Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers used zerodays to infect Windows, iOS, and Android users

arstechnica.com

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#51

Post by enkid »

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#53

Post by floatboth »

sneak wrote: post #37
Jonnax wrote: post #23

Earlier quoted context omitted.

Most of those bugs were in font rendering.

I saw; such a security-focused browser would naturally use only local, trusted fonts and strongly sandbox media playback/decode of any kind, probably in a different process. We need slow and safe before we can have fast and safe. Either is better than the fast and unsafe we have now. We should probably unfuck the dangerous morass that is turing-complete font file formats at some point, too.

Firefox at least uses the wasm sandbox for Graphite, the really fancy turing-complete font thing:

https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

Same with Ogg container parsing.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#54

Post by forgotmypw17 »

ekianjo wrote: post #52
forgotmypw17 wrote: post #25

Earlier quoted context omitted.

Still works great in Pale Moon.

Afaik there is no Pale Moon on Android.

sorry, i misread the comment i replied to.

android and ios are indeed a wasteland in terms of browser security.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#55

Post by ce4 »

ekianjo wrote: post #50
DelightOne wrote: post #38

Earlier quoted context omitted.

What does it have to do with Mozilla?

Mozilla removed most extensions with their new Firefox on Android.

I use F-Droid's Fennec, which has addon-collections re-enabled. Bit of a hassle if you want something that's not yet included in an existing collection, but possible:

https://f-droid.org/de/packages/org.mozilla.fennec_fdroid/

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#56

Post by codetrotter »

corty wrote: post #36
tiddles wrote: post #28

Earlier quoted context omitted.

Totally off topic, but I'm often tripped up by these multiple uses of quotes like this. Why do we use the same symbols out of a huge space for both quoting and sarcasm ?

There are separate symbols for sarcasm, but in "serious" writing emoji aren't considered appropriate. And sites/software likes to restrict them, like e.g. HN, which is why the sarcasm above is marked by quotes instead of the appropriate emoji. Some earlier internet cultures used :> But I fear that is understood less widely nowadays.

On Reddit people sometimes put /s at the end of a sentence to indicate sarcasm.

And then there is also the irony punctuation which looks like this: ⸮

https://en.wikipedia.org/wiki/Irony_punctuation

But I have never seen anyone actually ever use it. In fact I only ever heard about it so rarely that I almost miswrote and was about to say that interrobang is sometimes used for indicating sarcasm. But when I looked it up I read that interrobang is for showing surprise of course!

As for your :> there was a guy that used to use it on an IRC channel that I was on. But I never understood quite what he meant by that kind of smiley. And later I looked it up and in his case I think the description I saw on Urban Dictionary fit pretty well, which said it was like a mischievous or devious smile. And I guess that also fits good for when you are sarcastic. Ever since I read that definition of :> it makes me think of this cartoon grinch smile https://meme.fandom.com/wiki/The_Grinch_Smile

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#57

Post by dmos62 »

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

Diversity is a sign of health in an ecosystem. But, increasing diversity directly isn't really viable. Question is, why is diversity low?

In my opinion, Web, OSes and CPUs suffer from being overly complicated, closed-source ridden, non-modular systems-within-systems. Basicly, the opposite of what the Unix philosophy advocates.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#58

Post by cute_boi »

Jonnax wrote: post #18
swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

The reason why general computing sites don't recommend it is because users won't be happy when they can't sign into their bank or use other websites they wish to use. The average user doesn't know anything about how sites are constructed. Telling them to use uMatrix is non sensical. Though that's not to say there's good advice on these kinds of sites. I've seen a "Windows 10 tips" list from a very popular site tellin…

Yep

Regarding Update/UAC Please blame microsoft.

I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge".

I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#59

Post by rzzzt »

tiddles wrote: post #28
sdflhasjd wrote: post #3

Earlier quoted context omitted.

It's in quotes because it's a quote from Maddie Stone as opposed to a judgement made by the author.

Totally off topic, but I'm often tripped up by these multiple uses of quotes like this. Why do we use the same symbols out of a huge space for both quoting and sarcasm ?

BBC articles tend to use it a lot, it's probably part of their style guide. I snicker quietly at each title that "is worded" like "this", imagining a Dr. Evil air quoting each segment dutifully.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#60

Post by httpsterio »

cute_boi wrote: post #58
Jonnax wrote: post #18

Earlier quoted context omitted.

The reason why general computing sites don't recommend it is because users won't be happy when they can't sign into their bank or use other websites they wish to use. The average user doesn't know anything about how sites are constructed. Telling them to use uMatrix is non sensical. Though that's not to say there's good advice on these kinds of sites. I've seen a "Windows 10 tips" list from a very popular site tellin…

Yep Regarding Update/UAC Please blame microsoft. I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge". I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package…

Because you most likely didn't buy the product called Windows 10. Rather, you're using the service and you are in fact the product.

W10 education and enterprise licenses allows you to manage the updates yourself.

Post reply on HN