Hacker News Reader

Comment by egonschiele | Hacker News Reader

I read that if Pegasus is on your phone, even a factory reset will not get rid of it. Could someone explain why?

I am not an expert, but my belief is that Pegasus does not maintain persistence.

While the Wikipedia article claims Pegasus "jailbreaks" the iPhone to maintain persistence. Every technical article I've read says that a reboot clears Pegasus (albeit, it is easy to re-infect with a no-click exploit without the user's knowledge).

Hopefully, someone more knowledgeable can chime in with citations.

Generally these attacks do not persist, as this is quite a bit more challenging.

Haven't read about Pegasus, but what you describe is the behavior of bootkits. Factory reset does not imply that you erase 100% of your permanent storage: some part of it should contain the system programs to restore the system. If these system programs or the clean OS image are modified, then factory reset won't help

I don’t know about the original claim either way, but I would be even more impressed and scared if it survived an iTunes restore (basically a PC reflashes the iPhone’s OS image with an image downloaded from Apple.)

If the malware controls the bootloader nothing will help: it can imitate any kind of restore, modifying the OS image on the fly

everything is signed.

should not be even remotely possible

Should. But we are talking about software vulnerabilities here. It means that things do not work as intended.

All code is signed on Apple’s platforms. Most exploits have a codesigning bypass of some sort.

Apple has firmware restore features in ROM. I would also assume (hope?) that there’s a procedure to enter the ROM-based restore that is impossible to intercept in software (maybe holding the power button for 10 seconds initiates a hardware reset into the ROM.)

There is.

Here is a very technical breakdown of the malware: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas...

Note that this is a very old analysis.

If you're being targeted with anything like Pegasus (i.e. a state sponsored attack), you should definitely assume that even a factory reset will not fix the issue. It's more about "better safe than sorry" than anything that can be said with certainty, since these attacks may evolve over time.

Reply on news.ycombinator.com