Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

41–50 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#41

Post by EvanAnderson »

ttul wrote: post #36

TL;DR - the ending of the post is all you need: “JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operation…

This one will be another talking point right beside the "arbitrary code execution in SNES games via controller inputs" as a rebuke to arguments about even small systems (like an image decompressor) being "made secure".

I also keep thinking "The Cylons would totally write an exploit like this."

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#43

Post by walrus01 »

> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once,

Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and skeptical that Signal supports embedding animated images.

I can name exploits of this type on desktop PC operating systems going back probably 22-23 years...

I do realize that lack of rich media inline in messages is a non starter for most non-technical consumer end users.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#44

Post by athenot »

airstrike wrote: post #11
usmannk wrote: post #3

This is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.

That reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."

Then you can "Enhance".

https://www.youtube.com/watch?v=Vxq9yj2pVWk

Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#45

Post by moyix »

Thorncorona wrote: post #39

Since NSO is able to do these 0 click exploits on iphones does this mean they have have hacked apple engs as well and have copies of iOS lying around?

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#46

Post by julietdg »

There has been something called a Pegasus framework on my iphones since the 5s and now in my xr. I have seen other people question the same thing on apple dev site but just as i never got a response from apple about what it actually is, neither have they. There is also a Pegasus Arm64 too.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#47

Post by mlindner »

walrus01 wrote: post #43

> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and sk…

Signal lets you embed animated images but they still won't let you send native resolution images from your phone to someone else. Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#49

Post by NmAmDa »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

I am not sure what do you mean with unlimited energy here, is it literal or metaphor but I sense a second law of thermodynamics violation.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#50

Post by [deleted] »

moyix wrote: post #45
Thorncorona wrote: post #39

Since NSO is able to do these 0 click exploits on iphones does this mean they have have hacked apple engs as well and have copies of iOS lying around?

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

[deleted]
Post reply on HN