Apple warns Russian journalists of Pegasus iPhone infections

It would be even nicer of Apple if it fixed the weaknesses Pegasus takes advantage of.  Actually, until this article appeared, that's what I assumed Apple had already done, given Pegasus' notoriety.  Unless, of course, those weaknesses require social engineering - not much Apple can do about people's stupidity.

Pegasus has been around for years now. Could somebody please write a professional but comprehensive article explaining why Apple has not been able to protect us from this loophole?

dope_ahmine said:

Pegasus has been around for years now. Could somebody please write a professional but comprehensive article explaining why Apple has not been able to protect us from this loophole?

Apple already explained that those attacks are very sophisticated and likely have direct hand on access to those devices and rigged them.

"Apple threat notifications are designed to inform and assist users who may have been targeted by state-sponsored attackers. These users are individually targeted because of who they are or what they do. Unlike traditional cybercriminals, state-sponsored attackers apply exceptional resources to target a very small number of specific individuals and their devices, which makes these attacks much harder to detect and prevent. State-sponsored attacks are highly complex, cost millions of dollars to develop, and often have a short shelf life. The vast majority of users will never be targeted by such attacks."

netrox said:

dope_ahmine said:

Pegasus has been around for years now. Could somebody please write a professional but comprehensive article explaining why Apple has not been able to protect us from this loophole?

Apple already explained that those attacks are very sophisticated and likely have direct hand on access to those devices and rigged them.

"Apple threat notifications are designed to inform and assist users who may have been targeted by state-sponsored attackers. These users are individually targeted because of who they are or what they do. Unlike traditional cybercriminals, state-sponsored attackers apply exceptional resources to target a very small number of specific individuals and their devices, which makes these attacks much harder to detect and prevent. State-sponsored attacks are highly complex, cost millions of dollars to develop, and often have a short shelf life. The vast majority of users will never be targeted by such attacks."

It's also a moving target. As exploits are discovered, NSO Group happily uses them.

This blog article explains why there's not specific mitigation for Pegasus spyware, or other providers of surveillance malware for that matter. There's a lot of cross-platform cooperation involved in keeping the harm to a minimum. 
https://blog.google/threat-analysis-group/googles-efforts-to-identify-and-counter-spyware/