Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

31–40 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#31

Post by blinkingled »

attack-surface wrote: post #23

Noticed a flaw in my phone and other people's phones where the default browser was not honored (on Android) and SMS links open in `Samsung Internet` which barely gets updates and is a serious vector for attack. On top of this, why should a link containing a malicious payload be able to speak to other parts of the system? Doesn't Android do a basic security measure called sandboxing and `principle of least privilege'[…

It's all configurable on a per URL level on Android, it's just hidden deep into settings - it's not so much that it wasn't honored, it's likely someone some time set Samsung Internet top open SMS links - you can go in the app settings/permissions/app defaults to try and reset it or set it to another app.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#34

Post by netizen-936824 »

olliej wrote: post #7
mmastrac wrote: post #4

Earlier quoted context omitted.

Not just a VM - effectively a computer. Holy crap that's amazing (ly evil).

Right? I was using VM as a short hand - it is after all a virtual just more virtual than usual :)

I think VM is the correct term here. They are technically emulating hardware

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#35

Post by sophacles »

netizen-936824 wrote: post #28
hn_throwaway_99 wrote: post #19

Earlier quoted context omitted.

A large percentage of the planet has personal sensitive data stored by Google. If that data leaks, even due to a bug in another company's product through which Google has no fault, Google suffers. Google greatly benefits by having a secure Internet.

On this note, has google ever had a breach? I actually can't think of one off the top of my head, which is impressive for a company like google with so much data and such a large footprint Either their security or PR is great (or both?)

There was this one: https://en.wikipedia.org/wiki/Operation_Aurora

It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#36

Post by ttul »

TL;DR - the ending of the post is all you need:

“JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.”

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#37

Post by olliej »

attack-surface wrote: post #23

Noticed a flaw in my phone and other people's phones where the default browser was not honored (on Android) and SMS links open in `Samsung Internet` which barely gets updates and is a serious vector for attack. On top of this, why should a link containing a malicious payload be able to speak to other parts of the system? Doesn't Android do a basic security measure called sandboxing and `principle of least privilege'[…

Everything is sandboxed, part of the complexity of exploitation is the circumvention of the sandbox.

The reason they create a virtual machine out of image operations is because they have not even got direct code execution at that point.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#38

Post by inter_netuser »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

Dear sir, the entire NSA staff are currently plugging away on that pesky P=NP problem, including datacenter janitors.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#40

Post by ASalazarMX »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.
Post reply on HN