> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors
What is this in reference to?
What is this in reference to?
They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jamal Khashoggi.
Their exploits, developed in-house as well as presumably partially bought on the black market, are some of the most sophisticated exploits found in the wild, e.g. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
> JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
Exactly my point. They do not sell backdoors.
Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"
And i mean, i'm genuinely curious. I don't think they would be above doing so if they had the opportunity, i just haven't heard of any instances where they were caught doing so.
RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.
"The Maxwell-Mossad team steals spy software PROMIS from the United States, Mossad puts an undetectable trap door in it so Mossad can track the activities of anyone using it, then Maxwell sells it around the world (including back to the U.S. -- with the trap door)."