NSO group iPhone zero-click, zero-day exploit captured in the wild • Hacker News Board

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#71

Post by ketralnis » Thu, Sep 07, 2023, 9:13 PM UTC

NegativeK wrote: post #63

pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

If you show me software that's immune to advanced 0-days, I'll show you software that isn't usable.

That's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché.

We can and should improve development practises, mitigate vulnerabities (ASLR, WAFs, etc), isolate systems from each other, and model threats in a way that we know where and how to do those things. It's not easy but just moaning "everything sucks" isn't how to fix it.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#72

Post by fatfingerd » Thu, Sep 07, 2023, 9:14 PM UTC

pseg134 wrote: post #52

fuddle wrote: post #42

For anyone interested in learning more about the NSO group, I'd recommend this podcast episode: https://darknetdiaries.com/episode/100/

[flagged]

The US government gives them billions of dollars and they help the US government maintain puppet dictatorships like Saudi Arabia..

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#73

Post by vxNsr » Thu, Sep 07, 2023, 9:15 PM UTC

pseg134 wrote: post #52

fuddle wrote: post #42

For anyone interested in learning more about the NSO group, I'd recommend this podcast episode: https://darknetdiaries.com/episode/100/

[flagged]

You seem to think the NSO is some rogue org within Israel. Couldn’t be further from the truth. It’s simply a plausible deniability org that works for everyone, and counts every single US intelligence agency among its clients. The fact that you’re all upset about what they’re doing is exactly the point, you’re pointing your finger the NSO when it’s the NSA who’s paying them off.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#74

Post by hot_gril » Thu, Sep 07, 2023, 9:15 PM UTC

ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#75

Post by flutas » Thu, Sep 07, 2023, 9:17 PM UTC

zelphirkalt wrote: post #51

curiousgal wrote: post #34

Earlier quoted context omitted.

I've never met a person who threw away a phone because of the lack of updates.

Maybe not throw away but give away. Just look at how many people buy a new phone every 2 years or even shorter period. Something must happen to their old phones.

People do that exact same thing with iPhones, so clearly Apple must suck too. /s

A lot of phone purchases anymore fall into the fashion side of consumerism. They don't actually care about X, Y or Z new features. They just want to show off that they have the new thing.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#76

Post by vxNsr » Thu, Sep 07, 2023, 9:19 PM UTC

bastard_op wrote: post #55

So at what point does the world bring sanctions against Israel for allowing organizations like this to exist there? Everyone knows NSO is just a dubiously legal version of common APT groups, so how do they still exist after these years?

Any politician who attempted something like that would immediately find themselves on the wrong side of the table with various three letter agencies. You’re incredibly naive if you think Israel or really anyone else is responsible for this. They’re simply doing the bidding of various first world intel orgs that want/need plausible deniability.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#77

Post by hot_gril » Thu, Sep 07, 2023, 9:19 PM UTC

NegativeK wrote: post #63

pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

If you show me software that's immune to advanced 0-days, I'll show you software that isn't usable.

Or just slow. If you don't care about optimization and run things in really inefficient sandboxes, security becomes a lot easier.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#78

Post by bri3d » Thu, Sep 07, 2023, 9:19 PM UTC

liminalsunset wrote: post #20

parhamn wrote: post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

Some of the problems with iMessage have to do with the fact that it's integrated with the system SMS app. It seems that there are a large number of legacy requirements in the GSM spec that require the Messages app to be privileged in some way, especially with regards to automatic processing of data received. There have been plenty of iMessage or Messages related vulnerabilities. I do wish there was a way to turn off…

Apple have a service which attempts to do this, BlastDoor. The issue here is feature surface area unrelated to GSM. My guess from the CVEs is that this exploit revolves around sending a valid Wallet/PassKit item attachment which has a malicious image. The payload is safely _deserialized_ by BlastDoor itself, but is then passed off to the PassKit framework which happily detonates it.

IMO Apple should make a middle ground Lockdown mode - something that still allows attachments (which Lockdown mode doesn't, making it difficult for many users to employ), but forces them to be 1-click. This is something I would use personally and would at least protect me from getting 0-clicked by attacks like this; I'd never click a Wallet item from an unknown sender, but I also can't live with the restrictions in Lockdown mode.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#79

Post by pyinstallwoes » Thu, Sep 07, 2023, 9:19 PM UTC

l33t7332273 wrote: post #44

pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

>no wonder China is banning government officials from using their devices. Do you actually think security is the reason they are being banned? I think the reasons are far more political than technical.

Technology is political.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#80

Post by bsaul » Thu, Sep 07, 2023, 9:20 PM UTC

s3p wrote: post #10

robear wrote: post #8

Earlier quoted context omitted.

Isn't Messages E2E by default?

iMessage or android messages? iMessage is E2E by default, unless one or more parties own multiple apple devices, in which case apple stores an encryption key on iCloud and maintains E2EE connections with every connected Apple device. This changes if you turn on Advanced data protection-- then iCloud no longer has the ability to decrypt messages. Somewhat unrelated but ADP is off by default as most customers do not wa…

Do you have any kind of official doc that explains that behavior ?