Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

271–280 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#271

Post by andrewia »

Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people.

I'd prefer a third mode that compromises between the two, perhaps letting you lower your security for a few minutes when you need the extra functionality. For example, Safari could detect when JavaScript is being slow and pop up an offer to re-enable JIT.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#273

Post by jacquesm »

phendrenad2 wrote: post #226
jacquesm wrote: post #216

Earlier quoted context omitted.

At the risk of being boring: software liability would go a long way towards getting companies to do this work themselves. Even though Apple is the largest company on the planet an entity that has a small fraction of the budget is apparently able to do a better job. I don't see why Apple couldn't make those people an offer they can't refuse. That takes them off the market and has them doing something productive.

Software liability would effectively crush smaller companies, unable to keep up with the lawsuits, because they don't have billions in the bank.

If your software can cause billions of damage and you don't have billions in the bank you are in the wrong business, or acting very irresponsibly.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#274

Post by andrewia »

Horffupolde wrote: post #265

[flagged]

The issue is that NSO makes spyware available to far more countries by lowering the barrier to entry. Looking at their sales history, they have little criteria for sales besides following the preferences of the Israeli government. They sometimes sell to nations that generally promote human rights, and other times sell to nations that are very repressive yet important allies to Israel.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#275

Post by bawolff »

jacquesm wrote: post #257
jcampbell1 wrote: post #238

Earlier quoted context omitted.

I don’t understand your comment. Are you saying that involving trial lawyers and US juries to collect big settlements from Apple is going to stop the NSO Group? Or is it that the NSO Group should be liable for the actions of their clients?

I don't understand your comment either. You say you don't understand and then you give a choice between two narrow interpretations neither of which seems to cover what I wrote. To make this a bit more productive: If Apple were liable for their defective products then they might decide not to ship them at all until they can be sure enough that the risk of the lawsuits putting them out of business is small enough that…

> If Apple were liable for their defective products then they might decide not to ship them at all until they can be sure enough that the risk of the lawsuits putting them out of business is small enough that they can absorb it.

> This worked wonders for other industries (notably: automotive, airlines, medicine). It may slow them down a bit, you may have a wait a bit longer for the next iteration of some gadget. But that's a small price to pay in my opinion.

That's quite a big price for non life-critical equipment that is a billion times more complex than a pacemaker or the safety-critical parts of an airplane or car.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#276

Post by walterbell »

cheese_van wrote: post #266
l33t7332273 wrote: post #44

Earlier quoted context omitted.

>no wonder China is banning government officials from using their devices. Do you actually think security is the reason they are being banned? I think the reasons are far more political than technical.

>I think the reasons are far more political than technical. You may be right but sometimes the local optics track better when a political reason is given and the local authorities might also expect better compliance with political reasoning. Similarly, "We are getting pwned," never tracks well. There are solid reasons, long ago, why China stopped using Nortel.

> There are solid reasons, long ago, why China stopped using Nortel.

Such as?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#277

Post by acdha »

jacquesm wrote: post #257
jcampbell1 wrote: post #238

Earlier quoted context omitted.

I don’t understand your comment. Are you saying that involving trial lawyers and US juries to collect big settlements from Apple is going to stop the NSO Group? Or is it that the NSO Group should be liable for the actions of their clients?

I don't understand your comment either. You say you don't understand and then you give a choice between two narrow interpretations neither of which seems to cover what I wrote. To make this a bit more productive: If Apple were liable for their defective products then they might decide not to ship them at all until they can be sure enough that the risk of the lawsuits putting them out of business is small enough that…

> If Apple were liable for their defective products then they might decide not to ship them at all until they can be sure enough that the risk of the lawsuits putting them out of business is small enough that they can absorb it.

I think this works best at that level, like if there’s a sliding scale based on your company’s importance to normal people’s security. I think a lot of developers are worried that their two person consulting team is suddenly liable for bugs but it’s totally reasonable to say that Tim Cook should shake the spare change out of his office couch, call Graydon Hoare into his office and say “here’s a billion dollars, who should we hire so I never hear the phrase ‘buffer overflow’ again?”

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#278

Post by drewtato »

cowthulhu wrote: post #248

Does anyone know to what extent this compromises the device? I might have missed it, but didn’t see it explained in the article. Does the attacker get full access to the device, or do they only compromise a subset of the devices functionality?

They say at the top that the exploit can install Pegasus, so probably some or all of Pegasus's functionality. That doesn't really narrow it down, but it likely can constantly run in the background, use the sensors, read texts, and send info over the internet at least.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#279

Post by barryrandall »

andrewia wrote: post #271
Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromis…

I’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#280

Post by kbenson »

andrewia wrote: post #271
Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromis…

I think attackers would just try to make the system offer to disable security whenever possible then. Anything as easy as clicking an already offered option by the OS itself will be used often enough to negate most of the security benefits of that mode IMO, meaning you deal with it being slower be default and probably not as secure as you think because people will opt out often for convenience, so the worst of both worlds.

As I understand it this was a real problem with earlier versions of Windows where it kept asking for admin privileges all the time for simple things, and people got conditioned to just authorize it. They made a concerted effort to provide APIs that didn't require it for most actions to combat this.

Post reply on HN