‘Zero-click’ hacks are growing in popularity • Hacker News Board

Re: ‘Zero-click’ hacks are growing in popularity

#331

Post by normac2 » Sat, Feb 19, 2022, 9:18 PM UTC

dataangel wrote: post #295

phendrenad2 wrote: post #243

Earlier quoted context omitted.

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

This is just incorrect. The beauty of Rust is even bad programmers end up writing memory safe code because the compiler enforces it. The ONLY rule an organization needs to enforce on their crappy programmers is not allowing use of unsafe. And there are already available tools for enforcing this in CI, including scanning dependencies.

I think what they're saying is that by making devs use a less familiar language, you're going to end up with at least as many security bugs, just ones not related to memory safety. (Not weighing in either way, just clarifying.)

Re: ‘Zero-click’ hacks are growing in popularity

#332

Post by staticassertion » Sat, Feb 19, 2022, 9:26 PM UTC

assttoasstmgr wrote: post #326

phendrenad2 wrote: post #243

Earlier quoted context omitted.

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

I'm surprised no one has mentioned OpenBSD yet. Theo touches on this topic in this presentation: https://www.youtube.com/watch?v=fYgG0ds2_UQ&t=2200s Some follow-up commentary: https://marc.info/?l=openbsd-misc&m=151233345723889

Because it's not relevant.

1. In the video he's saying that you can't replace memory safety mitigation techniques like ASLR with memory safe languages. He notes that there will always be some unsafe code and that mitigation techniques are free, so you'll always want them.

No one should disagree with that. ASLR is effectively "free", and unsurprisingly all Rust code has ASLR support and rapidly adopts new mitigation techniques as well as other methods of finding memory unsafety.

2. The link about replacing gnu utils has nothing to do with memory safety. At all.

Even if it were related, it would simply be an argument from authority.

Re: ‘Zero-click’ hacks are growing in popularity

#333

Post by egberts1 » Sat, Feb 19, 2022, 9:28 PM UTC

saagarjha wrote: post #157

egberts1 wrote: post #26

Earlier quoted context omitted.

Apparently, formal proof of algorithms being safe and sound has been repeatedly demonstrated, just not so toward Apple’s closed (proprietary) software specifically their large 14-format image decoders running outside a sandbox.

Apple sandboxes their image decoder.

NOW they do. it is STILL a large attack area.

Re: ‘Zero-click’ hacks are growing in popularity

#334

Post by staticassertion » Sat, Feb 19, 2022, 9:31 PM UTC

benreesman wrote: post #112

xavxav wrote: post #101

Earlier quoted context omitted.

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust won't solve logic bugs but it can help bring up the foundations . So long as memory safety bugs are so pervasive we can't even properly reason on…

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

lol if "shit still gets rocked" means "programs exit safely but unexpectedly sometimes" we're on very different pages

I'm searching your posts in this topic trying to find something of value and coming up short. You assert that you know rust, and therefor your opinions have merit, but... lots of people know rust and disagree. But somehow your opinions are More Right and the others are just religious Rust shills.

I don't think you know what you're talking about honestly. If you want to pick fights on HN that's cool, we all get that urge, but you're really bad at it.

Re: ‘Zero-click’ hacks are growing in popularity

#335

Post by dang » Sat, Feb 19, 2022, 9:32 PM UTC

Recent and related:

A Saudi woman's iPhone revealed hacking around the world - https://news.ycombinator.com/item?id=30393530 - Feb 2022 (158 comments)

Before that:

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution - https://news.ycombinator.com/item?id=29568625 - Dec 2021 (341 comments)

Re: ‘Zero-click’ hacks are growing in popularity

#336

Post by chromanoid » Sat, Feb 19, 2022, 9:33 PM UTC

tester756 wrote: post #214

chromanoid wrote: post #210

Earlier quoted context omitted.

While I think garbage collected languages produce programs that are more safe, I also think they are often enablers for new classes of security issues. For example ysoserial, log4j etc.

(This is genuine question) Is log4j's bug actually unique to Java/C#/gc-based languages?

No, it's not unique. But a GC strengthens, like dynamic typing, your ability to develop more dynamically and together with reflection or duck typing to write code that can deal with to some extent unknown input more easily. You can pass arbitrary objects (also graphs of objects) around very generously. Ysoserial is based more or less on this idea. Passing arbitrary objects around was deemed so useful, that it is also supported by java's serialization mechanism and thus could be exploited. Log4shell exploits similar mechanisms that would be a hell to implement in non-gc languages.

Re: ‘Zero-click’ hacks are growing in popularity

#337

Post by contravariant » Sat, Feb 19, 2022, 9:37 PM UTC

mrtksn wrote: post #313

obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

Remember when Apple replaced mDNSResponder with Discoveryd? It was total disaster, %95 CPU usage and all kind of connectivity issues. They had to bring back mDNSResponder not long after. So there's no guarantee that the replacements would be bug-free. If anything, the current stuff is battle tested through the years and gets better with each scar. I would guess that they are also employing all kind of hacks, i.e thin…

Re: ‘Zero-click’ hacks are growing in popularity

#338

Post by staticassertion » Sat, Feb 19, 2022, 9:42 PM UTC

rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

Yes, Chrome pretty much single-handedly changed that, timed well with Vista. For about a decade we got a reprieve because:

1. Memory safety mitigations became much more common (Vista)

2. Browsers adopted sandboxing (thanks IE/Chrome)

3. Unsandboxed browser-reachable software like Flash and Java was moved into a sandbox and behind "Click to Play" before eventually being removed entirely.

4. Auto-updates became the norm for browsers.

And that genuinely bought us about a decade. The reason things are changing is because attackers have caught back up. Browser exploitation is back. Sandboxing is amazing and drove up the cost, but it is not enough - given enough vulnerabilities any sandbox falls.

So it's not that security is getting worse, it's that security got better really really quickly, we basically faffed around for a decade more or less making small, incremental wins, and attackers figured out techniques for getting around our barriers.

If we want another big win, it's obvious. Sandboxing and memory safety have to be paired together. Anything else will be an expensive waste of time.

Re: ‘Zero-click’ hacks are growing in popularity

#339

Post by staticassertion » Sat, Feb 19, 2022, 9:46 PM UTC

oefrha wrote: post #55

What's the evidence that zero-click hacks are growing in popularity? TFA doesn't seem to provide any, and given that in the not so distant past, every other Windows PC was infested with viruses and/or trojans, it's hard to believe device security is on a downward trajectory.

You can just count ITW exploits against Chrome, for example, to see that they're increasing over the last 3 years. I assume the same is true for some other software.

Re: ‘Zero-click’ hacks are growing in popularity

#340

Post by staticassertion » Sat, Feb 19, 2022, 9:48 PM UTC

aborsy wrote: post #59

We need a security focused phone. General purpose consumer phones are focused on features; security is not a top priority for the average person. What are the options now?

I would imagine https://grapheneos.org/ is the state of the art.