Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi woman's iPhone revealed hacking around the world

reuters.com

Post reply on HN
Print view View original

81–90 of 184 posts

Re: A Saudi woman's iPhone revealed hacking around the world

#81

Post by theshrike79 »

IncRnd wrote: post #60
judge2020 wrote: post #40

Earlier quoted context omitted.

These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1]. 0:…

You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.

Vulnerabilities on iOS are getting really scarce. People spend truckloads of money finding them and you need to pay twice that for the permission to burn said exploit.

That stuff isn't burned on mass hacks on random phone users, it's way too valuable.

BUT. There is a small sliver of time between the exploit being used on a high value target and Apple patching the hole. That's the spot where Joe Schmoe should be cautious.

Re: A Saudi woman's iPhone revealed hacking around the world

#82

Post by rasz »

TheBozzCL wrote: post #5
Steko wrote: post #3

Earlier quoted context omitted.

Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

Did you miss https://en.wikipedia.org/wiki/Stagefright_(bug) ?

Re: A Saudi woman's iPhone revealed hacking around the world

#83

Post by beebeepka »

BeetleB wrote: post #64
Synaesthesia wrote: post #35

Earlier quoted context omitted.

It's just a very minor victory for women's rights and it was a very impractical law anyway. It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies. Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.

Quoted post unavailable.

No post body was provided.

Re: A Saudi woman's iPhone revealed hacking around the world

#84

Post by heavyset_go »

TheBozzCL wrote: post #5
Steko wrote: post #3

Earlier quoted context omitted.

Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

Exploits via image libraries have been a perennial threat. A lot of jailbreaks on various devices and consoles over the last 20 years owe their existence to such exploits.

Re: A Saudi woman's iPhone revealed hacking around the world

#85

Post by anothernewdude »

patja wrote: post #2

"The image files tricked the iPhone into giving access to its entire memory, bypassing security and allowing the installation of spyware that would steal a user's messages." Seems like there is a lot behind this summary of the hack. How does an image file trick the iPhone into all that?

As of windows 7, the parsing of some font files was handled inside the Windows Kernel.

Re: A Saudi woman's iPhone revealed hacking around the world

#86

Post by Bombthecat »

thaumasiotes wrote: post #68
bombcar wrote: post #28

Earlier quoted context omitted.

Which is why the only safe way to operate is assume anything that is susceptible to outside data is already compromised - and so run them in sandboxes.

That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.

I always remember a quote from a sci fi I read about the "multi planet Internet" there.

It was layer upon layer upon layer of protocols and software.

Because it wasn't possible to remove old layers (because some satellites or wormholes or whatever would stop working.)

So, it was super easy to hack...and sending spam. Well you will get killed for that though.

Re: A Saudi woman's iPhone revealed hacking around the world

#87

Post by rvnx »

onion2k wrote: post #66
rfoo wrote: post #63

Earlier quoted context omitted.

Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.

once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?

Yes, probably the backdoors that security companies implement on the phones to exfiltrate and sell data would reveal that.

Re: A Saudi woman's iPhone revealed hacking around the world

#88

Post by petra »

bombcar wrote: post #28
retrac wrote: post #19

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter abo…

Which is why the only safe way to operate is assume anything that is susceptible to outside data is already compromised - and so run them in sandboxes.

The tech is the easy part: iOS/Android have the best security teams in the world, and an unlimited budget, and sandboxing is an old, proven tech.

I guess that the politics here are the real barrier.

Re: A Saudi woman's iPhone revealed hacking around the world

#89

Post by lenkite »

a1a106ed5 wrote: post #43
jtsiskin wrote: post #23

Earlier quoted context omitted.

Not to sound like a broken record but…. This was yet another memory management bug that would have been prevented if using a memory safe language

On a brighter note, apple is currently in the process of converting almost all iMessage components to Swift for this reason. I'm sure it is taking many engineering hours, and image parsers/open source libraries like this are the most difficult to convert.

Is there a link that mentions this ? The bug was in the ImageIO/Core Graphics layer so are they re-writing all Core Graphics components in Swift ?

Re: A Saudi woman's iPhone revealed hacking around the world

#90

Post by jack_pp »

TheBozzCL wrote: post #5
Steko wrote: post #3

Earlier quoted context omitted.

Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

they are safe, unless they're being targeted by state actors.
Post reply on HN