Asia-24-Frielingsdorf-YouShallNotPass-Analysing

A Black Hat Asia 2024 briefing presenting a forensic walk-through of a Pegasus (NSO) BLASTPASS iOS zero-click spyware sample: investigators found a malicious Wallet .pkpass whose oversized WebP image triggered ImageIO/Wallet vulnerabilities (CVE-2023-41064 / CVE-2023-41061), extracted a bplist/NSKeyedArchiver object that contained an NSExpression-based payload, and unpacked multiple nested base64/compressed payloads leading to encrypted components and potential sandbox-escape/mitigation bypasses; the talk lists IOCs (e.g., sample.pkpass, logo.png, Ref 11, crash signatures), outlines analysis tools and steps, and closes with open questions about keys, C2, and further implant behavior.