Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

101–110 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#101

Post by xavxav »

benreesman wrote: post #70
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”.

Rust won't solve logic bugs but it can help bring up the foundations. So long as memory safety bugs are so pervasive we can't even properly reason on a theoretical level about logic bugs. The core theorem of any type system is "type safety" which states that a well-typed program never goes wrong (gets stuck, aka UB). Only then can you properly tackle correctness issues.

> Rust is cool because Haskell Lego Edition is better than no Haskell at all, and Rust is cool because now that it’s proven affine/linear typing can work, someone will probably get it right soon.

I don't understand the condescending remarks about "Haskell Lego Edition". I do agree that Rust has shown that substructural type systems work and are useful, and that they will be a 'theme' in the next batch of languages (or I can hope).

Re: ‘Zero-click’ hacks are growing in popularity

#102

Post by lionkor »

benreesman wrote: post #70
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

The flaw in the idea of "rewrite it in rust" is that, next to the memory issues, the biggest issues are logic bugs.

Rewriting something from scratch isnt going to magically not have bugs, and the legacy system likely has many edge cases covered that a modern new implementation will have to learn about first.

Re: ‘Zero-click’ hacks are growing in popularity

#103

Post by sva_ »

55555 wrote: post #90
sva_ wrote: post #8

Earlier quoted context omitted.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

This is an impressive example, but is it really a common example? I think typical examples are much more mundane and possible only due to poorly written code and memory overflow exploits, etc, no?

Difficult to say. I'd keep in mind that NSO Group is a private company, with limited funding and limited privileges. There are also government actors out there with secret services. Who knows what they have been up to recently.

Re: ‘Zero-click’ hacks are growing in popularity

#104

Post by orbital-decay »

oefrha wrote: post #55

What's the evidence that zero-click hacks are growing in popularity? TFA doesn't seem to provide any, and given that in the not so distant past, every other Windows PC was infested with viruses and/or trojans, it's hard to believe device security is on a downward trajectory.

Yeah, there was a time when installing Windows XP with an Ethernet cable plugged in was impossible, because the PC would get infected before even finishing the setup, and reboot.

Re: ‘Zero-click’ hacks are growing in popularity

#105

Post by brazzy »

w1nk wrote: post #84
efdee wrote: post #65

Earlier quoted context omitted.

Maybe Code Red https://en.wikipedia.org/wiki/Code_Red_(computer_worm) >, Conficker https://en.wikipedia.org/wiki/Conficker > or Blaster https://en.wikipedia.org/wiki/Blaster_(computer_worm) >.

Also, don't forget https://en.wikipedia.org/wiki/Nimda ... all of these were a horror show to deal with on networks of the era..

My favourite: https://en.wikipedia.org/wiki/SQL_Slammer - 376 bytes of malware, spread via spraying UDP packets at random IP addresses, infected basically every vulnerable system on the entire internet within 10 minutes.

Re: ‘Zero-click’ hacks are growing in popularity

#106

Post by sva_ »

d0mine wrote: post #68
sva_ wrote: post #8

Earlier quoted context omitted.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

It is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.

I'm not sure if you're being sarcastic, but for parallel construction they'd still need to find this exploit. Are you saying Google Project Zero is out there to hide the traces of backdoors?

Re: ‘Zero-click’ hacks are growing in popularity

#107

Post by Closi »

benreesman wrote: post #79
Gigachad wrote: post #76

Earlier quoted context omitted.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.

Why compare 'non-tight' Rust against 'tight' C?

Surely we should compare tight Rust (with some 'tight' unsafe sections) against tight C?

Re: ‘Zero-click’ hacks are growing in popularity

#108

Post by xavxav »

lionkor wrote: post #102
benreesman wrote: post #70

Earlier quoted context omitted.

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

The flaw in the idea of "rewrite it in rust" is that, next to the memory issues, the biggest issues are logic bugs. Rewriting something from scratch isnt going to magically not have bugs, and the legacy system likely has many edge cases covered that a modern new implementation will have to learn about first.

Right, but a memory unsafety but is what takes a harmless logic bug in an image parser with no filesystem access to an RCE and sandbox escape.

Memory unsafety allows you to change the 'category' of the bug, you become free to do whatever whereas a logic bug forces to to work within the (flawed) logic of the original program.

Re: ‘Zero-click’ hacks are growing in popularity

#109

Post by scoopertrooper »

Gigachad wrote: post #81
d0mine wrote: post #68

Earlier quoted context omitted.

It is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.

It doesn’t seem all that unrealistic. These companies buy and research every single bug they can get for iOS and eventually you have enough that you can glue them together in to full exploits. When you have enough funding, this stuff becomes realistic.

Never underestimate the extremes computer science types will go to in order to prove a point.

Re: ‘Zero-click’ hacks are growing in popularity

#110

Post by benreesman »

Closi wrote: post #107
benreesman wrote: post #79

Earlier quoted context omitted.

I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.

Why compare 'non-tight' Rust against 'tight' C? Surely we should compare tight Rust (with some 'tight' unsafe sections) against tight C?

I must be more tired than I thought if I said “non-tight Rust” and forgot ten minutes later.

I just think if mistakes need to be literally low as possible you’ve got a better bet than Rust unsafe.

The language spec is smaller, the static analyzers have been getting tuned for decades, and the project leaders arent kinda hostile to people using it in the first place.

Post reply on HN