Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

71–80 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#71

Post by zuzun »

xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

Re: ‘Zero-click’ hacks are growing in popularity

#72

Post by bilbo0s »

formerly_proven wrote: post #27
bilbo0s wrote: post #10

Earlier quoted context omitted.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.

Again, from the perspective of a cyber security expert, all that is great!

Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there.

Here's the thing though, it's not.

That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to the app devs have to adopt a security mindset.

Users should not download that free app that lets you see what you would look like as your favorite French pastry. They should not click on the link in that sms they got from that strange phone number. They should be careful about giving out their phone number. Give everyone your gmail google phone number instead and let them send texts to that. Then check those texts on your gmail google phone if you're a high profile target. (Or even just a guy/gal who has a few people out there who really don't like them.) Keep a buffer between the world and your phone. Etc etc etc.

Devs want access to the file system. Awesome, but they'd better make sure in using that filesystem they are not inadvertently allowing users to take any actions deleterious to the system. Devs want access to the GPU. Again, no problem. But you'd better know how to write secure GPU code. There is no way a browser, or .NET, or Python or an OS can provide you access to a GPU "safely". If they give you the gun, they expect you will use it responsibly.

Browsers and other platform providers should also act responsibly. I understand developers want features. At the same time, is it responsible to hand out access to these features without some kind of plan to keep irresponsible devs from compromising security at scale? Sometimes there just is no way to do that, and I understand. (Access to the GPU is an example. Devs just have to know what they're doing.) But sometimes it is possible to do things in a more secure fashion, or to just wait on delivering that feature altogether.

Point is, for a secure environment, everyone has to play their part. There are so many of these 0-clicks and 0-days out there in the wild. Everyone wants to make a better environment. Well, I'm not seeing how that happens without getting everyone's cooperation. Or, at a minimum, getting everyone to be a bit more careful with their behaviors.

Re: ‘Zero-click’ hacks are growing in popularity

#73

Post by delusional »

simion314 wrote: post #21
bilbo0s wrote: post #10

Earlier quoted context omitted.

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…

>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before R…

"If we could just have one more layer of abstraction, THEN we would be secure".

You'll end up making a standard library so big that it will never be secure. And even more portantly, you'll strangle innovation by disallowing improvements to the standard library.

Re: ‘Zero-click’ hacks are growing in popularity

#74

Post by bregma »

Grimburger wrote: post #12
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

> safe code is impossible > Humans cannot write safe software. Ever. No matter what. Formally proven code does what it says on the box? Do we have different definitions of safe perhaps?

You could formally prove Unicode renderers are 100% correct. It's because they are 100% correct that they can be relied on to be exploited.

The weak spot when it comes to security is not the hardware or the software, it's the human mind.

Re: ‘Zero-click’ hacks are growing in popularity

#75

Post by sva_ »

pyman wrote: post #50

There are no laws in Israel preventing companies like NSO from building and selling zero-day and zero-click exploits? Without proper regulations the Israeli government is creating a sophisticated and dangerous platform for these kind of illegal attacks.

I don't think NSO is building & selling exploits. They're buying and renting them out. Exploit-as-a-service.

Re: ‘Zero-click’ hacks are growing in popularity

#76

Post by Gigachad »

zuzun wrote: post #71
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

Re: ‘Zero-click’ hacks are growing in popularity

#77

Post by simion314 »

bilbo0s wrote: post #38
simion314 wrote: post #21

Earlier quoted context omitted.

>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before R…

Respectfully, an enormous amount of work has gone into making sure things like Python, .NET, and Rust are secure. And the security researchers still regularly find bugs and sell 0-days. That's not even counting the work that's gone into the gold standard that is the JVM. Any serious minded security expert could tell you that guaranteeing security on any of these platforms is a sysiphean effort. Your platform is state…

You are using big words like "Impossible" such big word would need a proof. There are languages that can produce programs proven to be correct as per the specifications. We don't have such programs because we prefer moving fast, breaking things, having fun while coding, making money etc.

Do you have a proof that it is impossible to have a secure calculator application?

About .Net and Python, they are using a lot of wrappers around old unsafe code, so we would need to put more work and eliminate that, MS failed because of their shity Windows first ideals and their FUD,

Re: ‘Zero-click’ hacks are growing in popularity

#78

Post by mbarbar »

secondaryacct wrote: post #69
bouke wrote: post #36

Earlier quoted context omitted.

Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.

In window titles, that s fine. I like my French accents too but I can give them up for the hypervisor communication...

More than accents are non-Latin scripts.

Re: ‘Zero-click’ hacks are growing in popularity

#79

Post by benreesman »

Gigachad wrote: post #76
zuzun wrote: post #71

Earlier quoted context omitted.

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.

Re: ‘Zero-click’ hacks are growing in popularity

#80

Post by xorcist »

b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

Well designed software with attack surface within the bounds of human understanding does not have these problems.

OpenSSH has been exposed to the public Internet for over two decades, with nothing resembling this type of security problem. OpenSSH runs the protocol parser without permissions on the local filesystem, yet Apple thinks an ancient tiff library with scripting abilitites can be run with full permissions. Of course there is a discussion of financial incentives and customer expectations to be had here.

URL previews are an anti feature for a many users. We could not care less. But it gets shoved upon users by product feature teams for whom a continous stream of new features are their reason for being. That's how we develop commercial software, but that's not the only way.

Post reply on HN