Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

241–250 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#241

Post by imajoredinecon »

ASalazarMX wrote: post #40
ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.

> digital equivalent

In fact, many are literally mercenary soldiers!

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#242

Post by onphonenow »

tmsbrg wrote: post #172
MayeulC wrote: post #128

Earlier quoted context omitted.

> Historically the jump from overflow to RCE was much much shorter. Not really. I am about to read the article, but it sounds like return-oriented programming[1] chaining "gadgets" that are small bits of existing code that you can re-purpose into executing arbitrary code by manipulating the stack. Extremely common exploitation technique, even if not trivial. Who said an exploit or RCE was trivial to exploit? Edit: I…

I think what he means with historically is before ASLR, DEP, and other mitigations, where a buffer overflow meant you can simply overwrite the return pointer at ESP, jump to the stack and run any shellcode. Mitigations have made exploitation much, much more complex nowadays. See for example https://github.com/stong/how-to-exploit-a-double-free

Exactly. This escape is technically quite cool frankly in terms of some creativity.

That said, my own view is that messages from untrusted contacts should be straight ascii, parsed in a memory safe language with no further features until you interact (ie, write back etc).

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#244

Post by inkyoto »

saagarjha wrote: post #161
MayeulC wrote: post #159

Earlier quoted context omitted.

> 70,000 step program My initial assumption was that they would compile a program, take the binary output as an image and JBIG2-compress it, as I don't really get how they would use the result of the binary operations to branch to different code. Reading the article a bit more, I think they can loop multiple times over the area, by changing w , h and line dynamically over each pass, which would give them some kind of…

iOS does not allow the modification or generation of new executable code (at least, it will not at this stage of an exploit). So they are likely creating a weird machine to patch various data and then redirecting control flow with the altered state by overwriting a function pointer.

> […] then redirecting control flow with the altered state by overwriting a function pointer.

The analysis calls this out specifically:

> Conveniently since JBIG2Bitmap inherits from JBIG2Segment the seg->getType() virtual call succeed even on devices where Pointer Authentication is enabled

Which is disturbing. Was the code compiled for the arch64e architecture in the first place, or it is a bug in the LLVM compiler toolchain? The armv8.3 authenticated pointers have been invented to preclude this from happening, but that is not the case with the exploit.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#245

Post by joshuamorton »

robocat wrote: post #127
sophacles wrote: post #35

Earlier quoted context omitted.

There was this one: https://en.wikipedia.org/wiki/Operation_Aurora It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.

Google banned Windows throughout the organisation in 2010 due to this (with some well fenced exceptions where Windows was unavoidable). 1. Google will do costly things to be secure. 2. At the time I did not hear of any other organisation following Google’s lead. 3. They did not reverse the ban later.

Also, iirc P0 was created as a result of that breach.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#246

Post by FridayoLeary »

flyinglizard wrote: post #215
earthscienceman wrote: post #136

Earlier quoted context omitted.

Which we have a descriptive word for: unethical. The colorful word would be: disgusting

There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.

I think it's beyond barbaric to calmly send a request for more slaves (Jews other minorities) for the factory work, due to them inconveniently dying too fast. Because of the inhuman working conditions. I read that he did that all. He wasn't merely a patriotic, unaffected scientist, he played a part in the holocaust.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#247

Post by FridayoLeary »

flyinglizard wrote: post #215
earthscienceman wrote: post #136

Earlier quoted context omitted.

Which we have a descriptive word for: unethical. The colorful word would be: disgusting

There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.

I think it's barbaric to calmly send a request for more slaves (Jews other minorities) for the factory work, due to them inconveniently dying too fast. Because of the inhuman working conditions. I read that he did that all. He wasn't merely a patriotic, unaffected scientist, he played a part in the holocaust.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#248

Post by shakna »

Zigurd wrote: post #179
danaris wrote: post #106

Earlier quoted context omitted.

I've seen some examples of this. It's very clearly trained on a white-male dataset. I've also seen it "enhance" an image of a resistor into a human face. I don't care how much AI you have, you can't add back data that wasn't in the original image. The best you can hope to do is get a vague approximation, and you must have a very, very good (comprehensive) training dataset for that to be remotely viable.

> It's very clearly trained on a white-male dataset. TBF the Beatles look amazing in the Peter Jackson documentary, though the original material was shot on 16mm.

There is a world of difference upscaling something digital, and something analog. 16mm film actually does contain more information than could be shown with the original film. We have better scanning techniques today that can extract that information.

Upscaling something digital, does require creating information out of thin air, on the other hand.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#249

Post by dylan604 »

joe_guy wrote: post #237
dylan604 wrote: post #198

Earlier quoted context omitted.

"I found a 3rd party library that uses eval, so we just send it code we want to run and...boom. We're in." "I found a popular chat app that after install leaves a tool with full sudo privileages behind for us to take advantage of located clickityclickity... here. We're in." Sometimes, it can be even more pedestrian sounding. Hackers don't always have to be clever if other people are absolutely dumbasses before their…

To be clear, what this exploits is nothing like what you've mentioned. The article does a very good job of describing the relevant parts of the image format. They built a VM inside of an images single pass decompression route. I'd highly recommend reading the article. This is just one of the exploits in a very large chain. To quote some of the nations top security researchers: > Based on our research and findings, we…

I'm thinking you're missing the larger idea. The whole point is that while these "geniuses" did something really "impressive" and difficult, there are just as really not-impressive and not-difficult things found in the wild that have caused problems as well.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#250

Post by intrasight »

nexuist wrote: post #221
intrasight wrote: post #194

I know that I'm generalizing and also being somewhat sarcastic, but can't we blame the majority of exploits on the von Neumann architecture?

We can blame the majority of software on the von Neumann architecture

Indeed
Post reply on HN