Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

121–130 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#121

Post by wolf550e »

shmatt wrote: post #109

NSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased. Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres real…

The researcher that leaves the military takes with them general skills in reverse engineering and exploit development, but they cannot use specific 0days they know about from their military service. The specifics of everything done in the military is classified. People told me they couldn't mention in job interviews some of the skills they have because it's a secret. Like, if someone developed this Turing complete architecture on top of jbig2 decompression while they were in the military, it would be considered a secret that cannot be revealed.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#122

Post by ChuckMcM »

usmannk wrote: post #3

This is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.

I read through this and my jaw dropped. Pretty amazing detective work and a really amazing exploit. Presumably you could run Doom on it :-).

Sometimes I feel like it's hopeless but my brain cannot help but work on creating solutions to this sort of problem.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#124

Post by Jerrrry »

shmatt wrote: post #109

NSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased. Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres real…

>There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days.

popular social media account handles go for 4 figures.

people have wallets on their phones with 6+ figures in crypto

OSINT'ing a billionaires' phone number, leveraging a 0-click, and you are looking at 8+ figure trade, personal, and national secrets.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#125

Post by trashcat »

malshe wrote: post #52

From the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR ( https://www.johnscottrailton.com ) and make him say controversial things…

I literally just listened to this episode today. Some crazy stuff.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#126

Post by moyix »

toxik wrote: post #77
moyix wrote: post #45

Earlier quoted context omitted.

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

I mean, you’re not going to fuzz your way to bit twiddling together a small virtual computer inside of a compression stream.

Of course – but you can definitely fuzz your way to the initial vulnerability. The VM stuff is done once you have that vulnerability and are writing the actual exploit, which is a manual process.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#127

Post by robocat »

sophacles wrote: post #35
netizen-936824 wrote: post #28

Earlier quoted context omitted.

On this note, has google ever had a breach? I actually can't think of one off the top of my head, which is impressive for a company like google with so much data and such a large footprint Either their security or PR is great (or both?)

There was this one: https://en.wikipedia.org/wiki/Operation_Aurora It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.

Google banned Windows throughout the organisation in 2010 due to this (with some well fenced exceptions where Windows was unavoidable).

1. Google will do costly things to be secure.

2. At the time I did not hear of any other organisation following Google’s lead.

3. They did not reverse the ban later.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#128

Post by MayeulC »

onphonenow wrote: post #100
toxik wrote: post #74

Earlier quoted context omitted.

It also demonstrates how much more work there is after “buffer overflow” until you get to RCE.

Now - that is a big change. Historically the jump from overflow to RCE was much much shorter. Still the iMessage attack surface is just massive and running in an unsafe language kind of crazy?

> Historically the jump from overflow to RCE was much much shorter.

Not really. I am about to read the article, but it sounds like return-oriented programming[1] chaining "gadgets" that are small bits of existing code that you can re-purpose into executing arbitrary code by manipulating the stack. Extremely common exploitation technique, even if not trivial. Who said an exploit or RCE was trivial to exploit?

Edit: I was a bit quick to dismiss. The technique is certainly interesting, although the article doesn't go into the details of how the control flow is handled and where that register is stored. However, I'd like to point out that ROP is quite complex on its own, as it's kind of like using a computer with an arbitrary instruction set that you have to combine to create higher-level functions, hence my original confusion.

[1] https://en.wikipedia.org/wiki/Return-oriented_programming

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#129

Post by codezero »

ushakov wrote: post #10
SamuelAdams wrote: post #8

Earlier quoted context omitted.

Project Zero is a team of security analysts employed by Google tasked with finding zero-day vulnerabilities. https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 Don’t think of these folks as “google” employees. Think of them as “really good hackers with corporate sponsorship”. They look for flaws in everything - windows, apple, Linux, and google software. You should read some earlier blog posts, they’re really hig…

how does Google benefit from this?

Google employs a lot of people using Apple hardware.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#130

Post by sangnoir »

Jerrrry wrote: post #124
shmatt wrote: post #109

NSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased. Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres real…

>There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. popular social media account handles go for 4 figures. people have wallets on their phones with 6+ figures in crypto OSINT'ing a billionaires' phone number, leveraging a 0-click, and you are looking at 8+ figure trade, personal, and national secrets.

This has already allegedly happened to Bezos (attacked by Saudi Arabia IIRC, which is an NSO customer). This was likely over his ownership of Washington Post and the reporting on the killing of Kashoggi.

Yeah, billionaires and Trillion-dollar company CxOs have to step up their electronic security

Post reply on HN