Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

381–390 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#381

Post by kobebrookskC3 »

b112 wrote: post #374
CorrectHorseBat wrote: post #316

Earlier quoted context omitted.

There does actually exist such a thing as formally proven code, which is mathematically according to spec. https://www.sel4.systems/Info/FAQ/proof.pml

I don't even see the point you are making. Are you trying to claim that the above proof will never be invaldated? You're really just proving mt point here. You think thongs can be secure.

what do you mean invalidated? the point of proofs is that they will be still be as true today as they will millenia into the future. pythagoras' theorem is just as true today as it was millenia ago.

Re: ‘Zero-click’ hacks are growing in popularity

#382

Post by chlorion »

Gigachad wrote: post #76
zuzun wrote: post #71

Earlier quoted context omitted.

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.

I think unsafe rust is a lot more awkward to work with and easier to cause UB with compared to c and especially c++. This is just my opinion though!

&mut aliasing is a good example of running into instant UB in unsafe rust, but there are many more that you have to be aware of.

I would check out the unsafe rust "book" for yourself and see what you think. There is a section where you implement Vec and some other data structures from scratch!

https://doc.rust-lang.org/nomicon/intro.html

Re: ‘Zero-click’ hacks are growing in popularity

#383

Post by bsder »

ReptileMan wrote: post #235
skybrian wrote: post #213

Earlier quoted context omitted.

Both attacks and defenses have gotten a lot better. Meanwhile, the consequences of hacks keep going up every year. You didn't have viruses disrupting shipping or gas pipelines before, because they didn't depend as much on computers.

You have to be a special kind of naive to not have such infrastructure behind airgap.

You cannot assume "airgap" for any reason--that will eventually fail.

Systems need to work assuming that they are bathed in a hostile environment at all times.

Re: ‘Zero-click’ hacks are growing in popularity

#384

Post by [deleted] »

staticassertion wrote: post #353
emerongi wrote: post #258

Earlier quoted context omitted.

I think the only question that matters is how much longer it takes to write a moderately-sized program in Rust vs C. If it takes around the same time, then an average C programmer will probably write code with more bugs than an average Rust programmer. If it takes longer in Rust, the Rust programmer could start taking some seriously unholy shortcuts to meet a deadline, therefore the result could be worse. All code ca…

That assumes that writing unsafe code would make you go faster. It wouldn't. In general if you want to write code in Rust more quickly you don't use unsafe, which really wouldn't help much, but you copy your data. ".clone()" is basically the "I'll trade performance for productivity" lever, not unsafe.

[deleted]

Re: ‘Zero-click’ hacks are growing in popularity

#385

Post by thelittleone »

gmadsen wrote: post #365
thelittleone wrote: post #347

Earlier quoted context omitted.

I disagree. I think governments prioritise spending, jobs and votes over "better results".

so you agree with the comment then? you are both criticizing the government

I wrote "governments"... plural. And while both comments are critical of "governments", my comment clearly disagrees with the parent's assertion that governments do not fund whole rewrite projects "Mostly because it's not clear that from-scratch rewrites produce better results".

Re: ‘Zero-click’ hacks are growing in popularity

#386

Post by staticassertion »

rosndo wrote: post #377
staticassertion wrote: post #366

Earlier quoted context omitted.

There are definitely significant economic changes - the turnaround time for discovery, patch, rollout is way tighter. I suppose that could make a generalized kit much harder to sell. Once it's sold once you basically have to assume it'll be burned soon. Time will tell.

Only way we’re going to see another exploit pack like blackhole is if it’s targeting Android devices which aren’t receiving security updates.

Or there's more vertical integration in exploit packs ie: they pair it with some sort of post exploitation payload that's better at hiding. Or something else we haven't thought of.

Re: ‘Zero-click’ hacks are growing in popularity

#387

Post by simion314 »

giantrobot wrote: post #348
simion314 wrote: post #136

Earlier quoted context omitted.

I would not make it illegal for cool devs to invent their own language or libraries. I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing, you could rewrite your own in CoolLang using QunatumReactiveAntiFunctionalPatterns. It is your choice if you use a proven correct zip library or you use a different one written by some stranger in a weekend In CoolLang. Somet…

> I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing Wanting those things is fine but delivering those things is extremely difficult. JSON/XML/Zip have so many weird edge cases it's maybe impossible to write parsers that are complete to the spec yet also truly secure. XML and Zip bombs aren't explicit features of either format but they're side effects of not b…

I mean a good parser should be correct. We can have different implementation, say if you work with trusted data and you know that your json/html/xml has a specific form you can create a correct parser that handles this subset and is faster then the generic complete one.

We probably need to create better specifications, probably using a log/math language that can verify the specifications are valid and clear. It will be hard since people will need to learn to be more clear but it might also simplify things , say we would have a simple replacement for html and css if the guys creating it would have to do it in such a language.

The giants use json right, so they could put some money together find some experts to write a specification, if json is flawed they can write a new version of it that is correct, then when specification is coded they can release it, and after that this giants can pay some developers to implement it and prove the implementation correctness.

They should repeat it for one image format, they can chose what is a decent image format and do that, then do it for html, audio, video... it will save them money if less security issues happen on their servers or in their users devices. But it will save them money only if it would cost them when their devices get owned, this means we should stop apologizing this bugs with extreme fake stuff like "99.9% of applications have security issues"

Re: ‘Zero-click’ hacks are growing in popularity

#388

Post by tuwtuwtuwtuw »

e40 wrote: post #269
tuwtuwtuwtuw wrote: post #266

Earlier quoted context omitted.

Forcing their employees to learn rust doesn't mean Google has the capacity to rewrite all their software in rust. They have tons and tons of code which would need to be rewritten from scratch. Of course if they dropped all other development and told their employees to rewrite to rust, they may end up with a piece of software written in rust but no customers.

I agree, but there's so many people at Google (132,000 if you can believe the search results), it's hard for me to believe they couldn't devote a small percentage of them to moving to a secure stack.

Let's say 50 000 write code and a small percentage is 10%. So then your idea is that 45 000 would continue to write code in the unsafe languages and 5 000 would rewrite old and newly written code in rust? How many years do you think it would take for the 10% of developers to write all the old code and all the newly written by the 90%?

Re: ‘Zero-click’ hacks are growing in popularity

#389

Post by IceDane »

raesene9 wrote: post #198
rosndo wrote: post #148

Earlier quoted context omitted.

There is no meaningful distinction between the two. > Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone). Historically these have been referred to as RCE. FWIW You are essentially describing a service listening on the network. It’s silly to try t…

That's a view of the world for sure :) Personally I don't think it's irrelevant. From a threat modelling perspective, exposed services are expected to be attacked. Client services with zero interaction, have traditionally been regarded as safer, usually for client side attacks we'd expect a trigger from user action (e.g. a link being clicked, a PDF file being opened). Just because you don't find something to be usefu…

This is really flyfucking of the worst kind: the kind that doesn't serve any useful purpose.

From any useful perspective, RCE and zero-click exploits are the same thing. The latter is just a fancy name for the moron journalists like the one who wrote this article to bandy about to lure in some readers.

Re: ‘Zero-click’ hacks are growing in popularity

#390

Post by jhgb »

daniel-cussen wrote: post #111
can16358p wrote: post #83

Earlier quoted context omitted.

I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage. Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).

No, I would not blame the teams or their managers. You can't just blame a manager you've never met just because he's a manager, we're talking about the manager of Apple Music, they could very well be capable and well-minded, likely personally capable of coding. So let me give you another example in the same vein as C, where everybody uses a technology that is terrible, questioning it only at the outset, and then just…

> it was designed to slow down typing so typewriters wouldn't jam

I'm not quite sure that this is what actually happened: https://repository.kulib.kyoto-u.ac.jp/dspace/bitstream/2433...

Post reply on HN