zlacker

iOS is probably looked at as well, but has to be done manually since there's no way to just do it with a simple app.

>>xenosp+(OP)
I'd wager that they have a enterprise certificate to sign the iOS app with. Then it's a matter of sending the spy victims to a URL, installing the app and granting access to photos/ location/ whatever.

>>z33k+y1
Nope.. the user would also have to open Settings and explicitly mark the vendor certificate as trusted.

>>tomovo+l2
It says the devices were unlocked then the device was connected. I would assume the device is in the custody of the Chinese authority at this point. Thus, they can just go into Settings and trust the cert.

>>LocalH+da
Changing trust settings on device requires the password.

Better question is: what are they able to pull off the device while it's unlocked?