Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

301–310 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#301

Post by Dylan16807 »

snarf21 wrote: post #64
detritus wrote: post #57

Earlier quoted context omitted.

Forgive my ignorance, but what would they be - the complete implosion of all forms of known security, or something else? This is a bit beyond my ken :)

Among other things, mostly encryption. Most of our current methods depends on P != NP. So no need for 0 days if you can just read at encrypted data as if it wasn't.

> Most of our current methods depends on P != NP.

Not really. They depend on guessing being slow. P, just P, can do slow. P can be bigger than the universe even with low values of n.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#302

Post by rootkea »

Karupan wrote: post #273
nova22033 wrote: post #199

Earlier quoted context omitted.

The Indian government used it to spy on opposition politicians https://theprint.in/opinion/only-15-indians-know-about-pegas...

I remember reading this. Are you aware of a detailed account? Regardless of Indian politics, has it actually been proven/researched?

> has it actually been proven/researched?

Yes.

"The Wire has confirmed the numbers of at least 40 journalists who were either targets or potential targets for surveillance. Forensic analysis was conducted on the phones of seven journalists, of which five showed traces of a successful infection by Pegasus." https://thewire.in/rights/project-pegasus-list-of-names-unco...

The forensic analysis was conducted by Amnesty International's Security Lab and was peer-reviewed by Citizen Lab 1. https://www.amnesty.org/en/latest/research/2021/07/forensic-... 2. https://citizenlab.ca/2021/07/amnesty-peer-review/

Also, "In the midst of the heated West Bengal assembly election, the phone of poll strategist Prashant Kishor was broken into using NSO Group’s Pegasus spyware, according to digital forensics conducted by Amnesty International’s Security Lab and shared with The Wire." https://thewire.in/government/prashant-kishor-mamata-banerje...

Govt of India in parliament on NSO group (Dec 3, 2012): "There is no proposal for banning any group named NSO group" https://twitter.com/A2D2_/status/1466700684573642752

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#303

Post by n-e-w »

You have to hand it to NSO on this one. They might be evil but they sure aren't stupid.

They (loosely) created a virtual machine out of a (very) abstract vuln in the JBIG2 library to create their own logical Turing machine / computer that they then built their own simple architecture for...and then could allow for the computation of any arbitrary function within arbitrary memory. Brilliant; bravo. I salute the ingenuity of this one.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#304

Post by saiya-jin »

jstanley wrote: post #96
saiya-jin wrote: post #82

Earlier quoted context omitted.

Sorry but can't agree here - this stuff is proper evil for most of world population, which includes also most of HN readers (no its not just SV and 5 other guys). Its more often than not used to oppress common citizens, freedom thinkers and truth sayers. They are actively making this world a much worse place long term, and why - pure greed for money and power. They don't even try to act like there is some moral / law…

I don't think any of what you said refutes the point that this is deeply technically impressive.

It does to me, but then I have my own moral values.

How nazis organized jewish extermination of millions in concentration camps might be also amazing from bureaucratic & organizational point of view, yet I completely fail to marvel at such an achievement in efficiency.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#306

Post by est »

mmastrac wrote: post #4
olliej wrote: post #2

Ok, they apparently made a VM using just the JBIG2 logical operators, that’s both hilarious and amazing. Still hate NSO though.

Not just a VM - effectively a computer. Holy crap that's amazing (ly evil).

Not just an effective computer, but a computer that scans iOS memory and RCE exactly as planned, without crashing or failing.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#307

Post by baybal2 »

musicale wrote: post #234
meibo wrote: post #175

And still, in 2021, after so many exploits, realizing the futility of trying to fix these bugs and adding their "blast door" process, some Apple dev calls image parsing code where it doesn't belong. The people that are supposed to maintain the element of the OS that has been abused most by nation states do not know the internal APIs they are working with, even just to display looping GIFs. This negligence is killing…

It really does seem like a failure of blast door. Parsing any untrusted data should always be sandboxed.

The image library also runs sandboxed, and they found a way to "escape it with ease."

Sandboxes don't reduce the need in having programmers with straight hands. They just trade less safe APIs, for ones deemed more so. You will have as much holes in the sandbox, as much APIs you add to it.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#308

Post by baybal2 »

mlindner wrote: post #47
walrus01 wrote: post #43

> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and sk…

Signal lets you embed animated images but they still won't let you send native resolution images from your phone to someone else. Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.

> Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.

I believe they wont use Signal's own client to send their exploit. Client side TX restrictions make no sense.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#309

Post by thdespou »

In the last sentence:

>The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.

I bet even the Project Zero authors were profoundly amazed how NSO hackers managed to do that. Maybe they can hire them when NSO goes bust.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#310

Post by native_samples »

musicale wrote: post #234
meibo wrote: post #175

And still, in 2021, after so many exploits, realizing the futility of trying to fix these bugs and adding their "blast door" process, some Apple dev calls image parsing code where it doesn't belong. The people that are supposed to maintain the element of the OS that has been abused most by nation states do not know the internal APIs they are working with, even just to display looping GIFs. This negligence is killing…

It really does seem like a failure of blast door. Parsing any untrusted data should always be sandboxed.

In this case they obviously didn't realize it needed to be called inside the sandbox. That function name really is amazingly misleading about what it will do. Anyone could have made that mistake.
Post reply on HN