Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers used zerodays to infect Windows, iOS, and Android users

arstechnica.com

Post reply on HN
Print view View original

101–110 of 156 posts

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#101

Post by zzo38computer »

ancarda wrote: post #90
upofadown wrote: post #85

The actual exploited bugs were mostly found in the OS but this is really about browsers. A contemporary browser pretty much exposes your entire OS to remote attacks. You want to exploit font interpretation? No problem, the browser will happily download your malicious font. There has to be a better way. This isn't working...

The only thing that comes to mind is having most websites be sites and not apps . Most sites don't need custom fonts, JavaScript, and CSS. If Firefox & Chrome had support for something lightweight like Gemini ( https://gemini.circumlunar.space/ ) then most sites could just use that. With that sort of setup, restrictions on the web like uMatrix would be a lot less painful because most sites wouldn't ever need to be wh…

I agree, and on my computer I disable custom fonts in the web browser anyways.

A better web browser is really needed; one of things it can have is support for the Gemini protocol and file format. (It can also omit many things, as well as adding things.)

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#102

Post by Randor »

high_byte wrote: post #99
Randor wrote: post #96

Earlier quoted context omitted.

Actually with the font exploits an interpreter would be quite a bit safer. Many of the font exploit chains work by creating line vectors that result in an infinity or NaN throwing a floating point error (with the SeH handler already being overwritten). When running this by JIT... all of this is occurring on the physical CPU. If the floating point calculations were occurring inside an interpreter then the SEH chain ca…

a. closing one attack vector does not justify slowing down the entire world. b. you can have the jit compile with any bound checks as you suggested, so still not justifying an interpreter. the only reason for an interpreter is simplicity, once you have a jit there's no logical reason to go back. also when you say NX bit, you do know the interpreter is running code still. it's just doesn't have to be RW (actually jit…

Well, I feel like you are arguing for JIT just for the sake of arguing. The topic we are discussing in this thread is "Interpreted is safer than JIT" which is absolutely true.

Yeah, there are newer ROP mitigations coming down the pipeline, I agree verifiable execution flow remains a major problem.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#103

Post by zzo38computer »

deepstack wrote: post #19
swebs wrote: post #13

>The importance of keeping apps and OSes up to date and avoiding suspicious websites still stands. Unfortunately, neither of those things would have helped the victims hacked by this unknown group. Disabling Javascript would have helped. You can even use tools like uMatrix to set exceptions per site so you're not exposing yourself to every single site on the internet by default. Though you won't see online news sites…

> Disabling Javascript would have helped Thank you for saying that. I'm one of first in 2005/2006 advocating JS rendering in the browser. JS in the browser has really gotten out of hand. I no longer advocate to do everything on the client/browser side. A web site should just work without JS.

Most should work without JS (and also without CSS too, usually), yes.

Even in the few cases where it is needed, it should be designed to work OK without. I did see once where if JavaScript was disabled, it displayed a link to documentation instead; that is a good idea. (Unfortunately, the documentation didn't work without JavaScript enabled; they should fix that.) If it is accessing data, you can link to the documentation and/or to the data directly, in order to deal with it by yourself, with your own software, if the user wishes to do so. Sometimes the script is used to perform calculations, or automatically convert or render something; you can still add a block to just mention what it is, links to source codes, or in some cases (e.g. automatic time zone conversion) just omit that part entirely will do. Simply writing "This page requires JavaScript enabled to work" is worthless; don't do that.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#104

Post by zzo38computer »

deepstack wrote: post #77
moooo99 wrote: post #65

Earlier quoted context omitted.

Normal websites should absolutely, but actual webapps don't necessarily need to. Modern JS allows for very capable audio, video and 3d web applications inside the browser. The alternative if it wasn't for JS would be to build desktop apps, which would introduce a completely new set of problems and potential security risks.

> audio, video and 3d web applications For sure, audio, video do not need JS to function. Yes you need JS for 3d webGL, but it also opened another can of worm that allows company to fingerprint GPU pretty much anyone who is not using Safari regardless if you are in incognito mode. What most web developer don't realize browser was build to be a sandbox to protect you from the world wide web. Seems like the current tre…

This is true, and web browsers will need better user configuration to control such things, including fine controls to control what exactly a script does. The web developer console is a good start, but it doesn't even start to go far enough at all.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#105

Post by wdr1 »

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

> I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem.

How does that balance against the thread of each platform/ecosystem having its own variants of security issues?

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#106

Post by uncledave »

fsflover wrote: post #91
upofadown wrote: post #85

The actual exploited bugs were mostly found in the OS but this is really about browsers. A contemporary browser pretty much exposes your entire OS to remote attacks. You want to exploit font interpretation? No problem, the browser will happily download your malicious font. There has to be a better way. This isn't working...

The better way is to use Qubes OS for security through isolation. You then use hardware virtualization to isolate untrusted application (including browsers) from the rest of system. Doesn't work on mobile though.

Processes were a form of robust virtualisation once. It’s just pushing the problem down another layer. There are vulnerabilities in virtualisation layers too.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#107

Post by cutemonster »

uncledave wrote: post #106
fsflover wrote: post #91

Earlier quoted context omitted.

The better way is to use Qubes OS for security through isolation. You then use hardware virtualization to isolate untrusted application (including browsers) from the rest of system. Doesn't work on mobile though.

Processes were a form of robust virtualisation once. It’s just pushing the problem down another layer. There are vulnerabilities in virtualisation layers too.

> Processes were ..

Was it ever robust? Or just that there weren't yet so many exploits?

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#108

Post by caslon »

enkid wrote: post #51
choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped the…

> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer.

In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#109

Post by GartzenDeHaes »

Hackers ARE using zerodays to infect EVERYTHING. I really can't understand why people continue to just assume that their endpoints and networks are clean. Worse, they then use the lack of security events to justify not buying the tools and expertise that are necessary to identify compromises.

EDIT: not just zerodays. Many organizations have patch schedules that are too slow.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#110

Post by cutemonster »

jokoon wrote: post #80

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less crit…

> telling people to use computers for less critical tasks, and disengaging from certain areas.

I think I a bit can understand how you think. Looking at some health care related apps, I was surprised to see how buggy they were (the user interface) and silly built, wrt security.

On the other hand, without computers, the alternative seems to be that the health care staff picks up the phone and just assumes you are the one you say you are

Post reply on HN