Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

341–350 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#341

Post by Dylan16807 »

pvg wrote: post #320
Dylan16807 wrote: post #301

Earlier quoted context omitted.

> a constantly evolving target That decreases the amount of code to replace, doesn't it?

How so? New not-in-safe-languages code is being added all the time.

For code added in the future, you need devs no matter what language they use, so switching their language is the easy part of this large hard project.

For code added in the past, more evolution means that for every X lines of code written, a smaller and smaller fraction of X still exists. Which means less work to replace the end product.

Re: ‘Zero-click’ hacks are growing in popularity

#342

Post by kevin_thibedeau »

bastawhiz wrote: post #254
fsflover wrote: post #20

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files . I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ .

If you have so little faith in your system that Unicode characters will lead to an exploit that you block them in window titles, your problem isn't Unicode, the problem is your code that processes and renders it. You still have a problem, you're just making it the user's burden to bear.

They should just force the use of bitmap fonts. Unicode isn't the enemy.

Re: ‘Zero-click’ hacks are growing in popularity

#343

Post by qualudeheart »

benreesman wrote: post #79
Gigachad wrote: post #76

Earlier quoted context omitted.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.

We could set up a prediction market for this. A study would be performed of attempts ti pentest randomly selected unsafe Rust and tight ANSI C programs. A prediction market used to estimate the probability of either language winning before publication of results. Someone needs to make this a thing.

Re: ‘Zero-click’ hacks are growing in popularity

#344

Post by radford-neal »

nickelpro wrote: post #327
radford-neal wrote: post #275

Earlier quoted context omitted.

From the linked ASAN paper: "...at the relatively low cost of 73% slowdown and 3.4x increased memory usage..." That's too big a performance hit for production use - much bigger than you would get with the approach I outlined. I don't agree that any nontrivial C program is nonconformant, at least if you're talking about nonconformance due to invalid memory references. Referencing invalid memory locations is not the so…

That's a low cost for detecting the memory unsafe behvior. It is not intended to run in production, it's intended to run with your test suite.

Yes, I know. But this thread is about detecting invalid memory references in production, to prevent security exploits. ASAN seems too slow to solve that problem.

Re: ‘Zero-click’ hacks are growing in popularity

#345

Post by qualudeheart »

obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

It’s a good long term investment. Just not viable in the short term. Too expensive.

Re: ‘Zero-click’ hacks are growing in popularity

#346

Post by kevin_thibedeau »

recuter wrote: post #196
markdown wrote: post #53

Earlier quoted context omitted.

Israel are arguably the worlds biggest beneficiary of the arms trade. Why would they have anything against selling weapons?

Only in your active imagination. In reality it is roughly in 8th place with 3% marketshare. https://www.weforum.org/agenda/2019/03/5-charts-that-reveal-...

That doesn't include the free weapons the US gives them with their annual stipend.

Re: ‘Zero-click’ hacks are growing in popularity

#347

Post by thelittleone »

Natsu wrote: post #287
obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

Mostly because it's not clear that from-scratch rewrites produce better results. They can if the entire architecture needs to be different, but for many libraries it just devolves into an exercise in bikeshedding. This is particularly true of the US government which, if you've seen their IT systems, is not going to be anyone sane's first choice for doing from-scratch rewrites.

I disagree. I think governments prioritise spending, jobs and votes over "better results".

Re: ‘Zero-click’ hacks are growing in popularity

#348

Post by giantrobot »

simion314 wrote: post #136
delusional wrote: post #73

Earlier quoted context omitted.

"If we could just have one more layer of abstraction, THEN we would be secure". You'll end up making a standard library so big that it will never be secure. And even more portantly, you'll strangle innovation by disallowing improvements to the standard library.

I would not make it illegal for cool devs to invent their own language or libraries. I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing, you could rewrite your own in CoolLang using QunatumReactiveAntiFunctionalPatterns. It is your choice if you use a proven correct zip library or you use a different one written by some stranger in a weekend In CoolLang. Somet…

> I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing

Wanting those things is fine but delivering those things is extremely difficult. JSON/XML/Zip have so many weird edge cases it's maybe impossible to write parsers that are complete to the spec yet also truly secure. XML and Zip bombs aren't explicit features of either format but they're side effects of not being explicitly forbidden.

You're also want "good" parsers without specifying in which dimension you want them to be "good". You can have a complete parser that's reasonably secure but then pay for that with CPU cycles and memory. You can have a small and fast parser that's likely incomplete or has exploitable holes.

Re: ‘Zero-click’ hacks are growing in popularity

#349

Post by abecedarius »

falsenapkin wrote: post #325
abecedarius wrote: post #225

Earlier quoted context omitted.

Does it solve this to set a different app as your default app for texts? (Hopefully a more secure app.)

I want to trust Apple more than a random 3rd party app in general but regardless I don't think you have an option for alternate SMS on iOS. Anyway the problem here, I think, is that you can somehow send an iMessage (not SMS?) via an account that is backed by an email address instead of a phone number. So even if texts/SMS could have an alternate app, iMessage would still be accepting messages from bad accounts.

"Apple does not allow other apps to replace the default SMS/messaging app." https://support.signal.org/hc/en-us/articles/360007321171-Ca...

Oops, I must've been remembering Android. Well, it's one way Apple could fix this unconscionably lasting security hole.

Re: ‘Zero-click’ hacks are growing in popularity

#350

Post by greiskul »

foxtrottbravo wrote: post #140
rosndo wrote: post #47

Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.

I was about to ask whether I'm missing something here. "Zero Click" just means no user interaction is required right?So from my Perspektive this is just another way of saying Remote Code Execution? There really isn't something new here other than a fancy name - or I am not seeing the point.

A non zero click remote code execution would be for example the attacker sends the victim a message, with a link or attachment, that if the victim interacts with it, the attacked gets to run code they wrote in the victims device.

A zero click remote code execution, would be for example where the attacker send a message, and their phone just processing the message on it's own is enough for the attacker to execute code on the victims device.

A non zero click vulnerability can be mitigated by being cautious. A zero click vulnerability cannot.

Post reply on HN