Earlier quoted context omitted.
There are software engineers who sometimes write code that’s not perfect.
So frustrated with the slow adoption/transition to memory-safe languages.
True. Perl exists for more than 30 years already.
‘Zero-click’ hacks are growing in popularity
61–70 of 408 posts
Re: ‘Zero-click’ hacks are growing in popularity
#62Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?
Re: ‘Zero-click’ hacks are growing in popularity
#63Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Yeah, I started noticing huge flaws in Apple's Music app, which I told them about and work around mostly, but...are they because Apple software is written in C? C++, Objective-C, same thing. Like can C code ever really be airtight?
Re: ‘Zero-click’ hacks are growing in popularity
#64Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?
I think they talk about worms that spread by infecting other devices in the local network using RCEs in net-services like rdp/smb/..
That or maybe drive-by downloads / java/activeX code execution, which have become more rare
Re: ‘Zero-click’ hacks are growing in popularity
#65Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?
Maybe Code Red https://en.wikipedia.org/wiki/Code_Red_(computer_worm)>, Conficker https://en.wikipedia.org/wiki/Conficker> or Blaster https://en.wikipedia.org/wiki/Blaster_(computer_worm)>.
Re: ‘Zero-click’ hacks are growing in popularity
#66"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.
Or perhaps one step further (albeit verging into conspiracy theory territory): they intentionally push ahead with known-flawed approaches, projects and engineering practices because it's profitable and there's generally a net benefit to them in being more-aware and more-in-control of the vulnerabilities within that ecosystem than anyone else could be.
(instead of taking the time to wait for research results, best practices, security reviews and privacy concerns up-front at design-time, and even -- shock -- perhaps deciding not to build some societally risky products in the first place)
Re: ‘Zero-click’ hacks are growing in popularity
#67Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?
Probably referencing this
https://en.wikipedia.org/wiki/Morris_worm
Re: ‘Zero-click’ hacks are growing in popularity
#68As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.
This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…
It is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.
Re: ‘Zero-click’ hacks are growing in popularity
#69Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .
Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.
In window titles, that s fine. I like my French accents too but I can give them up for the hypervisor communication...
Re: ‘Zero-click’ hacks are growing in popularity
#70Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”.
Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because Haskell Lego Edition is better than no Haskell at all, and Rust is cool because now that it’s proven affine/linear typing can work, someone will probably get it right soon.
But if I can buy shares in: “shit still gets rocked constantly”, I’d like to know where.