Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

citizenlab.ca

Post reply on HN
Print view View original

31–40 of 314 posts

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#31

Post by iJohnDoe »

jnwatson wrote: post #30
iJohnDoe wrote: post #24

Earlier quoted context omitted.

Apple has never devoted enough care, resources, or money to cybersecurity. It’s just a fact. They’ve also never devoted enough care, resources, or money to network architecture and how important availability is (with fairness, they have improved in this area in the last couple of years due to the major iCloud outages they had). Apple doesn’t hire mainstream IT people and cybersecurity people from the enterprise realm…

They absolutely do hire cybersecurity folks from enterprise companies. Source: I know them.

That is wonderful news. Thanks for the update.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#32

Post by mjg59 »

iJohnDoe wrote: post #24
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

Apple has never devoted enough care, resources, or money to cybersecurity. It’s just a fact. They’ve also never devoted enough care, resources, or money to network architecture and how important availability is (with fairness, they have improved in this area in the last couple of years due to the major iCloud outages they had). Apple doesn’t hire mainstream IT people and cybersecurity people from the enterprise realm…

Every Apple security developer I've interacted with has been astonishingly competent. Unfortunately Apple's corporate policies mean they're very rarely in a position to publicly discuss things they're working on, so their visibility is significantly diminished (one of the reasons I wouldn't work there)

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#33

Post by SV_BubbleTime »

amluto wrote: post #17
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

It’s not just the lack of sandboxing — iMessage uses language-level serialization of object graphs. This design is never suitable for sending across privilege boundaries. Apple should replace the format with a reasonable wire format. If this requires updates to apps that integrate with iMessage or breaks interoperability with older iOS versions, so be it.

Can you explain a bit? Are you saying they send messages as Swift objects/structures directly? Instead of a serialization like JSON/CBOR/Proto/Proprietary/etc?

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#34

Post by sshumaker »

tomComb wrote: post #26
xoa wrote: post #22

Earlier quoted context omitted.

> when authoritarian countries wake up and realize they can simply force Apple to migrate user data into servers they own in exchange for market access China is the only authoritarian country with enough leverage over Apple to force them to do that sort of thing. There it's not just an enormous market, but also an utterly critical part of Apple's supply chains. Every other authoritarian country is small fry in compar…

Orthogonal to your comment, but Apple could say no and walk away. On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. It will become a business school case study in why companies shouldn't put ethics ahead of money. The point being that we need a business environment where it makes business sense to stand up to authoritarian re…

Can you imagine if Google were the ones behind the great filter and panopticon that is the Chinese internet? Corporations are made up of human beings and at some point if you have any values you have to take a stand. The whole current philosophy of maximizing shareholder value falls apart when you realize the selfsame system that enables a free market is deeply intertwined with the impact powerful organizations have on society. And history is clear about what happens when industry enables governments to oppress their citizens. It does not end well for millions of people.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#35

Post by xoa »

tomComb wrote: post #26
xoa wrote: post #22

Earlier quoted context omitted.

> when authoritarian countries wake up and realize they can simply force Apple to migrate user data into servers they own in exchange for market access China is the only authoritarian country with enough leverage over Apple to force them to do that sort of thing. There it's not just an enormous market, but also an utterly critical part of Apple's supply chains. Every other authoritarian country is small fry in compar…

Orthogonal to your comment, but Apple could say no and walk away. On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. It will become a business school case study in why companies shouldn't put ethics ahead of money. The point being that we need a business environment where it makes business sense to stand up to authoritarian re…

>Orthogonal to your comment, but Apple could say no and walk away.

>On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely.

Wait, what? Who did Google do that to that wasn't China? Because the only one I remember is China, and I explicitly acknowledged in my comment that they have the leverage to carve their own rules. Arguably even more-so with Apple than Google, that's one place where Apple's hardware and vertical integration strategy is a definite weakness vs other players rather than a strength. It's certainly not as if Apple has no negotiating chips vs China, but it's clear who likely has the strongest hand.

But for Google, was there really a "staggering" cost, or any real cost, over refusing the likes of Saudi Arabia or the UAE? I'd love to read up on that if you could point me to what you're thinking of.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#38

Post by compycom »

worker767424 wrote: post #36

When engineers make companies that sell tools like this, it makes all the talk you see about ethical AI and privacy look like bikeshedding.

It's hard to weigh the aggregate harm of doing something slightly bad at massive scale against the aggregate harm of doing something very bad to a small group. Both are pretty bad, and we should be vocal about both.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#39

Post by firecall »

xoa wrote: post #35
tomComb wrote: post #26

Earlier quoted context omitted.

Orthogonal to your comment, but Apple could say no and walk away. On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. It will become a business school case study in why companies shouldn't put ethics ahead of money. The point being that we need a business environment where it makes business sense to stand up to authoritarian re…

> Orthogonal to your comment, but Apple could say no and walk away. > On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. Wait, what? Who did Google do that to that wasn't China? Because the only one I remember is China, and I explicitly acknowledged in my comment that they have the leverage to carve their own rules. Arguably e…

"In the Plex" by Steven Levy covers Google first entrance into China.

Although the book was published in 2011. I do remember it being a good read at the time, and probably still is!

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#40

Post by boomboomsubban »

pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

Seems fairly hypocritical in a number of ways. From our own companies actions, like Blackwater, to our allies actions, like Saudi Arabia, to our own government's actions, like "Collateral Murder" or events in Yemen. Why punish Israel?
Post reply on HN