Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

citizenlab.ca

Post reply on HN
Print view View original

111–120 of 314 posts

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#111

Post by ketamine__ »

goatsi wrote: post #107
ketamine__ wrote: post #71

It was awesome when Facebook deleted NSO group employees personal profiles. And then they whined about it. The silver lining of Facebook owning WhatsApp. I hope more organizations do this. https://arstechnica.com/information-technology/2019/10/faceb...

They didn't just whine, they sued Facebook in Israeli court (and won). Facebook was forced to reinstate their accounts: https://www.cyberscoop.com/facebook-nso-group-accounts-reins...

Wow, I didn't know that. What an illegitimate court system. Facebook should be able to choose who can and can't use their platform.

Facebook will probably have better luck with lawsuits in the US.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#112

Post by spoopyskelly »

darksaints wrote: post #42
pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

We saw the news this year when a Saudi prince directly authorized the murder and dismemberment of an American/Saudi journalist inside it's own embassy. And literally nothing happened. I'm not holding my breath on America ever making the right decisions with respect to foreign policy.

It wasn't an American journalist.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#113

Post by swiley »

People sometimes say that Linux based OSes largely lack malware because they're unpopular but I would argue that it's also because they're so different from eachother. Even if the user wants to install you're binary it's hard to make it work on both redhat and alpine, if they don't want it it's even harder. A contrast to this is the extreme monoculture in "mobile Oses" and iOS in particular where even the IM app is more or less dictated by a single small group of people.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#114

Post by pertymcpert »

ronnier wrote: post #99
tbodt wrote: post #27

Earlier quoted context omitted.

iMessage is not being attacked because it's not as sandboxed as other apps. It's being attacked because it's accessible with zero clicks. For an attack like this you need to chain an iMessage exploit with an LPE, and the LPE can be launched from any other app.

LPE. What is an LPE?

Not sure, but it might mean Local Privilege Escalation. It’s one thing to take control of the iMessage process, it’s another to then gain kernel level access.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#115

Post by alternatetwo »

aarchi wrote: post #61

More generally, is there a known correlation between kernel panics and exploits, especially on macOS? > Almisshal’s device shows what appears to be an unusual number of kernel panics (phone crashes) between January and July 2020. While some of the panics may be benign, they may also indicate earlier attempts to exploit vulnerabilities against his device.

I doubt it's macOS only, if you remember EternalBlue, that was called that way because it kept bluescreening on machines the NSA tested it on ...

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#116

Post by ipv6ipv4 »

xkqd wrote: post #109
ipv6ipv4 wrote: post #102

Earlier quoted context omitted.

But it’s perfectly ok for European or American companies to do the same. Bull of France in Libya. Bluecoat in Syria. Siemens in iraq and Iran. Nokia in Bahrain. Cisco in China. ... The list is literally endless. Yet only Israeli companies are culpable in your mind and to such an extent that the entire state must be sanctioned. No less. Your hypocrisy is leaking.

It’s more likely someone is unaware of your examples, because it requires a level of knowledge in corporate geopolitical actors that most people wouldn’t come across via normal news streams. Be polite.

I’ve seen too many of these comments over the years. They always come from the same hateful place. Once comments like that bubble up, it’s no longer a dialogue and the person writing them is not debating in good faith.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#117

Post by 2Gkashmiri »

smashah wrote: post #46
pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

WhatsApp "attempted" to get NSOs export license revoked and failed. How would you expect America to stop two of their allies from dealing with each other (with a potential courtship in the works)? Especially when America itself gets major weapons contracts to look the other way? This will just continue to get worse. More journalists and human rights activists will die because some delusional maniacs feelings were hur…

india for the last couple of years has been cracking down on "whatsapp groups" in occupied kashmir for reasons unknown. the encryption has not helped them because now they cant just use their homegrown network analyzer called "netra" to sift through whatsapp messages like they do on facebook. instead they opted to have whatsapp admins get "registered" and "licensed" to operate their groups. this resulted in being called into the police station and having this pegasus and other shit installed so that they can get backdoor access.

https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe...

https://m.thewire.in/article/government/kargil-police-asks-a...

https://www.firstpost.com/india/jammu-and-kashmirs-kishtwar-...

https://theintercept.com/2020/12/06/kashmir-social-media-pol...

the one thing these media outlets don't outrightly say is the reason why admins are told to report to police stations and someone on twitter has an answer to that.

https://mobile.twitter.com/CRolanova/status/1260932017916506...

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#118

Post by saagarjha »

pertymcpert wrote: post #114
ronnier wrote: post #99

Earlier quoted context omitted.

LPE. What is an LPE?

Not sure, but it might mean Local Privilege Escalation. It’s one thing to take control of the iMessage process, it’s another to then gain kernel level access.

Yes, it means local privilege escalation.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#119

Post by saagarjha »

tbodt wrote: post #27
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

iMessage is not being attacked because it's not as sandboxed as other apps. It's being attacked because it's accessible with zero clicks. For an attack like this you need to chain an iMessage exploit with an LPE, and the LPE can be launched from any other app.

In this case it might not be necessary to escalate privileges, as iMessage itself may have been the target.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#120

Post by TheDong »

swiley wrote: post #113

People sometimes say that Linux based OSes largely lack malware because they're unpopular but I would argue that it's also because they're so different from eachother. Even if the user wants to install you're binary it's hard to make it work on both redhat and alpine, if they don't want it it's even harder. A contrast to this is the extreme monoculture in "mobile Oses" and iOS in particular where even the IM app is m…

> Even if the user wants to install you're binary it's hard to make it work on both redhat and alpine

Statically linking a binary to not require libc or muscl or any other libraries isn't hard. This is the easiest part of exploit writing. All linux distros run ELF binaries just fine.

People who are trying to package things in a correct way, where the user can list the installed program, uninstall it, have configuration stored in standardized locations, etc... that's actually a harder problem. But just because writing a "correct" package varies a bit by distro doesn't mean an exploit, which doesn't have to follow packaging guidelines, has the same difficulty.

In addition, you're trying to compare it to the difficulty of writing an exploit for iOS. It's not comparable. There's documentation about every step of compiling and packaging software for linux distros. There's no documentation for elevating privileges and breaking iOS's sandbox because it's not intended to be possible.

Post reply on HN