Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

191–200 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#191

Post by [deleted] »

S_A_P wrote: post #116
malshe wrote: post #52

From the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR ( https://www.johnscottrailton.com ) and make him say controversial things…

https://9to5mac.com/2021/12/15/pegasus-spyware-maker-nso-run... hopefully this company is on the way out...

[deleted]

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#192

Post by rhizome »

snovv_crash wrote: post #171
onphonenow wrote: post #166

Earlier quoted context omitted.

Right, and they get there of a decomp pass on totally untrusted input over the network. This is why it's so crazy that apple has this huge attack surface. My own suggestion. Ascii only messages if contact is not in address book or is a contact you've communicated with in your message history (however long you keep that) up to 1 year. Once you reply these untrusted saudi contacts can send you the gif meme's.

"Hello this is the state police, your mother just got in a car accident, please respond"

[calls phone number]

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#193

Post by pornel »

bscphil wrote: post #131
sterlind wrote: post #107

Earlier quoted context omitted.

then that offers no security at all, since an attacker could use a hacked client. unless clients also refuse to receive anything but one, very well-validated, format, so that sending anything funky would be futile.

No, just have the server reject anything at the /SendMessage endpoint over a certain size; presumably the client is resizing / recompressing images to hit a specific target.

That won't help much.

• Compressing to a file size limit is actually difficult/expensive. Tools usually target some good-enough quality level, and then the file size depends on remaining entropy in the image. The limit would need to be conservatively high.

• Exploits aren't necessarily larger than an average image. Adversaries in this case are quite skilled, and may be able to codegolf it if necessary.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#197

Post by pornel »

dreamcompiler wrote: post #160

This is quite clever, but fundamentally it's only possible because of a buffer overflow. If the JBIG decoder had been written in Rust (just to cite one example of a language safer than C), this would have been impossible. Use dumb languages, pwn valuable prizes.

This case is easy. No need to rewrite: deleted code is even safer than Rust.

Apart from Rust, Wuffs is also a good candidate for codecs: https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang...

Too bad that Swift isn't that good for low-level codecs, so a Swift rewrite of Messages couldn't remove C dependencies.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#198

Post by dylan604 »

airstrike wrote: post #11
usmannk wrote: post #3

This is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.

That reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."

"I found a 3rd party library that uses eval, so we just send it code we want to run and...boom. We're in."

"I found a popular chat app that after install leaves a tool with full sudo privileages behind for us to take advantage of located clickityclickity... here. We're in."

Sometimes, it can be even more pedestrian sounding. Hackers don't always have to be clever if other people are absolutely dumbasses before their arrival.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#199

Post by nova22033 »

nlh wrote: post #53

As other have commented, this is absolutely mind-bogglingly hard core. Kudos to the NSO group engineers who designed and built this (regardless of your allegiances and whether you like or dislike that they do this and whether it's objectively good or evil or somewhere in between, you have to admit that it's deeply technically impressive). Does anyone have a sense of who they sold this to and who used this particular…

The Indian government used it to spy on opposition politicians

https://theprint.in/opinion/only-15-indians-know-about-pegas...

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#200

Post by bt1a »

AlexanderTheGr8 wrote: post #138
mark_mart wrote: post #110

Earlier quoted context omitted.

These people probably smartest developers in the world. I wouldn't compare myself with them.

You think? These devs are some of the devs in Israel. The best get too popular to work in secret labs like NSO. I find it hard to believe that the best devs are secret ones in Israel. But obviously, I could be wrong.

I'd imagine there is a fair share of amazing developers that have no interest in flaunting or broadcasting their talent, for at some level it just isn't necessary to advance their career.
Post reply on HN