Hacker News Reader

Comment by echoangle | Hacker News Reader

I wonder how that was supposed to work? Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? Chrome on Android and WebKit on iOS? That would be concerning, but how realistic is that?

View on HN

Very. These companies pay good money for 0 days and invest considerable effort into finding their own.

Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.

> Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page?

This has been the reality of mobile phone security for almost a decade now. Any sufficiently-complex digital system will be rife with UB and exploits.

Yes, but the exploits are so valuable/expensive that they’ll only use them during targeted operations. Otherwise they risk burning the exploit. So just remain uninteresting and you should be safe.

I would guess/assume that work phones of MEPs are restricted to a specific set of manufacturers and models, which makes targeting different from having to consider all options.

They might also have specific software installed across most of them that could be part of the targeting.

Would cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.

Reply on news.ycombinator.com