Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

371–380 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#371

Post by markdown »

recuter wrote: post #196
markdown wrote: post #53

Earlier quoted context omitted.

Israel are arguably the worlds biggest beneficiary of the arms trade. Why would they have anything against selling weapons?

Only in your active imagination. In reality it is roughly in 8th place with 3% marketshare. https://www.weforum.org/agenda/2019/03/5-charts-that-reveal-...

According to that link, it's #1 per capita. Add to this the enormous annual gifts from the US, and you'll find that I'm correct. Per capita, they're the biggest beneficiaries of the arms trade, and the worlds largest arms dealer.

I don't blame you for not seeing that though. The propaganda about Israel being in serious danger from stones and home made rockets is quite effective.

Re: ‘Zero-click’ hacks are growing in popularity

#372

Post by eternityforest »

phendrenad2 wrote: post #243
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

You don't know what you're asking for. In reality, you'll end up replacing C code with memory unsafely with Rust code written by people who understand Rust less than they understand C. The problem? The Rust Evangelism Strike Force always assumes that if you replace a C program with a Rust program, it'll be done by a top-tier expert Rust programmer. If that isn't the case (which it won't be), then the whole thing fall…

Rust doesn't need top tier programmers. It just needs competent programmers.

The C in use today wasn't written by experts either. And if it was, we can leave it alone for now, or at least until said experts get tired of maintaining it.

Re: ‘Zero-click’ hacks are growing in popularity

#373

Post by malwarebytess »

anon_123g987 wrote: post #175
NohatCoder wrote: post #169

Earlier quoted context omitted.

Nothing wrong with Rust, but I still think making operating systems with airtight sandboxing and proper permission enforcement is the only thing that can truly solve these issues.

And what language should we use to create such an OS? Maybe Rust?

May I humbly suggest Holy C?

https://www.youtube.com/watch?v=BUrbyfzm6i0

https://templeos.holyc.xyz/Wb/Doc/HolyC.html

Re: ‘Zero-click’ hacks are growing in popularity

#374

Post by b112 »

CorrectHorseBat wrote: post #316
b112 wrote: post #25

Earlier quoted context omitted.

You mean, when you look at your code, or someone else does, they think it's ok? I guess that's why security issues, even in massively peer reviewed code, are a thing of the past, right? Do your best, code as safely and securely as you know how, peer review and test and fuzz... Then when you deploy your code, treat it as vulnerable, because history days it likely is. Treat your phone as compromised. Anything network c…

There does actually exist such a thing as formally proven code, which is mathematically according to spec. https://www.sel4.systems/Info/FAQ/proof.pml

I don't even see the point you are making.

Are you trying to claim that the above proof will never be invaldated?

You're really just proving mt point here. You think thongs can be secure.

Re: ‘Zero-click’ hacks are growing in popularity

#375

Post by b112 »

roca wrote: post #298
b112 wrote: post #173

Earlier quoted context omitted.

we know how to write Rust code that is guaranteed to be free from common classes of bugs that these No we don't. You are trying to shift the sands, by saying "But.. this one thing we can do...", except even that isn't true. If we did, it wouldn't keep happening, year after year, decade after decade. But even with peer reviews, with people supposedly knowing how, well.. it just keeps happening. Do you think every occu…

In practice safe Rust code never causes use-after-free bugs, for example, and UAF bugs are large fraction of exploitable RCE bugs. Safe Rust code could trigger a compiler bug that leads to use-after-free, or trigger a bug unsafe Rust code (i.e., code explicitly marked "unsafe") that leads to use-after-free; the latter are rare, and the former are even rarer. In practice I've been writing Rust code full time for six y…

Can you now?

So there will be no human error? And rust will have zero compile time bugs, ever?

I'm not against improvement, but the absurd assumption that anything is safe. Because nothing is.

Re: ‘Zero-click’ hacks are growing in popularity

#376

Post by [deleted] »

obblekk wrote: post #267

Why don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libr…

[deleted]

Re: ‘Zero-click’ hacks are growing in popularity

#377

Post by rosndo »

staticassertion wrote: post #366
SCHiM wrote: post #364

Earlier quoted context omitted.

I think it's different for good now. Detection is better, response is better. The exploits used in blackhole would be patched really quickly, and detected really quickly. I think it would be detected quickly because the most likely payload dropped would be ransomware. which makes it immediately obvious to users they got owned. I don't think it would take longer than a day to discover a zero day exists in $BROWSER onc…

There are definitely significant economic changes - the turnaround time for discovery, patch, rollout is way tighter. I suppose that could make a generalized kit much harder to sell. Once it's sold once you basically have to assume it'll be burned soon. Time will tell.

Only way we’re going to see another exploit pack like blackhole is if it’s targeting Android devices which aren’t receiving security updates.

Re: ‘Zero-click’ hacks are growing in popularity

#378

Post by PeterisP »

Dinux wrote: post #296
joshgachnang wrote: post #270

Earlier quoted context omitted.

Isn't Google (allegedly) already doing this with Fuchsia?

Fuchsia isn't Unix afaik

IMHO that's kind of the point; to get a substantially different security posture, it's not sufficient to just rewrite the code but it's also necessary to change the design, and that would not be fully Unix anymore.

It would not be enough to provide new, more secure options; and not enough to make them the default - to actually reduce the attack surface, you'd want to remove the nonsecure options, if required, at the cost of compatibility.

Re: ‘Zero-click’ hacks are growing in popularity

#379

Post by bastawhiz »

fsflover wrote: post #324
bastawhiz wrote: post #254

Earlier quoted context omitted.

If you have so little faith in your system that Unicode characters will lead to an exploit that you block them in window titles, your problem isn't Unicode, the problem is your code that processes and renders it. You still have a problem, you're just making it the user's burden to bear.

You should not have faith in software. You should verify and isolate.

I very explicitly didn't say "software". You should be distrustful of software. If you can't trust the system you've created, you've used or created bad software and then failed to build necessary safeguards. The answer is not to restrict the user, it's to make more robust systems.

Re: ‘Zero-click’ hacks are growing in popularity

#380

Post by stonewareslord »

nonrandomstring wrote: post #194

> 'Zero-click' hacks A.K.A. 'Hacks' (as opposed to social engineering)

A one-click hack can still be a hack. Clicking a link should not be able to break out of a sandbox, run arbitrary code, etc and should still be considered a hack.

I think both should be considered hacks, but zero click is much scarier, so it makes sense to distinguish them

Post reply on HN