zlacker

>>el_dud+(OP)
So it’s android only?

>>olliej+it
iOS is probably looked at as well, but has to be done manually since there's no way to just do it with a simple app.

>>xenosp+Ev
I'd wager that they have a enterprise certificate to sign the iOS app with. Then it's a matter of sending the spy victims to a URL, installing the app and granting access to photos/ location/ whatever.

>>z33k+cx
Nope.. the user would also have to open Settings and explicitly mark the vendor certificate as trusted.

>>tomovo+Zx
It says the devices were unlocked then the device was connected. I would assume the device is in the custody of the Chinese authority at this point. Thus, they can just go into Settings and trust the cert.

>>LocalH+RF
Changing trust settings on device requires the password.

Better question is: what are they able to pull off the device while it's unlocked?