Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

111–120 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#111

Earlier quoted context omitted.

Yeah, I started noticing huge flaws in Apple's Music app, which I told them about and work around mostly, but...are they because Apple software is written in C? C++, Objective-C, same thing. Like can C code ever really be airtight?

I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage. Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).

No, I would not blame the teams or their managers. You can't just blame a manager you've never met just because he's a manager, we're talking about the manager of Apple Music, they could very well be capable and well-minded, likely personally capable of coding. So let me give you another example in the same vein as C, where everybody uses a technology that is terrible, questioning it only at the outset, and then just accepting it: keyboard layouts. QWERTY is obsolete. It wasn't designed at random, it would have aged better if it did, it was designed to slow down typing so typewriters wouldn't jam. And secondly, in order for salesmen to type "TYPEWRITER" with just the top row, so the poor woman he was selling didn't realize typewriters were masochistic. So that's how you end up with millions of people hunting and pecking, or getting stuck for months trying to learn touch typing for real with exercises like "sad fad dad." It takes weeks before you can type "the". It's just the network effects of keyboard layouts are just next-level. Peter Thiel talks about this in "Zero to One" as an example of a technology that is objectively inferior but is still widely used because it's so hard to switch, illustrating the power of network effects. I for one did switch, and it was hard because I couldn't type neither Qwerty nor Dvorak for a month. But after that Dvorak came easily, you don't need an app to learn to type, you just learn to type by typing, slowly at first, then very soon, very fast.

So with regard to C, I would say it is not objectively inferior like QWERTY became, it's actually pretty well designed. It does produce fast code. I use it myself sometimes, not a bad language for simple algorithm prototypes of under 60 lines. But it's based to a huge degree on characters, the difference between code that works and code that fails can come down to characters, C is about characters, pretty much any character, there's no margin of error. Whereas with Lisp, you have parentheses for everything, you have an interpreter but you can also compile it, I am actually able to trust Lisp in a way that is out of the question with C. There's just so incredibly many gotchas and pitfalls, buffer overflows, it's endless, you have to really know what you're doing if you want to do stunts with pointers, memory, void types.

I guess the bottom line is if you're want your code to be perfect, and you write it in C, you can't delegate to the language, you yourself have to code that code perfectly in the human capacity of perfection.

Re: ‘Zero-click’ hacks are growing in popularity

#112
post #101

Earlier quoted context omitted.

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust won't solve logic bugs but it can help bring up the foundations . So long as memory safety bugs are so pervasive we can't even properly reason on…

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

Re: ‘Zero-click’ hacks are growing in popularity

#113
post #71
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

Unsafe does not turn off the borrow checker

https://steveklabnik.com/writing/you-can-t-turn-off-the-borr...

Re: ‘Zero-click’ hacks are growing in popularity

#114
post #101

Earlier quoted context omitted.

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust won't solve logic bugs but it can help bring up the foundations . So long as memory safety bugs are so pervasive we can't even properly reason on…

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

And frankly I don’t see how it’s even remotely fair to call a no-nonsense statement that some things are simplified versions of other things with a cheeky metaphor “condescending”.

I could just as easily throw around words like “anti-intellectual” if my goal was to distract from the point rather substantially replying.

Re: ‘Zero-click’ hacks are growing in popularity

#115
post #101

Earlier quoted context omitted.

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust won't solve logic bugs but it can help bring up the foundations . So long as memory safety bugs are so pervasive we can't even properly reason on…

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

Panicking in Rust isn't a memory-unsafe operation.

Re: ‘Zero-click’ hacks are growing in popularity

#116
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

As if rewriting entire OS components is easy or viable for vendors, even big ones like Apple or Microsoft.

Also backwards compatibility is a feature many wouldn't give away for extra security, at least not now.

Re: ‘Zero-click’ hacks are growing in popularity

#117
post #43

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

Also segregates every app/workspace into a different vritualized system IIRC

Yes this is in fact the main feature :-) Though it's not exactly as you say it. VMs are a first-class entity. You can easily make as many as you want to represent different security domains. But it's not every app (unless you want it to be).

I didn't even notice the unicode thing. But it doesn't surprise me. They have various similar conservative features. For instance, by default an app in a VM cannot get full screen access. To full-screen a video in youtube you have to full-screen in app and then hit Alt-F11. The concern is that the app somehow tricks the user into thinking that they're interacting with the host OS desktop. Also the host OS doesn't have Internet access; update package files are downloaded by another VM and copied over.

It's fairly paranoid by design, and their tagline is "a reasonably secure operating system".

Re: ‘Zero-click’ hacks are growing in popularity

#118

Earlier quoted context omitted.

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

And frankly I don’t see how it’s even remotely fair to call a no-nonsense statement that some things are simplified versions of other things with a cheeky metaphor “condescending”. I could just as easily throw around words like “anti-intellectual” if my goal was to distract from the point rather substantially replying.

But Rust isn't remotely a simplified version of Haskell, and I'm not sure where you got that impression. It's inspired by several languages, but is predominantly a descendant of ML and C++. The only similarity they have is that Rust traits resemble Haskell typeclasses, but even there they are quite different in semantics and implementation.

Re: ‘Zero-click’ hacks are growing in popularity

#119
post #4

"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.

Yes but practically this isn't viable.

Nothing is impossible unless it disobeys the laws of physics(which are also limited to what we currently know)

It would be equivalent to saying, well it isn't economic enough for energy companies to simply create nuclear fusion reactors...

Some things are just extremely hard and there's no obvious answer even if you had "unlimited" funds.

Re: ‘Zero-click’ hacks are growing in popularity

#120
post #90
post #8

Earlier quoted context omitted.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

This is an impressive example, but is it really a common example? I think typical examples are much more mundane and possible only due to poorly written code and memory overflow exploits, etc, no?

definitely rare and highly targeted exploits.

Exploits for mobile phones in the "open market" are in the millions of dollars, for a single working exploit.

But the incentive is growing as these devices are becoming the center of our lives.

Post reply on HN