Not necessarily true. It could be a buffer overflow in text message processing, it’s still requires a text message to be sent to the phone.
It could be a Wi-Fi or Bluetooth exploit, which requires locality.
It could be a browser, webview, certificate exploit that requires a sophisticated chain of events with a low probability to intercept a web page and get the user to do something that isn’t guaranteed.
The exploit might display itself to a user on the phone, so every time it’s applied there’s a risk of discovery.
Not to mention many advanced persistent threats do not want their exploits to be analyzed, so they will not leave them sitting around to be collected, just waiting for the device to need a reinfection. That’s valuable signals capability that you give to your adversary they just need to analyze it.
Those all are things that require external human intervention though?
If the malware is persistent, then one way or another it needs to leave an exploit on the device, it can either be a persistance exploit, or a privesc exploit.
Right so the issue here is we are saying for the class of malware that is not persistent restarting the device will take it out of memory. Which is a strict positive
Yup. Although i’m not sure there are many (any?) malwares that don’t have some form of persistence. Exploits requiring human intervention are usually just the first stage, and persistance is the second.
I dont know of any APTs that are purely memory only, but if you know of one please link so I can read up on it.
