When the attacker never "hacks" anything: what JadePuffer teaches those who decide on security

For months I have been repeating the same thing in every Assessment I run: a granted permission is not proof that the behavior behind it is legitimate. An app with access to the camera, the microphone