Hacker News Reader

Comment by chmod775 | Hacker News Reader

Sounds more like it missed. They sent him a link, and he was wise enough to not click on it.

Don’t we live in a world where zero click exploits are a thing? I thought the target didn’t have to click the links just receive them

Zero click exploits are a thing, but they are very expensive and have limited shelf life (once they have been used a few times, they tend to get found out and patched). Most actors won’t use one, unless it is a very, very high value target. It seems that the EU parliament member was not high value enough, and got lucky.

That's why I disable HTML in emails

Just to be aware that's a start but it's not a full mitigation. Some of the prominent zeroclick exploits have been "rich content" in messaging products such as whatsapp[1] and imessage[2].

Definitely not an expert but I'm presuming they take advantage of the "helpful" behaviour those apps have to preview content and then pair that with some sort of exploit in the library that parses/displays the content. So say they have an exploit in a jpeg library that whatsapp uses then they send a specially-crafted jpeg via whatsapp, whatsapp "previews" the image and that triggers the exploit to compromise the jpeg library and pwn the user.

[1] https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a...

[2] https://appleinsider.com/articles/23/06/01/zero-click-ios-ma...

not all of them are zero click :)

I wonder how that was supposed to work? Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? Chrome on Android and WebKit on iOS? That would be concerning, but how realistic is that?

Very. These companies pay good money for 0 days and invest considerable effort into finding their own.

Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.

> Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page?

This has been the reality of mobile phone security for almost a decade now. Any sufficiently-complex digital system will be rife with UB and exploits.

Yes, but the exploits are so valuable/expensive that they’ll only use them during targeted operations. Otherwise they risk burning the exploit. So just remain uninteresting and you should be safe.

I would guess/assume that work phones of MEPs are restricted to a specific set of manufacturers and models, which makes targeting different from having to consider all options.

They might also have specific software installed across most of them that could be part of the targeting.

Would cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.

Reply on news.ycombinator.com