Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

371–380 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#371

Post by UncleMeat »

rakkhi wrote: post #123
ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Again buffer overflow in image decoding. Would think apple might just #threatmodel and #fuzz that to death... but you would be wrong. 2.7T market cap company can't do this...

Coverage-guided fuzzing is extremely powerful and has proven to be very effective at finding oodles of vulns. But it is not perfect. You'll fail to drive the code to a bug or run into limitations of the sanitizers to actually detect a vuln.

You can stand up fuzz targets at all of the relevant endpoints and throw tons of compute at it and still fail to find lots of things. The problem is unsafe languages. Apple is taking steps to get things moved to swift, but it is slow going.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#372

Post by markus_zhang »

doug_durham wrote: post #316
londons_explore wrote: post #171

How many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.

Every process in iOS is run in a sandbox. That is why these exploits are so hard to come by.

I so respect those who figured out these exploits. I don't like people using them of course but the technical brilliance is indisputable.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#373

Post by ipaddr »

lazide wrote: post #335
acdha wrote: post #268

Earlier quoted context omitted.

> No one can pay these guys enough I’m sure there are a lot of committed patriots there but I doubt it’s the whole company. Tim Cook could drop 1% of their cash on hand and see how many of them would turn down a million or two as a signing bonus, and if that didn’t work he could escalate to 10% or toss in some stock. I find it unlikely that wouldn’t tempt a lot of people, especially since the U.S. is one of Israel’s…

I think you’re misunderstanding. Mossad likely wouldn’t let anyone pay enough. Or let NSO accept. Unless they were already friends enough to not need to worry much about cost.

Mossad would encourage it. Moosad is not a gang where you cannot leave. They want ex-mossad in high positions because they can leverage that later.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#374

Post by SigmundA »

wyldfire wrote: post #82

Wow this sounds like stagefright was way back when. So for those keeping score, is Android now ahead of iOS in this aspect of security?

Not sure Android just had a bunch of CVE published with little fanfare here: https://source.android.com/docs/security/bulletin/2023-09-01

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#376

Post by callalex »

saagarjha wrote: post #292
jacquesm wrote: post #270

Earlier quoted context omitted.

GPS is a thing. iPhones have GPS.

Ok, and these companies develop zero-day exploits for a living. You think region-locking is going to work?

Enough to make the company politically unpopular in its home country, yes.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#377

Post by UncleMeat »

aaomidi wrote: post #342
tlrobinson wrote: post #201

Earlier quoted context omitted.

Maybe a dumb question, but why are media decoders, which are notoriously high risk, not well sandboxed?

And why haven’t they been rewritten yet considering it keeps happening.

It takes a while. At Google at least, new systems in android are required to be built in rust and there are major efforts to rewrite significant systems. But it takes time and rewrites are dangerous in other ways. And you need all the tooling to handle everything else an engineer does beyond simply writing code.

From where I sit, it also feels like the industry has really only coalesced around "the only real solution is safer languages" in the last 2-3 years. "Rewrite it in swift/rust" was way more controversial in 2019. So hopefully we'll see significant progress in the next several years.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#378

Post by Dylan16807 »

vilunov wrote: post #300
Dylan16807 wrote: post #242

Earlier quoted context omitted.

That depends entirely on what the software needs to do. For image decoding in particular, you can put the software into an exceptionally restrictive sandbox, or use a language that builds in the same restrictions. No I/O. No system calls. Just churn internally and fill a preallocated section of memory with RGBA. The broader system will still have weaknesses, but it won't have this kind, and this kind keeps happening.

What exactly is "an exceptionally restrictive sandbox"? There are virtual machines such as JVM, V8, or even QEMU. These are sandboxes, which run either some special bytecode or native code with extreme performance drawbacks. Media decoders are performance- and energy-sensitive pieces of software in the end. And media decoders actually ARE sandboxes of sorts. They are designed to interpret media formats, sometimes eve…

> JVM, V8, or even QEMU

> extreme performance drawbacks

That's just not true.

> And media decoders actually ARE sandboxes of sorts. They are designed to interpret media formats, sometimes even Turing-complete bytecode in retrictive and isolated environments. And like any sandboxes, they too have bugs.

It's pretty easy to sandbox a simple bytecode, but that's not the bulk of what a media decoder is doing. A plain old decoder is mostly not sandboxing what it does.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#380

Post by n8cpdx »

andrewia wrote: post #271
Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromis…

You can turn off lockdown mode per site and per-app in safari. I had to do that to get Obsidian to work, but I also use it for specific trusted sites.
Post reply on HN