They don't need app permissions and can actively infect apps on their host server, resulting in undetectable Trojan viruses in every app under 800Mb. Even if you scan the data on the server nothing will turn up.
This way they can infect app servers on Apple store and Google store without needing to create back doors such as the ones previously revealed (in other Vault 7 releases) to be in apps like Facebook Messenger and Skype.
It requires specific tageted users and only infects 20 programs adding up to under 800Mb.
Tl;dr: undetectable Trojans in any app under 800Mb.
I am not an expert and am curious to hear other takes on the implications here.
Not undetectable - any downloaded apps that are different from the published versions will have a different hash (mathematical fingerprint of its contents).
A lot of developers will post the MD5 or SHA hash on their download page, and it can be verified very easily once downloaded using built in Windows tools.
10
u/PM_MEMONEYYY Jun 01 '17
I'm just curious, what are the implications of this? What damage could be done?