Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

291–300 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#291

Post by Natsu »

joshgachnang wrote: post #270
obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

Isn't Google (allegedly) already doing this with Fuchsia?

They've done their own version of a lot of things, but then have open sourced what they can to grow the base of people familiar with that tech who can make things with it.

I mean, on some level you can try to make your own custom TempleOS for everything, but that only gets you (possibly) reduced scrutiny and hiring issues simply because nobody knows how to use it. But if you're already a target, the reduced scrutiny is probably a bad thing since the good guys won't point out the bugs to get them fixed.

Re: ‘Zero-click’ hacks are growing in popularity

#292

Post by ghusbands »

xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Around 70% of security flaws are from memory unsafety (according to Google and Microsoft), which isn't "almost universally" but is still a significant percentage and worth attacking. But we'll still have a forest fire to fight afterwards from the other 30%.

Re: ‘Zero-click’ hacks are growing in popularity

#293

Post by roca »

xet7 wrote: post #137
roca wrote: post #37

Earlier quoted context omitted.

We don't need to be sure of that. We already have ample evidence that code written in Rust has far fewer vulnerabilities than, say, code written in C.

Quoting from https://forum.nim-lang.org/t/8879#58025 > Someone in the thread said he has 30 years experience in programming, and the only new lang which is really close to C in speed is Rust. He has a point. Both C and release-mode Rust have minimal runtimes. C gets there with undefined behavior. Rust gets there with a very, very robust language definition that allows the compiler to reject a lot of unsafe practices…

You can enable integer overflow checking in Rust release builds. Android does. I think that trend will continue and at some point even become the default.

Re: ‘Zero-click’ hacks are growing in popularity

#294

Post by radford-neal »

ghusbands wrote: post #289
radford-neal wrote: post #202

Earlier quoted context omitted.

Wouldn't it be a lot easier to just use a C compiler that produces memory-safe code? I'm sure someone else has already thought of this, but in case not... All you need to do is represent a pointer by three addresses - the actual pointer, a low bound, and a high bound. Then *p = 0 compiles to code that checks that the pointer is in bounds before storing zero there. I believe such a compiler would conform to the C stan…

That doesn't at all address use of pointers that have since become invalid (via free or function return, say).

Good point. There's also the problem of pointers to no-longer-existing local variables. (Though I think it's rare for people to take addresses of local variables in a context where the compiler can't determine that they won't be referenced after they no longer exist.)

Re: ‘Zero-click’ hacks are growing in popularity

#295

Post by dataangel »

phendrenad2 wrote: post #243
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

This is just incorrect. The beauty of Rust is even bad programmers end up writing memory safe code because the compiler enforces it. The ONLY rule an organization needs to enforce on their crappy programmers is not allowing use of unsafe. And there are already available tools for enforcing this in CI, including scanning dependencies.

Re: ‘Zero-click’ hacks are growing in popularity

#296

Post by Dinux »

joshgachnang wrote: post #270
obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

Isn't Google (allegedly) already doing this with Fuchsia?

Fuchsia isn't Unix afaik

Re: ‘Zero-click’ hacks are growing in popularity

#297

Post by rosndo »

f311a wrote: post #230
rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

Exactly, 10 years ago tens of millions users were using outdated Flash and Internet Explorer. Literally everyone could infect them using pretty old exploits. There were no autoupdates.

Yep, good luck finding an useful exploit pack on crime forums now. The days of blackhole & co are long past, those people hacked far more people than those discussed in this article ever will.

Re: ‘Zero-click’ hacks are growing in popularity

#298

Post by roca »

b112 wrote: post #173
roca wrote: post #40

Earlier quoted context omitted.

This absolutist statement is basically meaningless. Taking Rust as an example (use Swift or even Java if that works better for your use-case), we know how to write Rust code that is guaranteed to be free from common classes of bugs that these zero-click attacks exploit. Yes, we aren't going to get rid of all bugs, yes, zero-click attacks might still be possible once in a while, but we can make it much, much harder an…

we know how to write Rust code that is guaranteed to be free from common classes of bugs that these No we don't. You are trying to shift the sands, by saying "But.. this one thing we can do...", except even that isn't true. If we did, it wouldn't keep happening, year after year, decade after decade. But even with peer reviews, with people supposedly knowing how, well.. it just keeps happening. Do you think every occu…

In practice safe Rust code never causes use-after-free bugs, for example, and UAF bugs are large fraction of exploitable RCE bugs.

Safe Rust code could trigger a compiler bug that leads to use-after-free, or trigger a bug unsafe Rust code (i.e., code explicitly marked "unsafe") that leads to use-after-free; the latter are rare, and the former are even rarer. In practice I've been writing Rust code full time for six years and encountered the latter exactly once, and the former never. In either case the bug would not be in the safe code I wrote.

I'm certainly not claiming that humans can write bug-free code. The claim is that with the right languages you can, in practice, eliminate certain important classes of bugs.

Re: ‘Zero-click’ hacks are growing in popularity

#299

Post by toss1 »

ReptileMan wrote: post #235
skybrian wrote: post #213

Earlier quoted context omitted.

Both attacks and defenses have gotten a lot better. Meanwhile, the consequences of hacks keep going up every year. You didn't have viruses disrupting shipping or gas pipelines before, because they didn't depend as much on computers.

You have to be a special kind of naive to not have such infrastructure behind airgap.

Yup.

And yet in most organizations, airgapping is an alien concept. Even for machine tools that could kill someone.

Security vs convenience...

Re: ‘Zero-click’ hacks are growing in popularity

#300

Post by Dylan16807 »

tptacek wrote: post #279
Dylan16807 wrote: post #264

Earlier quoted context omitted.

They wrote it the first time, didn't they? C isn't special, and training isn't special.

It took decades.

So make the initial goal a portion. It's not like Apple is going to go away any time soon. The second best time to start is now.

And a lot of that was design work that still holds, and a lot of that was code that has been obsoleted.

Post reply on HN