61–70 of 184 posts
Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?
Apple’s security teams aren’t public facing; I suspect if a corporate or university customer had security issues, they would be addressed.
Earlier quoted context omitted.
Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.
There are two different types of attacks. One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures. Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.
Earlier quoted context omitted.
These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1]. 0:…
You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
Earlier quoted context omitted.
The irony is that he's also the one who forced the country to allow women to drive.
It's just a very minor victory for women's rights and it was a very impractical law anyway. It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies. Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.
Earlier quoted context omitted.
You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
Earlier quoted context omitted.
Not to sound like a broken record but…. This was yet another memory management bug that would have been prevented if using a memory safe language
I’m only a few more CVE’s from advocating C++ and Objective(ly)-C(rap) proponents be subject to registration and public humiliation whenever the (inevitable) next issue occurs. I get it, legacy crap has momentum and you can’t ignore that. What’s not ok is the mountain of people who pretend that’s not a problem.
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter abo…
Which is why the only safe way to operate is assume anything that is susceptible to outside data is already compromised - and so run them in sandboxes.
Earlier quoted context omitted.
You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
Earlier quoted context omitted.
Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625
Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.