Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers used zerodays to infect Windows, iOS, and Android users

arstechnica.com

Post reply on HN
Print view View original

41–50 of 156 posts

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#41

Post by pabs3 »

swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

uMatrix has been archived and is no longer maintained:

https://news.ycombinator.com/item?id=24532973 https://github.com/gorhill/uMatrix

I'm not sure what is supposed to replace it though.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#42

Post by pabs3 »

swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

Sounds like disabling web fonts would have helped too.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#43

Post by [deleted] »

gerdesj wrote: post #12
strogonoff wrote: post #9

It seems that a watering hole attack by definition targets users of a particular organization, but articles on this event make no mention of which organizations would that be, sounding like it affects general public. Wondering who should be worried. Related: can community recommend some forums, periodic publications or other sources that aggregate information security news?

"can community recommend some forums" Keep an eye on r/sysadmin in Reddit.

[deleted]

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#44

Post by pabs3 »

pacificmint wrote: post #7

If a PC is infected I can (and should) reinstall everything from scratch. That should remove the malware, barring some super resistant malware that hides in the BIOS or something like that. What do you do on an iOS device? Does a full device reset reinstall the OS, or does it simply remove all user settings? I feel like the locked down nature of iOS makes it harder to attack, but if an attack goes thru it would also…

There is a bootrom exploit called checkm8 (and corresponding jailbreak called checkra1n) for some iOS devices, you could exploit that, which lets you run code before any possible malware, then use that code to wipe the device and reinstall iOS, although I expect it would be hard to obtain a pristine copy of all the firmware in all the parts of the SoC.

https://checkra.in/

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#45

Post by choeger »

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs.

But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architecture) with three choices each should give you 3^n required exploits to cover all combinations.

But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits.

So I am a little bit at a loss here how we can make such attacks non-economical again.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#46

Post by waxyalan »

pabs3 wrote: post #41
swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

uMatrix has been archived and is no longer maintained: https://news.ycombinator.com/item?id=24532973 https://github.com/gorhill/uMatrix I'm not sure what is supposed to replace it though.

uBlock in medium mode or higher

https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#47

Post by smolder »

tiddles wrote: post #28
sdflhasjd wrote: post #3

Earlier quoted context omitted.

It's in quotes because it's a quote from Maddie Stone as opposed to a judgement made by the author.

Totally off topic, but I'm often tripped up by these multiple uses of quotes like this. Why do we use the same symbols out of a huge space for both quoting and sarcasm ?

Not a linguist or anything, but I'd say there's really just two categories: direct quotes (usually with a source), and then scare quotes which are used to communicate that you don't endorse the usage of the contained word(s).

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#48

Post by arnaudsm »

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

Exactly how biodiversity protects us from diseases.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#49

Post by saurik »

pacificmint wrote: post #7

If a PC is infected I can (and should) reinstall everything from scratch. That should remove the malware, barring some super resistant malware that hides in the BIOS or something like that. What do you do on an iOS device? Does a full device reset reinstall the OS, or does it simply remove all user settings? I feel like the locked down nature of iOS makes it harder to attack, but if an attack goes thru it would also…

A full reinstall of iOS--done by putting the device into DRU mode and then entirely re-imaging it over USB with iTunes from a firmware image--really does reinstall everything on the system that can possibly be changed by anyone (like, excepting code that is so fixed it isn't upgradeable even by Apple)... if anything you sometimes get some settings left around in awkward places for some of the lower-level components (that maybe could be used to smuggle intent or even attacks across the reinstall). iOS is actually really really good about this in comparison to a lot of other devices.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#50

Post by ekianjo »

DelightOne wrote: post #38
ekianjo wrote: post #24

Earlier quoted context omitted.

Umatrix is not available for firefox on android anymore. Thanks Mozilla !

What does it have to do with Mozilla?

Mozilla removed most extensions with their new Firefox on Android.
Post reply on HN