Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

261–270 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#261
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

There's something to be said for taking the entire class off vulnerability off of the table.

For instance, in the past I worked at a sort of active directory but in the cloud company. We identified parsers of user submitted profile pictures in login windows as a privilege escalation issue. We couldn't find memory safe parsers for some of these formats that we could run in all these contexts, and ended up writing a backend service that had memory safe parsers and would recompress the resulting pixel array.

Rust parsers at the time would have greatly simplified the workflow, and I'm not sure how we would have addressed the problem except as whack-a-mole at the time if there wasn't our central service in the middle (so MMS can't do that).

Re: ‘Zero-click’ hacks are growing in popularity

#262
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

It's worth engaging with the fact that essentially nobody disagrees with this (someone will here, but they don't matter), and that it's not happening not because Apple and Google don't want it to happen, but because it's incredibly, galactically hard to pull off. The Rust talent pool required to transition the entire attack surface of an iPhone from C, C++, and ObjC to Rust (substitute any other memory safe language,…

I honestly don't understand this. If Google or Apple wanted it to happen, they could force those developers to learn Rust. Are you saying the people that wrote the products in question can't learn Rust well enough to achieve the goal?

Re: ‘Zero-click’ hacks are growing in popularity

#263

Earlier quoted context omitted.

Well to some extent these companies are self sabotaging by centering interviews around algorithm problems, not only by selecting a certain kind if talent for further investment of resources, but also by signaling to the market the kinds of training needed to land a good job. If instead, the talent pool were incentivized to increase their ability to understand abstractions, and we selected for that kind of talent, it…

Abstractions are fun, security isn't. I doubt there are even that many programmers who enjoy writing (correct, safe) Rust.

Wait, this whole thread is about moving to languages that eliminate classes of security holes by virtue of the language itself. The premise is that being a security conscious programmer is not by itself enough to achieve good security.

Re: ‘Zero-click’ hacks are growing in popularity

#264
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

It's worth engaging with the fact that essentially nobody disagrees with this (someone will here, but they don't matter), and that it's not happening not because Apple and Google don't want it to happen, but because it's incredibly, galactically hard to pull off. The Rust talent pool required to transition the entire attack surface of an iPhone from C, C++, and ObjC to Rust (substitute any other memory safe language,…

They wrote it the first time, didn't they? C isn't special, and training isn't special.

Re: ‘Zero-click’ hacks are growing in popularity

#265

Earlier quoted context omitted.

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

I think the only question that matters is how much longer it takes to write a moderately-sized program in Rust vs C. If it takes around the same time, then an average C programmer will probably write code with more bugs than an average Rust programmer. If it takes longer in Rust, the Rust programmer could start taking some seriously unholy shortcuts to meet a deadline, therefore the result could be worse. All code ca…

This is part of the issue though:

Writing things in C correctly takes more time than in rust (once you get past the initial learning curve)

Writing things in C that appear to work may take less time.

I think we can be reasonably sure that Apple didn't introduce those image parsing bugs intentionally. But that means they thought it was correct.

Re: ‘Zero-click’ hacks are growing in popularity

#266
post #262

Earlier quoted context omitted.

It's worth engaging with the fact that essentially nobody disagrees with this (someone will here, but they don't matter), and that it's not happening not because Apple and Google don't want it to happen, but because it's incredibly, galactically hard to pull off. The Rust talent pool required to transition the entire attack surface of an iPhone from C, C++, and ObjC to Rust (substitute any other memory safe language,…

I honestly don't understand this. If Google or Apple wanted it to happen, they could force those developers to learn Rust. Are you saying the people that wrote the products in question can't learn Rust well enough to achieve the goal?

Forcing their employees to learn rust doesn't mean Google has the capacity to rewrite all their software in rust. They have tons and tons of code which would need to be rewritten from scratch.

Of course if they dropped all other development and told their employees to rewrite to rust, they may end up with a piece of software written in rust but no customers.

Re: ‘Zero-click’ hacks are growing in popularity

#267
Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities.

Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others.

Better yet, why wasn't "rebuild commonly used standard libraries" in the US Infrastructure bill last year? The government could pay programmers a lot, and pay whitehat pen-testers a lot (+ per bug discovered) and in a few years of iteration, we'd have incredibly hardened, durable software infrastructure that would benefit us for decades to come, in the public domain.

Re: ‘Zero-click’ hacks are growing in popularity

#268
post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

It's worth engaging with the fact that essentially nobody disagrees with this (someone will here, but they don't matter), and that it's not happening not because Apple and Google don't want it to happen, but because it's incredibly, galactically hard to pull off. The Rust talent pool required to transition the entire attack surface of an iPhone from C, C++, and ObjC to Rust (substitute any other memory safe language,…

In Apple's case they wouldn't need to move everything to Rust. Swift is a little bit higher level and a lot of stuff could be moved into it, with Rust as the lower level layer to replace ObjC / C / C++.

Still a gargantuan effort, but for them it doesn't require everyone learn Rust, just to learn Swift, which is kind of table stakes for a lot of user facing dev I'm sure there.

Re: ‘Zero-click’ hacks are growing in popularity

#269
post #262

Earlier quoted context omitted.

I honestly don't understand this. If Google or Apple wanted it to happen, they could force those developers to learn Rust. Are you saying the people that wrote the products in question can't learn Rust well enough to achieve the goal?

Forcing their employees to learn rust doesn't mean Google has the capacity to rewrite all their software in rust. They have tons and tons of code which would need to be rewritten from scratch. Of course if they dropped all other development and told their employees to rewrite to rust, they may end up with a piece of software written in rust but no customers.

I agree, but there's so many people at Google (132,000 if you can believe the search results), it's hard for me to believe they couldn't devote a small percentage of them to moving to a secure stack.

Re: ‘Zero-click’ hacks are growing in popularity

#270

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

Isn't Google (allegedly) already doing this with Fuchsia?
Post reply on HN