Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

221–230 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#221

Post by jdright »

tialaramex wrote: post #189
deepfriedrice wrote: post #152

Earlier quoted context omitted.

The article references Lockdown mode [0] which appears to be Apple's solution for this (and other) class of zero days. [0] https://support.apple.com/en-ca/HT212650

Lockdown mode means you're able to use less stuff. In this case the "pass" feature doesn't exist in Lockdown mode and that's the attack target AIUI. So, if most people don't use it (because less stuff works) then it can be "successful" statistically because maybe the attackers aren't targeting the stuff you're allowed to use and you don't get exploited. But this isn't a stable solution really. If Lockdown is populari…

Not entirely true because NSO (or their clients) have very specific target requeriments. If they want to target another Jamal Khashoggi and lockdown mode is used, they have their incentive to buy and create the demand for any 0day that they can then re-sell to their lovelly clients. No need statistics for this, the incentive is purely greed.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#222

Post by kylehotchkiss »

ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Ugh, apple needs to drop these antique image parsers

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#223

Post by ls612 »

bri3d wrote: post #78
liminalsunset wrote: post #20

Earlier quoted context omitted.

Some of the problems with iMessage have to do with the fact that it's integrated with the system SMS app. It seems that there are a large number of legacy requirements in the GSM spec that require the Messages app to be privileged in some way, especially with regards to automatic processing of data received. There have been plenty of iMessage or Messages related vulnerabilities. I do wish there was a way to turn off…

Apple have a service which attempts to do this, BlastDoor. The issue here is feature surface area unrelated to GSM. My guess from the CVEs is that this exploit revolves around sending a valid Wallet/PassKit item attachment which has a malicious image. The payload is safely _deserialized_ by BlastDoor itself, but is then passed off to the PassKit framework which happily detonates it. IMO Apple should make a middle gro…

I look forward to reading the Google Project Zero blog post about this one given how wild the last one was.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#224

Post by dragonwriter »

astrange wrote: post #205
dragonwriter wrote: post #173

Earlier quoted context omitted.

Apple has annual revenue greater than the GDP of any of the bottom ~4/5 of nation-states.

The problem with internal bounties is that you'd be granting them to the people with power to put in the security holes they find.

Sure, but “internal bounties have fundamental problems of incentives at any scale” is a different problem than “Apple can't afford internal bounties on an adequate scale to compete with nation-state attackers”.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#225

Post by lxgr »

bombolo wrote: post #177
crazygringo wrote: post #146

Earlier quoted context omitted.

That's a great question, and I'd love to know the answer.

Adding something in rust into a browser means you now need to bundle all of the needed crates and that your browser now also needs rustc to build… at a minimum. You also need potentially to audit all the crates and keep them up to date and so on… without crates you can't do so much.

I can see that for components heavily interfacing with high surface area things like encryption, hardware interfacing etc., but why would that be true for a relatively “pure” computational problem like an image codec? Bytes in, bytes out.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#226

Post by phendrenad2 »

jacquesm wrote: post #216
14 wrote: post #122

Earlier quoted context omitted.

What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?

At the risk of being boring: software liability would go a long way towards getting companies to do this work themselves. Even though Apple is the largest company on the planet an entity that has a small fraction of the budget is apparently able to do a better job. I don't see why Apple couldn't make those people an offer they can't refuse. That takes them off the market and has them doing something productive.

Software liability would effectively crush smaller companies, unable to keep up with the lawsuits, because they don't have billions in the bank.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#227

Post by postalrat »

l33t7332273 wrote: post #44
pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

>no wonder China is banning government officials from using their devices. Do you actually think security is the reason they are being banned? I think the reasons are far more political than technical.

I just assume the weaknesses were made to be exploited by the US and other governments.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#228

Post by sudosysgen »

mensetmanusman wrote: post #185
otterley wrote: post #81

Earlier quoted context omitted.

Apple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.

Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.

It's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#229

Post by mschuster91 »

jacquesm wrote: post #216
14 wrote: post #122

Earlier quoted context omitted.

What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?

At the risk of being boring: software liability would go a long way towards getting companies to do this work themselves. Even though Apple is the largest company on the planet an entity that has a small fraction of the budget is apparently able to do a better job. I don't see why Apple couldn't make those people an offer they can't refuse. That takes them off the market and has them doing something productive.

> Even though Apple is the largest company on the planet an entity that has a small fraction of the budget is apparently able to do a better job.

NSO Group is Israeli and (most likely) filled to the brim with former Unit 8200 staff. About the best of the best what the IDF has to offer - they've been said to match the NSA in quality.

> I don't see why Apple couldn't make those people an offer they can't refuse.

For all that can be guessed, they're a semi-private company, deeply connected with the Israeli government [1]. No one can pay these guys enough. If you want them to stop, you'll have to get the Israeli government to agree, and they won't give up any asset that gives them an edge over Iran or its numerous other enemies.

[1] https://en.wikipedia.org/wiki/NSO_Group#Relationship_with_th...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#230

Post by postalrat »

NegativeK wrote: post #63
pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

If you show me software that's immune to advanced 0-days, I'll show you software that isn't usable.

How can a 0-day exist if its not possible for that software?
Post reply on HN