Hacker News new | past | comments | ask | show | jobs | submit login

Persistence beyond rethrowing your RCE is generally desirable not only because they limit the chain's exposure (each time you throw it, you're risking your $>1MM chain being captured and patched!) but because it allows you to use less reliable bugs and one-clicks, both of which are substantially cheaper and easier to find and develop. Fully interactionless bugs are really hard to come by and are not something you'd typically want to risk burning every single time a target's phone runs out of battery. If you can get a persistence bug, you're in a much better spot because then you only risk a few bugs (persistence+kernel chain) which, while still very high value, are more easily replaced.



Depends on how confident in your exploit catalog and your ability to find new exploits is. Quantifying the value of the collected data is almost impossible because it can quite literally be priceless. Imagine you can understand geopolitical strategy of a major adversary before they execute it...

Being non persistent also reduces your exposure on secondary payloads though. If I was a nation state with nearly unlimited resources, I would also monitor the mobile networks as well, which could give you a good idea when the jig is up.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: