NSO group iPhone zero-click, zero-day exploit captured in the wild • Hacker News Board

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#241

Post by kevin_thibedeau » Thu, Sep 07, 2023, 11:10 PM UTC

mrbombastic wrote: post #182

mensetmanusman wrote: post #164

Earlier quoted context omitted.

If they didn’t exist it would be a different company in Russia or China. The demand exists.

Maybe that’s true, it probably is, but they should still be sanctioned into oblivion considering they consistently are in the headlines on the wrong end of this being used for deeply questionable purposes.

The US enjoys some fruits of their labor and they're conveniently distanced from any explicitly funded operations to avoid blow back when exploits are publicized. They won't enforce sanctions or, more practically, withhold the massive defense subsidies they give to Israel.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#242

Post by Dylan16807 » Thu, Sep 07, 2023, 11:11 PM UTC

NegativeK wrote: post #63

pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

If you show me software that's immune to advanced 0-days, I'll show you software that isn't usable.

That depends entirely on what the software needs to do.

For image decoding in particular, you can put the software into an exceptionally restrictive sandbox, or use a language that builds in the same restrictions.

No I/O. No system calls. Just churn internally and fill a preallocated section of memory with RGBA.

The broader system will still have weaknesses, but it won't have this kind, and this kind keeps happening.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#243

Post by Obscurity4340 » Thu, Sep 07, 2023, 11:11 PM UTC

mensetmanusman wrote: post #164

14 wrote: post #122

Earlier quoted context omitted.

What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?

If they didn’t exist it would be a different company in Russia or China. The demand exists.

Elcomsoft is their Russian analogue

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#244

Post by lxgr » Thu, Sep 07, 2023, 11:12 PM UTC

astrange wrote: post #231

lxgr wrote: post #208

Earlier quoted context omitted.

All good points, but hopefully Google would be able to find the resources to overcome these?

It can be overcome with time and it is getting better, those are just the historical reasons it's not already better. Google has contributed lots of fuzzing time and security improvements to eg ffmpeg already.

Definitely, but GP was specifically using this as an argument for Google not supporting a codec in Chrome. If anybody can spare the effort to do it safely, it’s them.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#245

Post by PradeetPatel » Thu, Sep 07, 2023, 11:13 PM UTC

sudosysgen wrote: post #228

mensetmanusman wrote: post #185

Earlier quoted context omitted.

Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.

It's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.

Difficult often implies additional resourcing and development related costs.

Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values.

Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#246

Post by [deleted] » Thu, Sep 07, 2023, 11:14 PM UTC

bastard_op wrote: post #55

So at what point does the world bring sanctions against Israel for allowing organizations like this to exist there? Everyone knows NSO is just a dubiously legal version of common APT groups, so how do they still exist after these years?

[deleted]

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#247

Post by jahewson » Thu, Sep 07, 2023, 11:14 PM UTC

ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

JBIG2, I should have known! Interesting that bug came not from Apple but from Xpdf.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#248

Post by cowthulhu » Thu, Sep 07, 2023, 11:15 PM UTC

Does anyone know to what extent this compromises the device? I might have missed it, but didn’t see it explained in the article. Does the attacker get full access to the device, or do they only compromise a subset of the devices functionality?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#249

Post by cma » Thu, Sep 07, 2023, 11:15 PM UTC

tlrobinson wrote: post #201

ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Maybe a dumb question, but why are media decoders, which are notoriously high risk, not well sandboxed?

It makes no sense, especially for things like thumbnails in file viewers.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#250

Post by ajross » Thu, Sep 07, 2023, 11:17 PM UTC

ok123456 wrote: post #133

zshrc wrote: post #38

Earlier quoted context omitted.

Please... Androids no better. At least Apple will have it patched within the year of discovery. Can't say the same for other Android vendors.

On Android you can disable automatic link preview and downloading of MMS messages. You can also swap out the application that handles text messages entirely. This eliminates this whole class of attack.

Also the application that handles text message is itself sandboxed and limited to a fixed set of permissions (to be fair, that include messaging other humans, so an exploit would still be very bad, just not "remote root" bad).

That's the part that is still unclear with this BLASTPASS business. Surely iOS isn't running the messaging app as a device root, right? There's some other presumably-unpatched privilege elevation attack going on?