airport you're going to impact a relatively small percentage of devices.

If you have control of a large botnet of compromised WiFi routers you might be able to push this from those, but the more you do that the more likely you are to be discovered, and you're still going to have the problem of selectivity.

What this all translates to is that exploiting this on a wide scale would require a lot of resources and extremely skilled developers while also being at fairly high risk of detection. Using this for highly targeted attacks on the other hand would allow for less work generalizing the attack and could probably go undetected. Further, if someone not a state actor has "weaponized" this their best option for making money on it would likely be to sell the exploit to either a government or to one of the groups who specializes in targeted hacking.

It all depends on who you are. Politician or CEO of a multinational or a company related to defense? Political activist? Enemy of the state? The opposition? Hacker?

It doesn't have to be 'large scale' to be effective and given how hidden an attack like this could be (and how easy it would be to erase the fact that it was even there) it may have been used on your device and you still wouldn't be aware of it or able to prove that it was.

If you do a little bit of "open source intelligence" you can find the author of this exploit used to be employed in an Isreali Defense Force - Elite Technological Unit.

Read between the lines where he got the idea to do an exploit like this.

There probably is a revolving door between the top tech companies and the various intelligence agencies. Nice sleuthing!

I dunno about revolving. The pay in the private sector is very good. Tons of folks who worked in the IDF end up at tech companies for two reasons:

(1) almost everyone goes through the IDF thanks to mandatory service

(2) if you have aptitude you end up in the signal Corp, who are good at what they do.

I wouldn't call this a conspiracy, and the parents speculation is very thin. If the author got this from the IDF they almost certainly wouldn't be publishing; breaking that kind of confidentiality can end really badly

Reply on news.ycombinator.com