Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

131–140 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#131

Post by Hitton »

eswat wrote: post #111
Hitton wrote: post #83

Earlier quoted context omitted.

The dedicated laptop would be smarter idea. Running "sensitive" tasks from VM doesn't provide much protection if the host might be compromised.

I guess you'd have to worry about malware breaking out of the VM as well, but are there many exploits that do that these days?

That's hard to say, but both VirtualBox and VMware were hacked this year[1]. Definitely most secure would be both dedicated PC and running everything facing outside from VM. (and using SELinux or AppArmor as well).

[1]: https://securityaffairs.co/wordpress/82702/breaking-news/pwn...

Re: A deep dive into iOS Exploit chains found in the wild

#132

Post by FabHK »

kemayo wrote: post #116
feanaro wrote: post #93

Earlier quoted context omitted.

I've recently seen a surge of non-nerd Signal users. Mostly random people from my contacts starting to use it.

Hopefully a popularity surge will translate into the app getting better. It's notably less pleasant to use than Telegram, which I'd think of as its closest competitor.

Given that Telegram uses an entirely different encryption scheme, and does not e2e encrypt by default, I'd consider Wire (using some variation of the Signal protocol) the closest competitor. And Wire is rather pleasant to use, with clients on many platforms, sign-up with phone number or email, encrypted voice chat, encrypted group chats, etc.

Re: A deep dive into iOS Exploit chains found in the wild

#133

Post by sangnoir »

cryptozeus wrote: post #130

What does this mean ? Should I reset all my passwords just incase ? “Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.”

The attackers could have stolen your 2FA tokens (e.g. if you use Authy or Google Authenticator) - you need to reset those as well in addition to your passwords

Re: A deep dive into iOS Exploit chains found in the wild

#134

Post by jen_h »

lawnchair_larry wrote: post #106
jen_h wrote: post #86

Earlier quoted context omitted.

Did you look at the screenshot and read the translation? Appears to be a real-time tracking database of Uighurs...

In the first link? Yes, but what does the first link have to do with this attack? I see nothing that ties the two together. Am I missing something in the Google link that relates to that? The list of target services doesn’t even look similar.

“The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.”

Re: A deep dive into iOS Exploit chains found in the wild

#135

Post by idividebyzero »

saagarjha wrote: post #10
gok wrote: post #7

It's staggering how systematically broken IOKit remains.

Technically these are bugs in IOKit drivers and not the IOKit framework itself: it’s a footgun and not an exploding gun.

True, but drivers methods are exposed through IOKit framework, which clearly does not even attempt in reducing the attack surface, and instead, makes the exploitation easier. Thus, its design appears to be fundamentally broken.

Re: A deep dive into iOS Exploit chains found in the wild

#137

Post by glenrivard »

snazz wrote: post #91
Wowfunhappy wrote: post #82

Earlier quoted context omitted.

> The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades. But China doesn't need exploits to spy on their iPhone-using citizens, right? Because Apple has been cooperating with the Chinese government.

Do you have some evidence of that? Aside from iCloud hosting and App Store censorship, I haven’t heard of a case where they’ve weakened security for the Chinese government.

https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... Campaign targets Apple over privacy betrayal for Chinese ...

https://www.scmp.com/news/china/policies-politics/article/21... Apple pulls major VPN from China App Store | South China ...

Re: A deep dive into iOS Exploit chains found in the wild

#138

Post by samsonradu »

sqldba wrote: post #100

I wonder what happens when Apple distribute the update and it detects this is on your phone. Do they even notify you?

IANAL but shouldn’t this be a requirement within the GDPR? As a data operator, an organisation has the obligation to disclose any loss/leak of data, so this should be enforced.

Re: A deep dive into iOS Exploit chains found in the wild

#139

Post by qrbLPHiKpiux »

toxik wrote: post #61
DavideNL wrote: post #57

Earlier quoted context omitted.

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

Absolutely. It is such a disgrace to open society that we have allowed our phones, computers and cars to be so taken over by corporate interest that we cannot even peek inside. NB I heard some infosec research companies actually get rooted phones from Apple with some big caveats.

This is what the free market chose. People bought these devices en masse and continue to do so.

It’s on us - the end user.

Re: A deep dive into iOS Exploit chains found in the wild

#140

Post by sangnoir »

londons_explore wrote: post #87
someguydave wrote: post #85

Earlier quoted context omitted.

Either that or they have specialized web-crawlers that emulate various browsers.

Emulating a browser wouldn't be good enough for most exploits. Most stealthy malware immediately deactivates itself if it thinks it is on an emulated or virtualized system.

It might be good enough to flag "interesting" websites for further research on native (or emulated native) environments
Post reply on HN