The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such:
Forensic evidence gathered by Amnesty International on Radi’s phone shows that it was infected by “network injection,” a fully automated method where an attacker intercepts a cellular signal when it makes a request to visit a website. In milliseconds, the web browser is diverted to a malicious site and spyware code is downloaded that allows remote access to everything on the phone. The browser then redirects to the intended website and the user is none the wiser.
There's also an accompanying schematic summarising the attack set up:
Some quick googling seems to indicate that "network injection" is actually a euphemism for packet injection.
In this specific case (i.e., attacking cellular internet connections),
- Does HTTPS provide adequate protection from such an attack?
- If not, why?