zlacker

I'd wager that they have a enterprise certificate to sign the iOS app with. Then it's a matter of sending the spy victims to a URL, installing the app and granting access to photos/ location/ whatever.

>>z33k+(OP)
Nope.. the user would also have to open Settings and explicitly mark the vendor certificate as trusted.

>>tomovo+N
It says the devices were unlocked then the device was connected. I would assume the device is in the custody of the Chinese authority at this point. Thus, they can just go into Settings and trust the cert.

>>LocalH+F8
Changing trust settings on device requires the password.

Better question is: what are they able to pull off the device while it's unlocked?