Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

411–420 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#411

Post by paravirtualized »

kernal wrote: post #353
chaxor wrote: post #209

Earlier quoted context omitted.

The pixel is decent if using graphene is . Not sure if any system is good by default. Apple fans think their defaults are somehow more private or secure, mostly due to marketing.

Decent? From a security perspective it's superior to the iPhone. As for Graphene, unless you've personally vetted the code I don't see how it can be trusted. And I won't even go into the drama that OS comes with.

> unless you've personally vetted the code I don't see how it can be trusted.

As opposed to proprietary Google code that cannot be vetted?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#412

Post by xxs »

anoncow wrote: post #235
ruuda wrote: post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Will Rust be able to prevent such overflows?

Image decoding can be ported to rust, however most video/image decoding software is rarely ported (performance reasons and what not) - and used as a library instead.

Java would have similar issues as well. It'd be using a compiled C code as an external library in cases like these.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#413

Post by SamuelAdams »

Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

I use Lockdown Mode on my Mac because I don’t use iMessage, FaceTime, or other apple services on that device. It’s literally just a computer for software dev and maybe YouTube videos. I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari. What I would really like to see is options. For example on iOS I use shared photo albums, so it would be nice to keep that feature but disable all the other capabilities.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#414

Post by computator »

Obscurity4340 wrote: post #336
andrewia wrote: post #271

Earlier quoted context omitted.

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromis…

I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.

That fact that Apple blended iMessages, SMS text messages, and email into an extremely confusing mess may also be the reason for so many security issues related to iMessage. Perhaps not directly responsible for this particular NGO exploit, but I find iMessage's logic and behavior bewildering at times.

For example: If you stop using WhatsApp for example, nothing bad happens if you try to send messages another way. But if you stop using iMessage, then you can no longer send a normal SMS to someone with whom you've communicated before using iMessage. The Messages app will tell you, "You must enable iMessage to send this message", even if it's an SMS text message to a normal phone number! Why shouldn't that work?

To be able to again send SMS text messages to someone you used to talk with is to disable iMessage of course, then sign out of Facetime (who could imagine that as a necessary step?), sign out of iCloud, reboot the iPhone, and wait some minutes to hours to days until you are "deregistered" from iMessage. I'm talking about the same phone with the same SIM chip. The problem can become much worse if you've switched phones or SIM card.

The source code for iMessage must be a nightmare having integrated SMS and email and a new messaging system all together.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#416

Post by udev »

I don't understand Apple here.

Just put an army of people on fuzzing the shit out of iMessage and all its possible file attachments.

You tried and failed? Fire the bozo who lead the effort. Try again.

You did not even try? Fire the c-level bozo who failed to see it coming and failed to approve such an effort.

But cynically, more and more it feels like some bugs have to stay unfixed, for NSA use, just that NSO is also getting on the game.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#417

Post by jacquesm »

xxs wrote: post #407
jacquesm wrote: post #270

Earlier quoted context omitted.

GPS is a thing. iPhones have GPS.

That sound so naive, or fanboy - it ain't funny. GPS can be spoofed, and the entire hardware that decodes it replaced. Trying to hide a hardware device that's sold in billions is not going to happen.

You are severely underestimating the power of an entity like Apple. HN regularly spouts opinions that if US companies don't like the GDPR they should just stop doing business with the EU. That's a massive block of consumers and I highly doubt any company that likes its bottom line is going to take that approach.

But we're talking about one company here that simply should stop selling their crap to the highest bidder. I'm at some level ok with the Israeli's doing what they do, they're no different than any other nation state. But to allow this sort of entity to operate from your soil in a commercial manner, including selling those exploits on the open market where they will inevitably be used against the home country as well seems 'optional' to me and there is a lot of Israelis that like their smartphones.

Why would an entity the size of Apple risk their reputation and everything they stand for to avoid a run-in with a relatively tiny company in a relatively small part of the world that is causing an enormous amount of problems?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#418

Post by l33t7332273 »

hot_gril wrote: post #356
dhosek wrote: post #108

Earlier quoted context omitted.

Yeah, the whole way that the jailbreaks installed was scary enough for me to never want to go near them.

Your phone would reboot with a pineapple logo and console messages flying across the screen like a 1337 h4cker, starting with the "regents of the University of California, Berkeley" message. Then you'd go install a ton of Cydia hacks.

What is the significance of the “regents of the University of California, Berkeley” message?

Is it the FreeBSD boot message?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#419

Post by xxs »

astrange wrote: post #207
lxgr wrote: post #143

Earlier quoted context omitted.

Why not implement all image codecs in a safer language instead? That would seem to tackle the problem at its root rather than relying on an implementation's age as a proxy for safety, given that that clearly isn't a good measure.

Almost all people don't want to or aren't capable of implementing image codecs, the safer languages aren't fast enough to do it in, and the people who are capable of it don't want to learn them.

when it comes down to doing the metal, benchmarks becomes an important thing -- and you rarely stop until the inner most routines are in Assembly.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#420

Post by xwolfi »

agnosticmantis wrote: post #297

I find it interesting that most comments here are blaming the victim (Apple’s iMessage and by transitivity its users) rather than the aggressor (NSO and its users). How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing?

Well in security, any open door is as much a problem as the guy opening the door. Nobody's blaming anyone, we're all programmers and we all made mistakes.
Post reply on HN