Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

171–180 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#171

Post by snovv_crash »

onphonenow wrote: post #166
saagarjha wrote: post #161

Earlier quoted context omitted.

iOS does not allow the modification or generation of new executable code (at least, it will not at this stage of an exploit). So they are likely creating a weird machine to patch various data and then redirecting control flow with the altered state by overwriting a function pointer.

Right, and they get there of a decomp pass on totally untrusted input over the network. This is why it's so crazy that apple has this huge attack surface. My own suggestion. Ascii only messages if contact is not in address book or is a contact you've communicated with in your message history (however long you keep that) up to 1 year. Once you reply these untrusted saudi contacts can send you the gif meme's.

"Hello this is the state police, your mother just got in a car accident, please respond"

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#172

Post by tmsbrg »

MayeulC wrote: post #128
onphonenow wrote: post #100

Earlier quoted context omitted.

Now - that is a big change. Historically the jump from overflow to RCE was much much shorter. Still the iMessage attack surface is just massive and running in an unsafe language kind of crazy?

> Historically the jump from overflow to RCE was much much shorter. Not really. I am about to read the article, but it sounds like return-oriented programming[1] chaining "gadgets" that are small bits of existing code that you can re-purpose into executing arbitrary code by manipulating the stack. Extremely common exploitation technique, even if not trivial. Who said an exploit or RCE was trivial to exploit? Edit: I…

I think what he means with historically is before ASLR, DEP, and other mitigations, where a buffer overflow meant you can simply overwrite the return pointer at ESP, jump to the stack and run any shellcode. Mitigations have made exploitation much, much more complex nowadays. See for example https://github.com/stong/how-to-exploit-a-double-free

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#173

Post by enlyth »

dreamcompiler wrote: post #160

This is quite clever, but fundamentally it's only possible because of a buffer overflow. If the JBIG decoder had been written in Rust (just to cite one example of a language safer than C), this would have been impossible. Use dumb languages, pwn valuable prizes.

Rust, our saviour, the lord, Jesus and God itself, as is proven in every HN comment thread

Edit: instant flagged for commenting anything non-positive about the Rust evangelism cult

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#174

Post by Aperocky »

addingnumbers wrote: post #84
Aperocky wrote: post #61

Earlier quoted context omitted.

The problem with nation states is that they don't pay people. I don't think nation state can ever come up with something like this - it takes passion, genius and those qualities demand higher premiums than governments are ever willing to hand out.

Their entire business model is predicated on nation-states paying NSO more than NSO pays their employees.

nation states are willing to pay a LOT more for a contract, they just don't want to pay people directly.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#175

Post by meibo »

And still, in 2021, after so many exploits, realizing the futility of trying to fix these bugs and adding their "blast door" process, some Apple dev calls image parsing code where it doesn't belong. The people that are supposed to maintain the element of the OS that has been abused most by nation states do not know the internal APIs they are working with, even just to display looping GIFs.

This negligence is killing journalists and activists.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#176

Post by runeb »

addingnumbers wrote: post #84
Aperocky wrote: post #61

Earlier quoted context omitted.

The problem with nation states is that they don't pay people. I don't think nation state can ever come up with something like this - it takes passion, genius and those qualities demand higher premiums than governments are ever willing to hand out.

Their entire business model is predicated on nation-states paying NSO more than NSO pays their employees.

Yes but they’re are paying for a proven exploit, not sinking money into R&D

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#177

Post by xxpor »

kingaillas wrote: post #137
nafey wrote: post #120

Earlier quoted context omitted.

Is proving P = NP equivalent to knowing how any intractable problem can be solved? Is it possible for P=NP and yet a class of intractable problems to remain unsolved?

It would mean that a large class of problems that have solutions that can be verified quickly can be solved quickly. Which cuts both ways. While that means most protocols used for cryptography would need to be replaced (hashing, digital signatures, etc) it also means other combinatorics algorithms (traveling salesman, protein structure prediction) would become solvable which may been boon for logistics and/or computa…

There's also the chance that while we may be able to come up with a polynomial algorithm for integer factorization, it's not actually practical to run still. Remember computational complexity discards the constants on that polynomial. Practically speaking x^2 + x is a lot different from 2^64x^2 + 2^32x + 2^16 :)

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#178

Post by helsinki »

netizen-936824 wrote: post #28
hn_throwaway_99 wrote: post #19

Earlier quoted context omitted.

A large percentage of the planet has personal sensitive data stored by Google. If that data leaks, even due to a bug in another company's product through which Google has no fault, Google suffers. Google greatly benefits by having a secure Internet.

On this note, has google ever had a breach? I actually can't think of one off the top of my head, which is impressive for a company like google with so much data and such a large footprint Either their security or PR is great (or both?)

https://news.ycombinator.com/item?id=5982313

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#179

Post by Zigurd »

danaris wrote: post #106
vmception wrote: post #58

Earlier quoted context omitted.

Enhancing works with trained AI these days Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure

I've seen some examples of this. It's very clearly trained on a white-male dataset. I've also seen it "enhance" an image of a resistor into a human face. I don't care how much AI you have, you can't add back data that wasn't in the original image. The best you can hope to do is get a vague approximation, and you must have a very, very good (comprehensive) training dataset for that to be remotely viable.

> It's very clearly trained on a white-male dataset.

TBF the Beatles look amazing in the Peter Jackson documentary, though the original material was shot on 16mm.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#180

Post by malshe »

Etheryte wrote: post #170
malshe wrote: post #52

From the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR ( https://www.johnscottrailton.com ) and make him say controversial things…

The transcript is such an intriguing read. You don't expect these things to happen in real life, but yet here they are, tie-cameras, pen recorders, driving circles around the block and all.

100% with you on this one. My life feels so boring in comparison!
Post reply on HN