Since the buffer overflow was in xpdf, perhaps image previews in Ubuntu are affected as well?
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
231–240 of 360 posts
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#232Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#233I'm surprised this works if image rendering is sandboxed and prevented from doing anything except for writing to a frame buffer.
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#234And still, in 2021, after so many exploits, realizing the futility of trying to fix these bugs and adding their "blast door" process, some Apple dev calls image parsing code where it doesn't belong. The people that are supposed to maintain the element of the OS that has been abused most by nation states do not know the internal APIs they are working with, even just to display looping GIFs. This negligence is killing…
It really does seem like a failure of blast door.
Parsing any untrusted data should always be sandboxed.
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#235Earlier quoted context omitted.
I think you get credit for having a bank of actual zero days, self-discovered or not Trying to trivialize the threat they pose only helps NSO Plus, "willing to sell to nations with bad human rights records" should be on that list
“All the us army is is a bunch of tanks and planes”
[deleted]
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#236Earlier quoted context omitted.
Right, and they get there of a decomp pass on totally untrusted input over the network. This is why it's so crazy that apple has this huge attack surface. My own suggestion. Ascii only messages if contact is not in address book or is a contact you've communicated with in your message history (however long you keep that) up to 1 year. Once you reply these untrusted saudi contacts can send you the gif meme's.
"Hello this is the state police, your mother just got in a car accident, please respond"
In the US if something serious like this happens the police will physically notify the next of kin of it, not send you a text.
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#237Earlier quoted context omitted.
That reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."
"I found a 3rd party library that uses eval, so we just send it code we want to run and...boom. We're in." "I found a popular chat app that after install leaves a tool with full sudo privileages behind for us to take advantage of located clickityclickity... here. We're in." Sometimes, it can be even more pedestrian sounding. Hackers don't always have to be clever if other people are absolutely dumbasses before their…
To be clear, what this exploits is nothing like what you've mentioned.
The article does a very good job of describing the relevant parts of the image format. They built a VM inside of an images single pass decompression route. I'd highly recommend reading the article.
This is just one of the exploits in a very large chain.
To quote some of the nations top security researchers:
> Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.
This has nothing in relationship to eval().
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#238Now they just have to publish the VM so I can do next year's Advent of Code in it.
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#239From the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR ( https://www.johnscottrailton.com ) and make him say controversial things…
Darknet Diaries is so good. To anyone who hasn't listened, highly recommend. Jack hits a homerun each week and the story about JSR and NSO was buck wild
Jack is awesome. Btw, I must give credit to many in the HN community who have recommended this podcast so many time in various threads. On my own I would have never found it.
Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
#240Earlier quoted context omitted.
Which we have a descriptive word for: unethical. The colorful word would be: disgusting
There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.
I'm not sure what world you live in where saying "I don't care if I'm making missiles for Germany or the USA" is not an ethical violation and is somehow patriotism... but I don't want to live in it with you.