Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

101–110 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#101

Post by sterlind »

inasio wrote: post #86
usmannk wrote: post #3

This is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.

It seems we're now at the point where anything Turing complete can be a vector. Wow...

this wasn't Turing-complete until they exploited it to make it so. JBIG2 executes arbitrary binary bitmap operations, but sequentially (no looping.) using the exploit they presumably found a way to send it into a loop, probably by overwriting the pointer to the next segment or something.

theoretically I guess you don't need that, but you'd have to send a payload linear in size to the number of cycles expected to run the shellcode, and that wouldn't lend itself to a processor-like design - it'd just be too big.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#103

Post by teh_infallible »

inter_netuser wrote: post #38
ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

Dear sir, the entire NSA staff are currently plugging away on that pesky P=NP problem, including datacenter janitors.

I have suspected for awhile now that the bitcoin blockchain is actually an attempt to break SHA-256. Bitcoin is built around incentives, and it has created an incentive for people all over the world to basically brute force this algorithm and maintain a recursive set of low entropy outputs.

Which would make the btc blockchain an incredibly expensive and valuable data set, for someone armed with the right mathematical theory.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#104

Post by sterlind »

ASalazarMX wrote: post #40
ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.

kinda like Werner von Braun, maybe. he just wanted to make rockets. whether they were for Nazi Germany or the US didn't matter, whether they were missiles or spacecraft didn't matter, he just wanted to build them.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#105

Post by xiphias2 »

ASalazarMX wrote: post #40
ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.

They don’t really have to, they can just mine Bitcoin by reversing SHA256 in polynomial time, inspect https messages to banks, or send Bitcoin to themselves by creating an ECDSA signature… or just set up a software as a service and have the biggest business in the world.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#106

Post by danaris »

vmception wrote: post #58
athenot wrote: post #44

Earlier quoted context omitted.

Then you can "Enhance". https://www.youtube.com/watch?v=Vxq9yj2pVWk Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.

Enhancing works with trained AI these days Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure

I've seen some examples of this. It's very clearly trained on a white-male dataset.

I've also seen it "enhance" an image of a resistor into a human face.

I don't care how much AI you have, you can't add back data that wasn't in the original image. The best you can hope to do is get a vague approximation, and you must have a very, very good (comprehensive) training dataset for that to be remotely viable.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#107

Post by sterlind »

walrus01 wrote: post #90
nightpool wrote: post #60

Earlier quoted context omitted.

How could Signal recompress images while retaining end-to-end encryption? Wouldn't any "recompression" happen entirely on the client-side, and therefore be fair game for hackers to bypass with their own payloads?

It's my understanding that the signal client which is sending the image reads the jpg/png/whatever image file from local storage, recompresses it local client side, and then sends the smaller version.

then that offers no security at all, since an attacker could use a hacked client. unless clients also refuse to receive anything but one, very well-validated, format, so that sending anything funky would be futile.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#108

Post by johndoughy »

ttul wrote: post #36

TL;DR - the ending of the post is all you need: “JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operation…

They must have spent tons of engineering effort to create this virtual computer to act as their foundation for further exploits. They don't deserve any sympathy of course, but it must really suck that their foundation disappears immediately with the fixed vulnerability.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#109

Post by shmatt »

NSO get way too much credit/dramatization these days. They are mostly 2 things

* a shiny UI for customers

* a bank of 0-days

Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased.

Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres really no way to stop a 0day from leaking from a researcher like that

This exploit has been closed, but we haven't heard anything about Pegasus not working anymore, so i'm just assuming they moved on to the next exploit. Previously there was a big Whatsapp exploit FB closed that had them hurting. I'm sure they always have multiple backups for when this happens

There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. NSO is just "in your face" which makes people angry

NSO was caught, and thats why Google is crediting them. But this same exploit could have been heavily used by 8200/NSA/who knows who else

Post reply on HN