[for-q-clinton]

This doesn’t make sense to me:

“For an attack to begin, attackers convince the victim to install an app that doesn’t require any required permissions, giving them a false sense of security.”

If I can convince you to run my program...well duh...

[kingu]

Install an app from a 3rd party - so you've got to turn on third party apps, then you have to approve installing another app after getting the MMS message.. Reminds me of the Lightning port attacks on Apple - a whole lot of ifs (though I guess easier on Apple since you can set up a ‘recharging station’ in a public place and people will happily plug into the offered cables.)