Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

31–40 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#31

Post by [deleted] »

bawolff wrote: post #29
fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

> it doesn't show non-ASCI symbols in window titles in dom0: Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.

[deleted]

Re: ‘Zero-click’ hacks are growing in popularity

#32

Post by bawolff »

stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

URL preview is a pretty big attack surface, you have to fetch over network using complex protocols, parse the result for a variety of formats, and then render it.

Re: ‘Zero-click’ hacks are growing in popularity

#33

Post by formerly_proven »

bawolff wrote: post #29
fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

> it doesn't show non-ASCI symbols in window titles in dom0: Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.

There have been many exploits related to Unicode text rendering.

Re: ‘Zero-click’ hacks are growing in popularity

#34

Post by antihero »

formerly_proven wrote: post #27
bilbo0s wrote: post #10

Earlier quoted context omitted.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.

Is there a way to rescind said permissions?

Re: ‘Zero-click’ hacks are growing in popularity

#35

Post by malka »

littlestymaar wrote: post #14
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

You're missing the point. Humans cannot write bug-free software[1]. Then if you're soft has security-related things to do (like credential management etc.) you cannot be sure there won't be a way to bypass it. But here we're talking almost exclusively about remote execution bugs coming from memory-safety issues , which are indeed preventable. Any managed language does the trick, and if they are not fast enough for yo…

How are you sure there is no bug being unfound in rust itself ?

Re: ‘Zero-click’ hacks are growing in popularity

#36

Post by bouke »

fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.

Re: ‘Zero-click’ hacks are growing in popularity

#37

Post by roca »

malka wrote: post #35
littlestymaar wrote: post #14

Earlier quoted context omitted.

You're missing the point. Humans cannot write bug-free software[1]. Then if you're soft has security-related things to do (like credential management etc.) you cannot be sure there won't be a way to bypass it. But here we're talking almost exclusively about remote execution bugs coming from memory-safety issues , which are indeed preventable. Any managed language does the trick, and if they are not fast enough for yo…

How are you sure there is no bug being unfound in rust itself ?

We don't need to be sure of that. We already have ample evidence that code written in Rust has far fewer vulnerabilities than, say, code written in C.

Re: ‘Zero-click’ hacks are growing in popularity

#38

Post by bilbo0s »

simion314 wrote: post #21
bilbo0s wrote: post #10

Earlier quoted context omitted.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before R…

Respectfully, an enormous amount of work has gone into making sure things like Python, .NET, and Rust are secure. And the security researchers still regularly find bugs and sell 0-days. That's not even counting the work that's gone into the gold standard that is the JVM. Any serious minded security expert could tell you that guaranteeing security on any of these platforms is a sysiphean effort. Your platform is state of the art with respect to security, until it is not.

The essential problem is features. Devs want features. So Python, .NET, etc, and even the browsers try to provide access to those features. But some of those features are simply inherently unsafe. Someone will find a way to compromise this feature or that. How does one provide 100% safe access to the GPU? The file system? And so on. It's not really possible. At some point, the app level dev will have to keep a security mindset when writing his code. Don't do things on the GPU that compromise the system. But that has to be on the app developer if that developer is demanding that the browsers give him/her access to the GPU.

I don't know if I'm being clear? But I hope you can see what I'm trying to say.

Re: ‘Zero-click’ hacks are growing in popularity

#39

Post by gfd »

Why aren't these used to steal cryptocurrencies? According to the article you can buy a similar exploit for just $1-2.5 million. Considering the amount of money floating around that space, that it hasn't happened yet is surprising to me (or maybe I just don't pay attention to people who own crypto and are public about it, maybe they do get hit by zero-days all the time?).

Re: ‘Zero-click’ hacks are growing in popularity

#40

Post by roca »

b112 wrote: post #28
littlestymaar wrote: post #14

Earlier quoted context omitted.

You're missing the point. Humans cannot write bug-free software[1]. Then if you're soft has security-related things to do (like credential management etc.) you cannot be sure there won't be a way to bypass it. But here we're talking almost exclusively about remote execution bugs coming from memory-safety issues , which are indeed preventable. Any managed language does the trick, and if they are not fast enough for yo…

There is no safe way to code anything, ever. (Yes people, and Apple should try, but...)

This absolutist statement is basically meaningless.

Taking Rust as an example (use Swift or even Java if that works better for your use-case), we know how to write Rust code that is guaranteed to be free from common classes of bugs that these zero-click attacks exploit.

Yes, we aren't going to get rid of all bugs, yes, zero-click attacks might still be possible once in a while, but we can make it much, much harder and more expensive, and therefore greatly reduce the set of people who have access to such attacks, and reduce their frequency.

Post reply on HN