Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

51–60 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#51

Post by NikolaeVarius »

EvanAnderson wrote: post #41
ttul wrote: post #36

TL;DR - the ending of the post is all you need: “JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operation…

This one will be another talking point right beside the "arbitrary code execution in SNES games via controller inputs" as a rebuke to arguments about even small systems (like an image decompressor) being "made secure". I also keep thinking "The Cylons would totally write an exploit like this."

Do we know for a fact the NSO group are in fact NOT Cylons?

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#52

Post by malshe »

From the top of the article:

> We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis.

This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR (https://www.johnscottrailton.com) and make him say controversial things, which could be later used to malign Citizen Lab. Darknet Diaries covered this incident recently: https://darknetdiaries.com/episode/99/

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#53

Post by nlh »

As other have commented, this is absolutely mind-bogglingly hard core. Kudos to the NSO group engineers who designed and built this (regardless of your allegiances and whether you like or dislike that they do this and whether it's objectively good or evil or somewhere in between, you have to admit that it's deeply technically impressive).

Does anyone have a sense of who they sold this to and who used this particular 0-click exploit?

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#54

Post by rowanG077 »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

I feel the opposite. All this stuff and even more hardcore crypto stuff is all relatively simple math. It's not even close to comparable to the things mathematicians do. Or even what physicist have achieved with LHC or fusion research.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#55

Post by olliej »

netizen-936824 wrote: post #34
olliej wrote: post #7

Earlier quoted context omitted.

Right? I was using VM as a short hand - it is after all a virtual just more virtual than usual :)

I think VM is the correct term here. They are technically emulating hardware

Yeah, but I also understand that in general parlance VM means a higher level virtualization.

Eventually though you get into one of those annoying simulation vs emulation style arguments so I’m happy to accept either definition of VM, just as long as both sides agree on what it is that they’re discussing :)

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#56

Post by vmception »

> further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states

I mean the whole “nation state” or “nation state backed” hackers thing was always a liiiiitle (very) ambiguous right?

Does the evidence really even move the goal post or mitigate the convenient scapegoating?

Politicians and CEOs and certified IT professionals are all incentivized to say “it was a nation state there’s nothing we could have done!” and rely on their sycophants to never question it, instead of “we’re incompetent and powerless towards random teenagers who rented a rootkit before renting a compromised windows machine that happened to be located in russia”

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#57

Post by detritus »

xxpor wrote: post #25
ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

Kind of ironic to use P = NP as an example of something to work on considering the biggest implications of proving P = NP :)

Forgive my ignorance, but what would they be - the complete implosion of all forms of known security, or something else?

This is a bit beyond my ken :)

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#58

Post by vmception »

athenot wrote: post #44
airstrike wrote: post #11

Earlier quoted context omitted.

That reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."

Then you can "Enhance". https://www.youtube.com/watch?v=Vxq9yj2pVWk Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.

Enhancing works with trained AI these days

Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#59

Post by vmception »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

It just is another example that bug bounties are undervalued and the experience doing anything “white hat” is too disastrous to be worth it.

Responsible disclosure is for the gullible.

The market keeps saying “this is what its worth”

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#60

Post by nightpool »

mlindner wrote: post #47
walrus01 wrote: post #43

> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and sk…

Signal lets you embed animated images but they still won't let you send native resolution images from your phone to someone else. Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.

How could Signal recompress images while retaining end-to-end encryption? Wouldn't any "recompression" happen entirely on the client-side, and therefore be fair game for hackers to bypass with their own payloads?
Post reply on HN