Pavel Durov listed in leaked Pegasus project data

Post by kaba0 » Fri, Jul 23, 2021, 9:57 AM UTC

gnufx wrote: post #51

kaba0 wrote: post #35

Earlier quoted context omitted.

I’m no security researcher so do correct me if I’m wrong but I assume you use firejail which is a suid program - a bug here could cause an escape to even become root. And why would you write a sandbox in a memory safe language…

Yes, you're right to be wary of suid, but primarily against local attacks on my laptop. The suid risk for a remote attacker seems rather less than from remote malware without the sandbox. Opinions may differ.

Post by lobocinza » Wed, Jul 28, 2021, 2:53 PM UTC

dukeofdoom wrote: post #40

kaba0 wrote: post #32

Earlier quoted context omitted.

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

How well would putting the phone in a lead box work.