Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

141–150 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#141

Post by fulafel »

lionkor wrote: post #102
benreesman wrote: post #70

Earlier quoted context omitted.

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

The flaw in the idea of "rewrite it in rust" is that, next to the memory issues, the biggest issues are logic bugs. Rewriting something from scratch isnt going to magically not have bugs, and the legacy system likely has many edge cases covered that a modern new implementation will have to learn about first.

It's important to have good foundations (memory safety) because then it becomes much more attractive to spend effort on the rest of the correctness and security. If you want to build a sturdy house, and see how to make the roof well, don't give up on it just because you'll need to do something else for good doors and windows.

Re: ‘Zero-click’ hacks are growing in popularity

#142

Post by LasEspuelas »

benreesman wrote: post #79
Gigachad wrote: post #76

Earlier quoted context omitted.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.

What is "tight ANSI C"?

Re: ‘Zero-click’ hacks are growing in popularity

#143

Post by raesene9 »

rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

To me there's a difference between RCE and Zero click.

RCE occurs on a system with a listening daemon/service (e.g. web, SQL, DNS SSH).

Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).

Re: ‘Zero-click’ hacks are growing in popularity

#144

Post by user3939382 »

benreesman wrote: post #130
kibwen wrote: post #118

Earlier quoted context omitted.

But Rust isn't remotely a simplified version of Haskell, and I'm not sure where you got that impression. It's inspired by several languages, but is predominantly a descendant of ML and C++. The only similarity they have is that Rust traits resemble Haskell typeclasses, but even there they are quite different in semantics and implementation.

I like Rust in a lot of ways, I write a fuckload of it and I get value from doing so. Not “praise the lord” value, but real value. But the attitude is an invitation to getting made fun of. It’s absurdly intellectually dishonest when Rust-as-Religion people actively hassle anyone writing C and then get a little precious when anyone mentions Haskell and then extremely precious when they step on the landmine of the guy…

It sounds like you’re saying, you spent a lot of time focused on learning rust, so now you like to discuss its shortcomings as abrasively as you can for sport.

Re: ‘Zero-click’ hacks are growing in popularity

#145

Post by rosndo »

foxtrottbravo wrote: post #140
rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

I was about to ask whether I'm missing something here. "Zero Click" just means no user interaction is required right?So from my Perspektive this is just another way of saying Remote Code Execution? There really isn't something new here other than a fancy name - or I am not seeing the point.

That’s correct.

Re: ‘Zero-click’ hacks are growing in popularity

#146

Post by saagarjha »

xavxav wrote: post #108
lionkor wrote: post #102

Earlier quoted context omitted.

The flaw in the idea of "rewrite it in rust" is that, next to the memory issues, the biggest issues are logic bugs. Rewriting something from scratch isnt going to magically not have bugs, and the legacy system likely has many edge cases covered that a modern new implementation will have to learn about first.

Right, but a memory unsafety but is what takes a harmless logic bug in an image parser with no filesystem access to an RCE and sandbox escape. Memory unsafety allows you to change the 'category' of the bug, you become free to do whatever whereas a logic bug forces to to work within the (flawed) logic of the original program.

Not necessarily; see https://github.com/LinusHenze/Fugu14/blob/master/Writeup.pdf for example. It's a full chain that repeatedly escalates privileges without exploiting any memory safety bugs by tricking privileged subsystems into giving it more access than it should have, all the way up through and beyond kernel code execution.

Re: ‘Zero-click’ hacks are growing in popularity

#147

Post by saagarjha »

alophawen wrote: post #133
CyberRage wrote: post #116

Earlier quoted context omitted.

As if rewriting entire OS components is easy or viable for vendors, even big ones like Apple or Microsoft. Also backwards compatibility is a feature many wouldn't give away for extra security, at least not now.

Nobody said it would be easy, but it is already happening. https://medium.com/@tinocaer/how-microsoft-is-adopting-rust-... https://preettheman.medium.com/this-is-what-apple-uses-rust-...

I don't think Apple is shipping anything customer facing that's built on Rust?

Re: ‘Zero-click’ hacks are growing in popularity

#148

Post by rosndo »

raesene9 wrote: post #143
rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

To me there's a difference between RCE and Zero click. RCE occurs on a system with a listening daemon/service (e.g. web, SQL, DNS SSH). Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).

There is no meaningful distinction between the two.

> Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).

Historically these have been referred to as RCE.

FWIW You are essentially describing a service listening on the network. It’s silly to try to make an artificial distinction based on some irrelevant L4 differences.

Re: ‘Zero-click’ hacks are growing in popularity

#149

Post by saagarjha »

daniel-cussen wrote: post #63
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Yeah, I started noticing huge flaws in Apple's Music app, which I told them about and work around mostly, but...are they because Apple software is written in C? C++, Objective-C, same thing. Like can C code ever really be airtight?

Bugs in Apple's Music apps have essentially nothing to do with it being written in C++ and Objective-C (and these days a significant portion of it is JavaScript and Swift).

Re: ‘Zero-click’ hacks are growing in popularity

#150

Post by benreesman »

xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

No post body was provided.
Post reply on HN