this post was submitted on 16 Jul 2024
310 points (95.3% liked)

Technology

60055 readers
3163 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 2 points 5 months ago* (last edited 5 months ago)

It is not as simple as you imagine. Sometimes a specific bug requires the device to think it’s online and providing this illusion is not perfect. You don’t just plug it in and push a button and you’re good unless perhaps you’ve got a really good bug. Often times, hitting the precise code area required to exploit a bug involves weird scenarios. For example, you might have to talk to the base station for the cell phone tower that can properly authenticate first before you can attack a bug. Sometimes, the bug involves an interaction between multiple phones. It’s not just some magic signals you sent down the cable necessarily. You have to hit the weird behavior. Most trivial stuff exposed over USB has been examined thoroughly. You need to get creative to find more attack surface. There are bugs like that, but you are mistaken if you think categorically there is not risk in exploiting some bugs that can break into a phone. Sometimes it’s trivial to ensure information about your bug is contained. Sometimes it’s not.

The money isn’t a concern about greed or actually making cash. The money reflects the value and scarcity of these bugs. With that said, yes they sell the exploits. Usually, the people who find the bugs are the ones doing the selling. There’s actually an entire market that exchanges this information if you know the right people. As an obvious example, mercenary malware contains exploits for these bugs. These are organizations like NSO group that buy and sell the information that you would use to do this.