Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers used zerodays to infect Windows, iOS, and Android users

arstechnica.com

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#31

Post by corty »

pacificmint wrote: post #7

If a PC is infected I can (and should) reinstall everything from scratch. That should remove the malware, barring some super resistant malware that hides in the BIOS or something like that. What do you do on an iOS device? Does a full device reset reinstall the OS, or does it simply remove all user settings? I feel like the locked down nature of iOS makes it harder to attack, but if an attack goes thru it would also…

Reinstalling everything from scratch is a good start, but persistence of an exploit can easily be achieved through most data backups. Nobody wants to part with their important Word and Excel files, so those will get restored onto the fresh machine, carrying all the usual embedded macro nasties that an attacker planted there.

Of course you can try to be diligent and skip everything that is potentially a problem, but it is even harder than reinstalling and the data you are dropping is usually more valuable than the OS installation.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#32

Post by Number157 »

gtirloni wrote: post #21
donatj wrote: post #10

The scare quotes in the title read as sarcasm but they clearly didn’t intend them as such. An odd choice as I almost overlooked the article assuming it was a tale of some failed hackers.

Are scare quotes the only type of quotes these days? I remember in school we were taught they could be used for emphasis.

Seems like it. The media tend to use quotes to emphasize that the thing they are writing is not something they believe.

X is dangerous VS X is "dangerous"

The implication is true vs not true.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#33

Post by Bancakes »

tiddles wrote: post #28
sdflhasjd wrote: post #3

Earlier quoted context omitted.

It's in quotes because it's a quote from Maddie Stone as opposed to a judgement made by the author.

Totally off topic, but I'm often tripped up by these multiple uses of quotes like this. Why do we use the same symbols out of a huge space for both quoting and sarcasm ?

Sarcasm should be put in single quotes.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#34

Post by robocat »

sneak wrote: post #11

How long until we realize that JIT was a mistake and that we should offer orders of magnitude slower JS in browsers that is actually safe (or start building webpages without JS at all again, which will probably never happen) lest we give every website the ability to take over our device? I'd pay real money for a browser with a slow, safe JS interpreter.

The v8 engine has a -—jitless option, however it isn’t clear to me whether Chrome allows that as a command line option.

https://v8.dev/blog/jitless

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#36

Post by corty »

tiddles wrote: post #28
sdflhasjd wrote: post #3

Earlier quoted context omitted.

It's in quotes because it's a quote from Maddie Stone as opposed to a judgement made by the author.

Totally off topic, but I'm often tripped up by these multiple uses of quotes like this. Why do we use the same symbols out of a huge space for both quoting and sarcasm ?

There are separate symbols for sarcasm, but in "serious" writing emoji aren't considered appropriate. And sites/software likes to restrict them, like e.g. HN, which is why the sarcasm above is marked by quotes instead of the appropriate emoji. Some earlier internet cultures used :> But I fear that is understood less widely nowadays.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#37

Post by sneak »

Jonnax wrote: post #23
sneak wrote: post #11

How long until we realize that JIT was a mistake and that we should offer orders of magnitude slower JS in browsers that is actually safe (or start building webpages without JS at all again, which will probably never happen) lest we give every website the ability to take over our device? I'd pay real money for a browser with a slow, safe JS interpreter.

Most of those bugs were in font rendering.

I saw; such a security-focused browser would naturally use only local, trusted fonts and strongly sandbox media playback/decode of any kind, probably in a different process.

We need slow and safe before we can have fast and safe. Either is better than the fast and unsafe we have now.

We should probably unfuck the dangerous morass that is turing-complete font file formats at some point, too.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#38

Post by DelightOne »

ekianjo wrote: post #24
swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

Umatrix is not available for firefox on android anymore. Thanks Mozilla !

What does it have to do with Mozilla?

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#39

Post by hosteur »

swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

Yes uMatrix is crucial. But alas it has been discontinued as I understand.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#40

Post by ancarda »

dave_sullivan wrote: post #27

Been playing with tools like angr lately and learning more about binary analysis. It seems to me that "automatic exploit generation" is improving quite a bit where the infrastructure for analysis is a little tricky to set up, but then you can direct that infrastructure to analyze the code for you. The bad guys and good guys are in a race to find new exploits faster (they always have been) but I've been pretty amazed…

>I might just go back to pen and paper at this point.

Maybe you kid, but... I've been using a physical calendar on the wall this year. I also replaced my Apple Watch with a Casio F-91W some time ago.

You know what's really great? My calendar or watch never gets hacked and it's never unavailable because some overnight software update broke it! Sure, the F-91W technically runs software, but it has no connectivity. That's the important part.

Now if I could just figure out what to do with my phone... I don't think dumb phones are particularly secure, so maybe it makes sense to keep using Android? Or eventually switch to Linux on my phone?

Post reply on HN