Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers used zerodays to infect Windows, iOS, and Android users

arstechnica.com

Post reply on HN
Print view View original

81–90 of 156 posts

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#81

Post by kube-system »

jokoon wrote: post #80

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less crit…

If you don't want it to happen, then why not become one of the people trying to prevent attacks from being successful?

The best way to stop future attacks is to make current attacks unsuccessful.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#82

Post by qw3rty01 »

jokoon wrote: post #80

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less crit…

Unlike lockpicking or actual arms races, it is possible to write software such that the only weak point is the people using it. Ideally all software would be formally verified, but that's a bit too cost/time expensive to be practical for everything, so instead computer security focuses a lot on minimizing attack surface and getting as close as possible to that "humans are the weak point" goal. Even if a 0day exists for particular software, if there's no way to reach it, then it's as good as being nonexistent.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#83

Post by Silhouette »

Jonnax wrote: post #74
cute_boi wrote: post #58

Earlier quoted context omitted.

Yep Regarding Update/UAC Please blame microsoft. I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge". I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package…

The reason is that the product is Windows 10 as a whole. Linux Distros are just bundles of software that make up the operating system. So if your compromise is that you don't want new Windows 10 updates because they also bundle in new features rather than using an OS like linux, then it'd be your fault if you get hacked via an exploit that was patched in an update. Microsoft aren't going to care.

Microsoft aren't going to care.

Then the obvious solution is to make them care. We penalise corporations for financial negligence and failing to take proper precautions and report correctly. We increasingly penalise them for violations of privacy and data protection rules, where similarly they are expected and required to provide adequate infrastructure to comply with the regulatory obligations. If failing to implement reasonable security practices and provide appropriate security updates to users with no strings attached started costing the hardware manufacturers and software developers and resellers the same kinds of penalty per violation as some of the financial or privacy regulations, we'd soon see those security updates universally available without forcing all the unwanted user-hostile changes at the same time.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#84

Post by 0xdeadbeefbabe »

ancarda wrote: post #40
dave_sullivan wrote: post #27

Been playing with tools like angr lately and learning more about binary analysis. It seems to me that "automatic exploit generation" is improving quite a bit where the infrastructure for analysis is a little tricky to set up, but then you can direct that infrastructure to analyze the code for you. The bad guys and good guys are in a race to find new exploits faster (they always have been) but I've been pretty amazed…

>I might just go back to pen and paper at this point. Maybe you kid, but... I've been using a physical calendar on the wall this year. I also replaced my Apple Watch with a Casio F-91W some time ago. You know what's really great? My calendar or watch never gets hacked and it's never unavailable because some overnight software update broke it! Sure, the F-91W technically runs software, but it has no connectivity. That…

It's a tedious game though: but, but, you your Casio is still vulnerable to EMP and you have to be awake to read it.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#85

Post by upofadown »

The actual exploited bugs were mostly found in the OS but this is really about browsers. A contemporary browser pretty much exposes your entire OS to remote attacks. You want to exploit font interpretation? No problem, the browser will happily download your malicious font.

There has to be a better way. This isn't working...

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#86

Post by CraneWorm »

cute_boi wrote: post #58
Jonnax wrote: post #18

Earlier quoted context omitted.

The reason why general computing sites don't recommend it is because users won't be happy when they can't sign into their bank or use other websites they wish to use. The average user doesn't know anything about how sites are constructed. Telling them to use uMatrix is non sensical. Though that's not to say there's good advice on these kinds of sites. I've seen a "Windows 10 tips" list from a very popular site tellin…

Yep Regarding Update/UAC Please blame microsoft. I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge". I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package…

you know, windows LTSC exists

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#87

Post by sdeep27 »

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

>>how we can make such attacks non-econimical again Does it say how they monetized these attacks? Or how would you expect?

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#88

Post by gibspaulding »

CraneWorm wrote: post #86
cute_boi wrote: post #58

Earlier quoted context omitted.

Yep Regarding Update/UAC Please blame microsoft. I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge". I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package…

you know, windows LTSC exists

Not in any real way for most people. It's only available to enterprise accounts, and from what I saw when I worked in IT, Microsoft strongly discourages it's use for normal user desktops.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#89

Post by boringg »

Curious why there isn't more specificity in the article? Is it to protect the sites and allow them time to fix? I'm not asking in a derogatory fashion, more trying to figure out the level of potential exposure I have myself. Tough to determine from the article.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#90

Post by ancarda »

upofadown wrote: post #85

The actual exploited bugs were mostly found in the OS but this is really about browsers. A contemporary browser pretty much exposes your entire OS to remote attacks. You want to exploit font interpretation? No problem, the browser will happily download your malicious font. There has to be a better way. This isn't working...

The only thing that comes to mind is having most websites be sites and not apps. Most sites don't need custom fonts, JavaScript, and CSS.

If Firefox & Chrome had support for something lightweight like Gemini (https://gemini.circumlunar.space/) then most sites could just use that.

With that sort of setup, restrictions on the web like uMatrix would be a lot less painful because most sites wouldn't ever need to be whitelisted.

Post reply on HN