Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

81–90 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#81

Post by Gigachad »

d0mine wrote: post #68
sva_ wrote: post #8

Earlier quoted context omitted.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

It is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.

It doesn’t seem all that unrealistic. These companies buy and research every single bug they can get for iOS and eventually you have enough that you can glue them together in to full exploits. When you have enough funding, this stuff becomes realistic.

Re: ‘Zero-click’ hacks are growing in popularity

#82

Post by ugl »

sva_ wrote: post #8
stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

Terrifyingly smart folks there.

Re: ‘Zero-click’ hacks are growing in popularity

#83

Post by can16358p »

daniel-cussen wrote: post #63
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Yeah, I started noticing huge flaws in Apple's Music app, which I told them about and work around mostly, but...are they because Apple software is written in C? C++, Objective-C, same thing. Like can C code ever really be airtight?

I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage.

Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).

Re: ‘Zero-click’ hacks are growing in popularity

#84

Post by w1nk »

efdee wrote: post #65
caoilte wrote: post #57

Earlier quoted context omitted.

errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?

Maybe Code Red https://en.wikipedia.org/wiki/Code_Red_(computer_worm) >, Conficker https://en.wikipedia.org/wiki/Conficker > or Blaster https://en.wikipedia.org/wiki/Blaster_(computer_worm) >.

Also, don't forget https://en.wikipedia.org/wiki/Nimda ... all of these were a horror show to deal with on networks of the era..

Re: ‘Zero-click’ hacks are growing in popularity

#85

Post by foxfluff »

bawolff wrote: post #29
fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

> it doesn't show non-ASCI symbols in window titles in dom0: Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.

> Was there a zero day in the font renderer?

As far as I'm concerned, freetype is another spelling for CVE. There have been multiple high impact vulns. Though it usually seems to require crafted fonts, so I wouldn't be too concerned about window titles using system fonts. Web fonts on the other hand.. disable 'em.

Re: ‘Zero-click’ hacks are growing in popularity

#86

Post by phh »

aborsy wrote: post #59

We need a security focused phone. General purpose consumer phones are focused on features; security is not a top priority for the average person. What are the options now?

Not sure who is "we" here, but yes I agree, a general purpose customer phone can't be considered secure against state-level hackers, there MUST be tradeoffs.

As an example, I consider that a secure phone MUST have boot-time full disk encryption passphrase, which needs to be different from lockscreen. For obvious reasons (which is that the user will tend forget their password), you can't have this even as an option on general purpose phones.

That being said. GrapheneOS is IMO a pretty good option wrt security (like they chose to disable JIT, which impacts performance, but supposedly improve security), even though lately their focus is no longer security for business reasons.

Architecture-wise, the best smartphone are pinephones/Librem, because of separation of modem (which is in the case of state-actors, an actual danger), and you can force encryption of all communications (it's even possible to do VoLTE encryption CPU-side rather than modem-side), but I think at the moment their OS really lags behind Android when it comes to security.

Re: ‘Zero-click’ hacks are growing in popularity

#87

Post by benreesman »

caoilte wrote: post #57
rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

errr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?

A sibling has already linked it, but extra context: Robert Tappen Morris (aka ‘rtm’) is a legend, his dad is a Bell Labs legend, and along with Trevor he’s kind of the “silent partner” in the Viaweb -> YC -> $$$$$ miracle.

Guy’s a boss.

Re: ‘Zero-click’ hacks are growing in popularity

#88

Post by axiosgunnar »

benreesman wrote: post #70
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

> Haskell Lego Edition

Gatekeeping much?

Re: ‘Zero-click’ hacks are growing in popularity

#90

Post by 55555 »

sva_ wrote: post #8
stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

This is an impressive example, but is it really a common example? I think typical examples are much more mundane and possible only due to poorly written code and memory overflow exploits, etc, no?
Post reply on HN