Just use dumb phones. Maybe one old smartphone purely for business to minimize personal information leak.
Dumb phones still had Bluetooth https://en.wikipedia.org/wiki/Bluebugging
‘Zero-click’ hacks are growing in popularity
161–170 of 408 posts
Re: ‘Zero-click’ hacks are growing in popularity
#162Earlier quoted context omitted.
As if rewriting entire OS components is easy or viable for vendors, even big ones like Apple or Microsoft. Also backwards compatibility is a feature many wouldn't give away for extra security, at least not now.
Nobody said it would be easy, but it is already happening. https://medium.com/@tinocaer/how-microsoft-is-adopting-rust-... https://preettheman.medium.com/this-is-what-apple-uses-rust-...
Did you even read what you linked? I wouldn't say "already happening" more like first early steps. Operating systems have a massive attack surface, would take years to convert code from C\C++ to Rust and likely be more vulnerable initially(the old code base went through decades of scrutiny, hundreds of scanners\fuzzers etc)
Re: ‘Zero-click’ hacks are growing in popularity
#163Re: ‘Zero-click’ hacks are growing in popularity
#164Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
As if rewriting entire OS components is easy or viable for vendors, even big ones like Apple or Microsoft. Also backwards compatibility is a feature many wouldn't give away for extra security, at least not now.
My view is that it should be state mandated for products with over 1 million users.
In the long run it would pay for itself with the money that no longer has to be spent on mitigating cyber security problems.
Cyber security is national security is the people’s security. Ever since my aunt was doxxed and had her online banking money stolen I’ve become a cyber security hardliner.
Re: ‘Zero-click’ hacks are growing in popularity
#165Earlier quoted context omitted.
Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.
I write Rust at $WORK. Using `unsafe` to meet a deadline makes 0 sense. It doesn't disable the borrow checker unless you're literally casting references through raw pointers to strip lifetimes, which is... insane and would never pass a code review. 99% of the time if you're fighting the borrow checker and just want a quick solution, that solution is `clone` or `Arc >`, not `unsafe`. Those solutions will sacrifice per…
My girlfriend uses Rust for embedded systems at a large and important company. Everyone uses memory safety.
Re: ‘Zero-click’ hacks are growing in popularity
#166Earlier quoted context omitted.
It sounds like you’re saying, you spent a lot of time focused on learning rust, so now you like to discuss its shortcomings as abrasively as you can for sport.
Upthread I’ve already surrendered. There are certain gangs you just don’t pick a fight with. I’m a slow learner in some ways but I get the message. Got it, learning Rust nuts and bolts only makes it worse to say anything skeptical about it.
Your argument seems to mostly boil down to "Rust isn't magic", which nobody is really arguing. It does help eliminate one class of really nasty bugs, which tend to repeatedly show up in a lot of massive security hacks, and which generally everyone would like to see eliminated. Therefore: use Rust.
Comparisons to other languages like Haskell don't really work, since they don't fit in the same space nor have the same goals as Rust or C.
Re: ‘Zero-click’ hacks are growing in popularity
#167Earlier quoted context omitted.
Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast…
That's a defeatist position. 99% of the problem is just wanting to not have to rewrite a hundred parsers in memory-safe languages. It's just economics and engineering. They don't have to change everyone's minds or fix the world. They'd need to invest a lot but so far nobody really thinks it's worth it.
People try to address that will simpler solutions that wouldn't break backwards compatibility or require a full re-write.
Isolation, mitigation and prevention of exploitation is common.
Re: ‘Zero-click’ hacks are growing in popularity
#168Earlier quoted context omitted.
Right, but a memory unsafety but is what takes a harmless logic bug in an image parser with no filesystem access to an RCE and sandbox escape. Memory unsafety allows you to change the 'category' of the bug, you become free to do whatever whereas a logic bug forces to to work within the (flawed) logic of the original program.
Not necessarily; see https://github.com/LinusHenze/Fugu14/blob/master/Writeup.pdf for example. It's a full chain that repeatedly escalates privileges without exploiting any memory safety bugs by tricking privileged subsystems into giving it more access than it should have, all the way up through and beyond kernel code execution.
That’s not a zero-click vulnerability though. I didn’t read the entire pdf but 2 of the first 4 steps involve active user participation and assistance (install exploit app 1 and exploit app 2).
I think regardless, you’re right, we will still have logic bugs… but that example is also an “exception proves the rule” kind of thing.
Re: ‘Zero-click’ hacks are growing in popularity
#169Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Nothing wrong with Rust, but I still think making operating systems with airtight sandboxing and proper permission enforcement is the only thing that can truly solve these issues.
Re: ‘Zero-click’ hacks are growing in popularity
#170Earlier quoted context omitted.
Upthread I’ve already surrendered. There are certain gangs you just don’t pick a fight with. I’m a slow learner in some ways but I get the message. Got it, learning Rust nuts and bolts only makes it worse to say anything skeptical about it.
Your argument seems to mostly boil down to "Rust isn't magic", which nobody is really arguing. It does help eliminate one class of really nasty bugs, which tend to repeatedly show up in a lot of massive security hacks, and which generally everyone would like to see eliminated. Therefore: use Rust. Comparisons to other languages like Haskell don't really work, since they don't fit in the same space nor have the same g…
Do I really need to do the search for comparisons to solar panels or cancer drugs, or does that sort of scan?