Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

21–30 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#21

Post by simion314 »

bilbo0s wrote: post #10
xyzzy123 wrote: post #4

"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe.

This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before Rust was born, the issue was that either the languages were too slow, were not cross platform or had weird license or were "garbage".

If this gaints like Apple, Google, Facebook would contribute on rewriting or prove that the core libraries they use are correct then things would improve, but how would they continue to increase their obscene profits ?

Re: ‘Zero-click’ hacks are growing in popularity

#22

Post by AussieWog93 »

speedgoose wrote: post #18
Grimburger wrote: post #12

Earlier quoted context omitted.

> safe code is impossible > Humans cannot write safe software. Ever. No matter what. Formally proven code does what it says on the box? Do we have different definitions of safe perhaps?

The proof may be valid but the implementation may have a mistake, or the compiler, or the operating system, or the hardware.

Or if it dynamically loads anything that isn't formally proved.

Re: ‘Zero-click’ hacks are growing in popularity

#23

Post by xvector »

ajconway wrote: post #7
stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

There are software engineers who sometimes write code that’s not perfect.

So frustrated with the slow adoption/transition to memory-safe languages.

Re: ‘Zero-click’ hacks are growing in popularity

#24

Post by CorrectHorseBat »

Grimburger wrote: post #12
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

> safe code is impossible > Humans cannot write safe software. Ever. No matter what. Formally proven code does what it says on the box? Do we have different definitions of safe perhaps?

but does the hardware? Formally proven code does not prevent you from hardware bugs like rowhammer.

Re: ‘Zero-click’ hacks are growing in popularity

#25

Post by b112 »

Grimburger wrote: post #12
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

> safe code is impossible > Humans cannot write safe software. Ever. No matter what. Formally proven code does what it says on the box? Do we have different definitions of safe perhaps?

You mean, when you look at your code, or someone else does, they think it's ok?

I guess that's why security issues, even in massively peer reviewed code, are a thing of the past, right?

Do your best, code as safely and securely as you know how, peer review and test and fuzz...

Then when you deploy your code, treat it as vulnerable, because history days it likely is.

Treat your phone as compromised. Anything network connected as compromised.

Because history says it can be, and easily.

Monitoring is one of the most important security measures for a reason.

Re: ‘Zero-click’ hacks are growing in popularity

#26

Post by egberts1 »

b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

Apparently, formal proof of algorithms being safe and sound has been repeatedly demonstrated, just not so toward Apple’s closed (proprietary) software specifically their large 14-format image decoders running outside a sandbox.

Re: ‘Zero-click’ hacks are growing in popularity

#27

Post by formerly_proven »

bilbo0s wrote: post #10
xyzzy123 wrote: post #4

"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

> And those apps, probably upwards of 99.999999% of them will be unsafe.

Apps are sandboxed, so the damage should be limited to only the exploited app.

Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.

Re: ‘Zero-click’ hacks are growing in popularity

#28

Post by b112 »

littlestymaar wrote: post #14
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

You're missing the point. Humans cannot write bug-free software[1]. Then if you're soft has security-related things to do (like credential management etc.) you cannot be sure there won't be a way to bypass it. But here we're talking almost exclusively about remote execution bugs coming from memory-safety issues , which are indeed preventable. Any managed language does the trick, and if they are not fast enough for yo…

There is no safe way to code anything, ever.

(Yes people, and Apple should try, but...)

Re: ‘Zero-click’ hacks are growing in popularity

#29

Post by bawolff »

fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

> it doesn't show non-ASCI symbols in window titles in dom0:

Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.

Re: ‘Zero-click’ hacks are growing in popularity

#30

Post by [deleted] »

allisdust wrote: post #16

It's high time governments and mega corps fund projects that rewrite all media decoding libraries in pure Rust (or some managed language is performance is not a concern). People keep saying RIR is some how pointless but the reality is that its impossible to keep ahead of those vulnerabilities that aren't found yet.

[deleted]
Post reply on HN