‘Zero-click’ hacks are growing in popularity

Post by daniel-cussen » Sat, Feb 19, 2022, 6:00 PM UTC

daniel-cussen wrote: post #111

can16358p wrote: post #83

Earlier quoted context omitted.

I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage. Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).

No, I would not blame the teams or their managers. You can't just blame a manager you've never met just because he's a manager, we're talking about the manager of Apple Music, they could very well be capable and well-minded, likely personally capable of coding. So let me give you another example in the same vein as C, where everybody uses a technology that is terrible, questioning it only at the outset, and then just…

Post by vbphprubyjsgo » Sat, Feb 19, 2022, 6:05 PM UTC

b112 wrote: post #173

roca wrote: post #40

Earlier quoted context omitted.

This absolutist statement is basically meaningless. Taking Rust as an example (use Swift or even Java if that works better for your use-case), we know how to write Rust code that is guaranteed to be free from common classes of bugs that these zero-click attacks exploit. Yes, we aren't going to get rid of all bugs, yes, zero-click attacks might still be possible once in a while, but we can make it much, much harder an…

we know how to write Rust code that is guaranteed to be free from common classes of bugs that these No we don't. You are trying to shift the sands, by saying "But.. this one thing we can do...", except even that isn't true. If we did, it wouldn't keep happening, year after year, decade after decade. But even with peer reviews, with people supposedly knowing how, well.. it just keeps happening. Do you think every occu…

Post by ReptileMan » Sat, Feb 19, 2022, 6:07 PM UTC

skybrian wrote: post #213

rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

Both attacks and defenses have gotten a lot better. Meanwhile, the consequences of hacks keep going up every year. You didn't have viruses disrupting shipping or gas pipelines before, because they didn't depend as much on computers.

Post by tptacek » Sat, Feb 19, 2022, 6:09 PM UTC

raesene9 wrote: post #143

rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

To me there's a difference between RCE and Zero click. RCE occurs on a system with a listening daemon/service (e.g. web, SQL, DNS SSH). Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).

Post by tptacek » Sat, Feb 19, 2022, 6:12 PM UTC

pyman wrote: post #50

There are no laws in Israel preventing companies like NSO from building and selling zero-day and zero-click exploits? Without proper regulations the Israeli government is creating a sophisticated and dangerous platform for these kind of illegal attacks.