Remote exploitation-- so POISON CARP will impact both iOS
and Android devices.
There are more exploits known for Android
than there are for iOS.
What happens is the user will get a carefully crafted
smishing or phishing message.
So if it's phishing, it's through email.
If it's smishing, it's through text message.
They click on it.
The one click is all it takes.
It's a one-click exploit, it installs itself,
and the attacker is now on your device.
Now, so many people will say, I would never
click on a phishing message.
I also like to pride myself in that.
I had someone do my lunch show.
And he knows me very well.
And he said Heather, I could get you to click on a message.
And I was like, no, way.
We were joking back and forth.
And I want you to think about this.
If you're a parent, and you get a message that's
so targeted that says there's an active shooter at your child's
school, click on this link to figure out
where to pick your child up, in 5 seconds I would click that.
I would never even second guess.
Some people are, like, I would stop.
I would turn on the news before I click that link.
No way.
If the attacker wants to get your attention,
they will craft it so specifically.
It's not going to be like the Nigerian schemes.
It's, like, your wedding dresses for sale,
here's a check for it-- or something ridiculous like that.
These are really crafty messages that
will get your attention, maybe something like,
your raise finally came through.
Click on this PDF in order to see what your raise is.
And you're, like, ooh, I want to raise.
And you click on it, and it's not, that at all.
You have now done a single-click or one-click exploit
that landed on your iOS device or Android.