[phillypham]

It used to be possible to break into iPhones by sending just a text message without the target clicking on anything.

The only thing that kept this under control was there was an agreement to not target US-based numbers and the exploit was expensive.

Reference: The Battle for the World’s Most Powerful Cyberweapon https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... and https://en.wikipedia.org/wiki/Pegasus_(spyware)

[pwagland]

Not quite, from the Wikipedia:

> Pegasus' iOS exploitation was identified in August 2016. Emirati human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates by following a link. Mansoor sent the link to Citizen Lab of the University of Toronto, which investigated, with the collaboration of Lookout, finding that if Mansoor had followed the link it would have jailbroken his phone and implanted the spyware into it, in a form of social engineering.

So the link was sent via text message, but you had to click on it. Receiving the text message did nothing in and of itself.

[phillypham]

Initial versions were one-click. The attack became more sophisticated and became zero-click.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_... for timeline.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Saudi_Arabia for the iMessage version.