Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

91–100 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#91

Post by benreesman »

axiosgunnar wrote: post #88
benreesman wrote: post #70

Earlier quoted context omitted.

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

> Haskell Lego Edition Gatekeeping much?

I took the time to learn Rust well in spite of how annoying the Jehovas Witness routine has been for like, what, 5-10 years now? I worked with Carl and Yehuda both on the project right before Cargo (which is pretty solid, those guys don’t fuck around).

I think I’ve paid my cover-fee on an opinion.

Re: ‘Zero-click’ hacks are growing in popularity

#92

Post by upofadown »

Hnrobert42 wrote: post #52

It seems one way to stop many of them would be to only access email using a web client.

Text email. HTML email provides access to a vast attack surface on the user's device. Normally webmail clients will cheerfully send along all the HTML. Filtering is a futile game of whack a mole.

If you are only doing text email (or some very restricted HTML interpretation) then there is no extra risk in using a local email client. The lack of a HTML interpreter probably means you would be safer than with a webmail client.

If you are doing some form of email as a precaution, you still need a secure place to do it. That might not be a typical smart phone.

Re: ‘Zero-click’ hacks are growing in popularity

#93

Post by 55555 »

bawolff wrote: post #32
stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

URL preview is a pretty big attack surface, you have to fetch over network using complex protocols, parse the result for a variety of formats, and then render it.

Right. Showing an “image preview” for myriad file types means executing them, essentially, and perhaps on buggy code.

Re: ‘Zero-click’ hacks are growing in popularity

#94

Post by axiosgunnar »

d0mine wrote: post #68
sva_ wrote: post #8

Earlier quoted context omitted.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

It is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.

I believe this line of thought has not been given enough attention recently.

Re: ‘Zero-click’ hacks are growing in popularity

#95

Post by foxfluff »

anthk wrote: post #44

Rust won't be the miracle stopping this. Porting unveil/pledge to all OSes will.

There's no silver bullet. Pledge on a complex application that does too many things [requests too many permissions] doesn't help much.

IMO complexity and churn remain the biggest problems but people are not willing to engage it. There's always at least one legitimate use case for some faddy trendy new feature, always a reason for more complexity, fuck anyone who doesn't want it. And so you get a massive body of constantly changing code that auditors can't keep on top of.

What would it be like if your chat app was max 3000 lines of code and received no more than a handful of small patches per year since 2008? You could audit that in an evening or two and be reasonably confident in its security, and you could also be reasonably confident that it hasn't grown a bunch of new vulns in the next three releases, and you could quickly audit it again to be sure.

Alas, practically nobody takes you seriously if you advocate for simplicity. Usually it's the opposite; I tend to get attacked if I suggest that a program/system might be too complex.

Re: ‘Zero-click’ hacks are growing in popularity

#96

Post by benreesman »

benreesman wrote: post #91
axiosgunnar wrote: post #88

Earlier quoted context omitted.

> Haskell Lego Edition Gatekeeping much?

I took the time to learn Rust well in spite of how annoying the Jehovas Witness routine has been for like, what, 5-10 years now? I worked with Carl and Yehuda both on the project right before Cargo (which is pretty solid, those guys don’t fuck around). I think I’ve paid my cover-fee on an opinion.

Do you have a different opinion on whether or not syntax for a clumsy Maybe/Either Monad is a bit awkward? Do you think that trait-bound semantics are as clean as proper type classes as concerns trying to get some gas mileage out of ad-hoc polymorphism? Do you think that the Rust folks might have scored a three-pointer on beating the Haskell folks to PITA-but-useable affine types?

Or were you just dissing knowing things?

Re: ‘Zero-click’ hacks are growing in popularity

#97

Post by xavxav »

zuzun wrote: post #71
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

Rust is used in production though at large companies: Amazon, Microsoft, Mozilla, etc... I would be highly surprised that the borrowchecker would be the reason code couldn't ship in the first place, once you get over the initial mental hurdles it's usually a non-issue.

Besides equivocating between a pervasively unsafe-by-default language and one with an explicit bounded opt-in is a little disingenuous. Time after time, it has been shown that even expert C developers cannot write memory safe C consistently, each line of code is a chance to blow up your entire app's security.

Re: ‘Zero-click’ hacks are growing in popularity

#98

Post by [deleted] »

bouke wrote: post #36
fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.

[deleted]

Re: ‘Zero-click’ hacks are growing in popularity

#99

Post by Retr0id »

xorcist wrote: post #80
b112 wrote: post #5

Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…

Well designed software with attack surface within the bounds of human understanding does not have these problems. OpenSSH has been exposed to the public Internet for over two decades, with nothing resembling this type of security problem. OpenSSH runs the protocol parser without permissions on the local filesystem, yet Apple thinks an ancient tiff library with scripting abilitites can be run with full permissions. Of…

> Apple thinks an ancient tiff library with scripting abilitites can be run with full permissions.

It doesn't. That is just one step in a chain of exploits.

Post reply on HN