I feel like this article makes the technique sound a lot more novel/surprising than it is. It seems like a simple case of "phone had an RCE vulnerability that got exploited by an attacker in control of the network".
back
2 comments
The point is how moneyed and powerful interests align, leveraging technical expertise to target specific investigative reporters, members of civil society, etc.; with the goal of killing democracy.
So either they had a fraudulent cert or he was using insecure sites :-/
It's probable that they were intercepting the connection and the act of hitting _any_ http site resulted in the redirection to an exploit payload. Many many sites have http requests, so you can't really blame someone for hitting a non-https site.
You're right it may not be his fault, but that is why all sites should be https, and sites should have the hsts header set.
Essentially if you are using http:// anywhere on your site (including transitively loaded resources) you are putting your users at risk - the same thing was exploited with the great cannon or whatever that DoS from the Chinese gov was called.
Oh yeah, I agree! https should be the standard, indeed.