Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

21–30 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#21

Post by [deleted] »

ikeboy wrote: post #18
bscphil wrote: post #17

Earlier quoted context omitted.

Well, you don't necessarily have to jump from one to the other. If you currently do financial stuff on your phone, just enabling 2FA and only browsing them on your laptop is already an enormous step up. There are cases where additional precautions are warranted, but there's no reason to let the perfect be the enemy of the good.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

[deleted]

Re: A deep dive into iOS Exploit chains found in the wild

#22

Post by dontbenebby »

bscphil wrote: post #17
js2 wrote: post #12

This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.

Well, you don't necessarily have to jump from one to the other. If you currently do financial stuff on your phone, just enabling 2FA and only browsing them on your laptop is already an enormous step up. There are cases where additional precautions are warranted, but there's no reason to let the perfect be the enemy of the good.

Using disappearing messages (eg: Signal) is also good.

If compromised, the attacker doesn't get a long log of comms, just a week's worth.

Re: A deep dive into iOS Exploit chains found in the wild

#23

Post by dontbenebby »

js2 wrote: post #12

This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.

>The only way to be safe is probably to access your financial sites

These folks don't want money.

And statue protects you from fraud - just set up text and email alerts so large transactions alert you ASAP.

Re: A deep dive into iOS Exploit chains found in the wild

#24

Post by jijji »

ikeboy wrote: post #18
bscphil wrote: post #17

Earlier quoted context omitted.

Well, you don't necessarily have to jump from one to the other. If you currently do financial stuff on your phone, just enabling 2FA and only browsing them on your laptop is already an enormous step up. There are cases where additional precautions are warranted, but there's no reason to let the perfect be the enemy of the good.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

Re: A deep dive into iOS Exploit chains found in the wild

#25

Post by chillaxtian »

saagarjha wrote: post #20
Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.

Link?

Re: A deep dive into iOS Exploit chains found in the wild

#26

Post by [deleted] »

jijji wrote: post #24
ikeboy wrote: post #18

Earlier quoted context omitted.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

[deleted]

Re: A deep dive into iOS Exploit chains found in the wild

#27

Post by maxdamantus »

jijji wrote: post #24
ikeboy wrote: post #18

Earlier quoted context omitted.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser.

Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface.

Re: A deep dive into iOS Exploit chains found in the wild

#28

Post by saagarjha »

chillaxtian wrote: post #25
saagarjha wrote: post #20

Earlier quoted context omitted.

Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.

Link?

No slides, unfortunately: https://blackhat.com/us-19/briefings/schedule/#behind-the-sc...

Re: A deep dive into iOS Exploit chains found in the wild

#29

Post by arkadiyt »

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why?

edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code was likely written by a separate, less experienced team, than the one that wrote the exploit chains (which might have simply been purchased?).

Re: A deep dive into iOS Exploit chains found in the wild

#30

Post by bt848 »

Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

Perhaps it would behoove security-sensitive users to use such devices, but they make up a tiny fraction of all iOS devices in the field. 90% of deployed iOS devices in the USA lack the A12 CPU and the number is higher abroad. Obsolete 32-bit CPUs are more common than CPUs with PAC.
Post reply on HN