Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

181–190 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#181

Post by fragmede »

liminalsunset wrote: post #20
parhamn wrote: post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

Some of the problems with iMessage have to do with the fact that it's integrated with the system SMS app. It seems that there are a large number of legacy requirements in the GSM spec that require the Messages app to be privileged in some way, especially with regards to automatic processing of data received. There have been plenty of iMessage or Messages related vulnerabilities. I do wish there was a way to turn off…

> I do wish there was a way to turn off automatic downloading of attachments like images etc.

isn't that what Lockdown Mode is for?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#182

Post by mrbombastic »

mensetmanusman wrote: post #164
14 wrote: post #122

Earlier quoted context omitted.

What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?

If they didn’t exist it would be a different company in Russia or China. The demand exists.

Maybe that’s true, it probably is, but they should still be sanctioned into oblivion considering they consistently are in the headlines on the wrong end of this being used for deeply questionable purposes.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#183

Post by koito17 »

hot_gril wrote: post #74
ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.

Huh? I could've sworn the TIFF bug was during the iPhoneOS 1.x days. I recall jailbreakme's exploit using corrupted fonts in a PDF, not TIFF images. A quick Google search led me to this https://appleinsider.com/articles/10/08/03/browser_based_ios...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#184

Post by baz00 »

lxgr wrote: post #143
crazygringo wrote: post #127

Earlier quoted context omitted.

Which actually makes me more sympathetic to Chrome not (yet) adopting JPEG-XL. Don't get me wrong, I think JPEG-XL is a great idea, but to everyone saying "how can supporting another image format possibly do any harm", this is the answer.

Why not implement all image codecs in a safer language instead? That would seem to tackle the problem at its root rather than relying on an implementation's age as a proxy for safety, given that that clearly isn't a good measure.

I think they are working on that slowly. Lots of stuff is moving to Swift. Including bits of iMessage.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#185

Post by mensetmanusman »

otterley wrote: post #81
ketralnis wrote: post #71

Earlier quoted context omitted.

That's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché. We can and should improve development practises, mitigate vulnerabities (ASLR, WAFs, etc), isolate systems from each other, and model threats in a way that we know where and how to do those things. It's not easy but just moaning "everything sucks" isn't how to fix it.

Apple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.

Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#186

Post by lijok »

btown wrote: post #85
baz00 wrote: post #13

Earlier quoted context omitted.

They're slowly rewriting the whole thing in Swift which should eventually eliminate most of the non architectural attack vectors. Most of them were mitigated in iOS 14 where they did some rather large architectural changes. Edit: Further info: https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

When I look at an initiative like BlastDoor, I'm struck by how unlikely it is that every other messaging app makes a similar investment on every platform. Does WhatsApp have a similar architecture? Has the Gmail app rewritten all its image parsers in a similar manner? Has Tinder? And sure, if you compromise WhatsApp you only get access to its internal memory and may not be able to escalate to other apps or OS storage…

zero click zero days cost literal millions, sometimes tens of millions

these exploits aren’t utilized haphazardly - someone has to be willing to pay

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#187

Post by acdha »

mensetmanusman wrote: post #164
14 wrote: post #122

Earlier quoted context omitted.

What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?

If they didn’t exist it would be a different company in Russia or China. The demand exists.

True, but there’s a real question about how effective they’d be. NSO has the veneer of legitimacy which means they can hire top notch talent by pretending their products are just law enforcement tools – fewer people would be comfortable working for a Russian mercenary group or able to tell their friends and family their work for a Chinese government vendor wasn’t helping oppression. That doesn't mean that everyone in the world is comfortable working for them but think about how it is for Palantir where a significant percentage of top tech talent don't seek employment there due to ethical concerns - NSO has similar problems but they'd be an order of magnitude worse if they weren't in a close ally country.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#188

Post by nabakin »

lxgr wrote: post #143
crazygringo wrote: post #127

Earlier quoted context omitted.

Which actually makes me more sympathetic to Chrome not (yet) adopting JPEG-XL. Don't get me wrong, I think JPEG-XL is a great idea, but to everyone saying "how can supporting another image format possibly do any harm", this is the answer.

Why not implement all image codecs in a safer language instead? That would seem to tackle the problem at its root rather than relying on an implementation's age as a proxy for safety, given that that clearly isn't a good measure.

I'd guess it's a combination of labor required to rewrite them and that you'd more or less have to use a safe systems language in order to not have a performance regression

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#189

Post by tialaramex »

deepfriedrice wrote: post #152
pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

The article references Lockdown mode [0] which appears to be Apple's solution for this (and other) class of zero days. [0] https://support.apple.com/en-ca/HT212650

Lockdown mode means you're able to use less stuff. In this case the "pass" feature doesn't exist in Lockdown mode and that's the attack target AIUI. So, if most people don't use it (because less stuff works) then it can be "successful" statistically because maybe the attackers aren't targeting the stuff you're allowed to use and you don't get exploited.

But this isn't a stable solution really. If Lockdown is popularized, NSO obviously will attack the things which are available in Lockdown. Apple shows no sign of only allowing it in Lockdown once it's actually safe - instead they've just arbitrarily decided what to allow and what not to allow.

Post reply on HN