A Saudi woman's iPhone revealed hacking around the world • Hacker News Board

Re: A Saudi woman's iPhone revealed hacking around the world

#181

Post by choko » Sun, Feb 20, 2022, 7:52 PM UTC

alasdair_ wrote: post #173

PoignardAzur wrote: post #121

Earlier quoted context omitted.

> There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process. Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off). Chromium distributes its logic over multiple processes per tab, so that even if you eg find a zero-day in V8, you still can't use it…

> Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off). There is a certain irony in the idea that people should rely on a Google product to avoid having their privacy compromised.

I guess with Google, at least you know and give consent to the privacy "invasion" when you use their products.

Re: A Saudi woman's iPhone revealed hacking around the world

#182

Post by snnn » Sun, Feb 20, 2022, 8:27 PM UTC

Const-me wrote: post #177

snnn wrote: post #165

Earlier quoted context omitted.

I think the most critical part in the flow is the integer overflow bug, and it is totally avoidable. I am a software engine at Microsoft. Half of my time was spent on security and compliance. We have the right tool, right policy to avoid such things happen. However, I'm not saying Microsoft software is free of integer overflow bugs. I don't intend to advertise Microsoft C/C++ development tools here, but they are the…

Why aren’t you using higher-level memory safe languages for that? In C#, the runtime checks for integer overflow can be enabled with a single compiler switch. The switch is not set by default for some reason, but easy enough to enable manually, a single line in *.csproj file. If you think GC performance is not good enough, see that proof of concept: https://github.com/Const-me/Vrmac/tree/master/VrmacVideo/Con... That…

I'd prefer to catch such errors at compile-time. More static the language is, more optimization/analysis can be made. Sometimes the problem can be simplified when your CPU is 64-bit capable but you limit array sizes to 2GB, then you can use 64-bit math to calculate memory sizes to avoid integer overflow. Java and Google protobuf are two such examples. Sometimes the 2GB limit is acceptable, sometimes it is not. You know protobuf even tries to limit string size to tens of MB for safety? The simplification can not be accepted as a general solution.

Back to your Raspberry Pi 4 example: The CPU is 64-bit, but most users only use 32-bit OS with it. Today most Linux installations are 64-bit. I believe Google doesn't care much on protobuf's security on 32-bit systems. So does the other OSS software. So if you take it seriously, it works but it is not safe(when we are talking integer overflow).

Re: A Saudi woman's iPhone revealed hacking around the world

#183

Post by Const-me » Sun, Feb 20, 2022, 10:08 PM UTC

snnn wrote: post #182

Const-me wrote: post #177

Earlier quoted context omitted.

Why aren’t you using higher-level memory safe languages for that? In C#, the runtime checks for integer overflow can be enabled with a single compiler switch. The switch is not set by default for some reason, but easy enough to enable manually, a single line in *.csproj file. If you think GC performance is not good enough, see that proof of concept: https://github.com/Const-me/Vrmac/tree/master/VrmacVideo/Con... That…

I'd prefer to catch such errors at compile-time. More static the language is, more optimization/analysis can be made. Sometimes the problem can be simplified when your CPU is 64-bit capable but you limit array sizes to 2GB, then you can use 64-bit math to calculate memory sizes to avoid integer overflow. Java and Google protobuf are two such examples. Sometimes the 2GB limit is acceptable, sometimes it is not. You kn…

> I'd prefer to catch such errors at compile-time.

I don't believe it's possible. These integers often coming from user's input, disk, or network. Compiler can't validate these simply because it doesn't have the data.

Even when possible, it's insanely complicated, and computationally expensive, to catch in compile-time, yet very simple in runtime.

Runtime performance overhead is very small because branch prediction is quite efficient on modern CPUs, these branches are almost never taken, JIT compiler knows about that, and emits code which will be predicted correctly even when uncached.

> if you take it seriously, it works but it is not safe

Noy sure I follow. Let's pretend I am taking it reasonably seriously, despite old and unpaid hobby project.

Why it's not safe? The Mpeg4 and MKV parsers are written in C#, and compiled with that option set to True.

Re: A Saudi woman's iPhone revealed hacking around the world

#184

Post by alasdair_ » Sun, Feb 20, 2022, 11:50 PM UTC

choko wrote: post #181

alasdair_ wrote: post #173

Earlier quoted context omitted.

> Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off). There is a certain irony in the idea that people should rely on a Google product to avoid having their privacy compromised.

I guess with Google, at least you know and give consent to the privacy "invasion" when you use their products.

> I guess with Google, at least you know and give consent to the privacy "invasion" when you use their products.

Google tracks you and adds things to your profile when you explicitly choose incognito mode to avoid the privacy invasion. This doesn't seem like informed consent to me.