CS For Real Lecture Series

A zero-click attack is a cyberattack in which malicious software infects a device without any user interaction, by exploiting hidden software vulnerabilities. A well-known example is Pegasus, developed by NSO Group, whose use was publicly exposed in 2021. Following this exposure, Apple, Google, and Meta Platforms closed major security gaps in iOS, Android, and WhatsApp, and initiated legal action against NSO. At the same time, U.S. and European regulators introduced tighter controls that significantly improved the security of mobile devices worldwide. Technically, zero-click attacks rely on a sophisticated blend of classical memory-exploitation techniques, subtle abuses of seemingly harmless compression algorithms, and—most remarkably—the construction of a virtual computer inside the target device. Once this virtual machine is in place, the attacker gains full control of the target device. This talk explains how such attacks work, and shows their deep connection to Turing completeness and to the core ideas taught in our Nand to Tetris course.