[truted2]

> to obtain remote, unauthorized access to any of the tens of millions of smartphones and mobile devices utilizing a U.S. Company Two-provided operating system

U.S. Company Two provides a mobile operation system. Hmmm, now who could that be?

[kccqzy]

My first thought was that it must be Apple.

But the article says,

> In August 2017, U.S. Company Two updated the operating system for its smartphones and other mobile devices, limiting KARMA 2’s functionality.

I didn't find any meaningful security updates by Apple in August 2017: https://support.apple.com/en-us/HT201222 The only one listed on that page was about using HTTP to send analytics data, which I don't think is the one that disabled KARMA 2.

Then I looked at Google. There are multiple RCE vulns with severity Critical during these two months: https://source.android.com/security/bulletin/2016-09-01 and https://source.android.com/security/bulletin/2017-08-01

[tyrfing]

It's Apple, see the Reuters report from 2019: https://www.reuters.com/investigates/special-report/usa-spyi...

Here's KARMA: https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...

Looking at CVEs, my guess for KARMA 2 is CVE-2017-8248, patched in 10.3.3. Bit of a stretch, though. Looks like whatever was patched was never really publicized.

https://nvd.nist.gov/vuln/detail/CVE-2017-8248