Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

611–620 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#611

Post by nvm0n2 »

wyldfire wrote: post #82

Wow this sounds like stagefright was way back when. So for those keeping score, is Android now ahead of iOS in this aspect of security?

Depends what you mean by this aspect of security.

If you flick through the fixes for Android CVEs, you'll notice that there are only a few remote code execution vulns and they're all in C code. The rest are bugs in the Java side but they're all logic bugs and yield exploits like local privilege escalation, or they're privacy issues.

So the Android strategy of using Java a lot definitely seems to have wiped out a lot of memory corruption and RCE bugs. The remainder are a mixed bag and it's hard to imagine any sort of systematic mitigation or fix.

You can't really compare Android and iOS by CVE because iOS isn't open source or distributed to vendors, so Apple fix a lot of security issues without a public CVE ever being created.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#613

Post by top_sigrid »

gzer0 wrote: post #520

[flagged]

For a „best guess“ you’re making quite detailed assumptions, of which I have no idea and you bring up no reasons how you can assume these.

In the note they state that the exploit was in image processing with PassKit and iMessage. Your comment somehow reads like an extrapolation what might have happened without any more actual knowledge that you share.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#614

Post by H8crilA »

black_puppydog wrote: post #594
H8crilA wrote: post #571

Earlier quoted context omitted.

Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm an…

There's multiple responses echoing this idea that it's a defense company like any other and thus an evil we'll have to accept exists. That may be true, but these companies (NSO group is by no means worse than the rest of them, just more notorious) have been caught over and over again, selling these "weapons" to dictators, companies, etc, who in turn use them to spy on journalists and activists, not terrorists or anyt…

This is true, but then you have to also socially shame a large part of the US military, for invading Iraq. At least those that didn't resign as soon as it became clear that there are no WMDs there, and the large amount of Iraqis were killed pretty much for nothing.

In short - you have a point, but it's not quite that simple.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#615

Post by raverbashing »

computator wrote: post #414
Obscurity4340 wrote: post #336

Earlier quoted context omitted.

I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.

That fact that Apple blended iMessages, SMS text messages, and email into an extremely confusing mess may also be the reason for so many security issues related to iMessage. Perhaps not directly responsible for this particular NGO exploit, but I find iMessage's logic and behavior bewildering at times. For example: If you stop using WhatsApp for example, nothing bad happens if you try to send messages another way. But…

"but but my precious text bubble colors!!1"

Yeah, it seems iMessage in iPhone is like IE in Windows, a needlessly ingrained mess for market segmentation purposes

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#616

Post by rollcat »

rollulus wrote: post #591
kubov wrote: post #557

Earlier quoted context omitted.

I dont know why, but this reads like a LLM output.

Looking at their history you’re likely right. Downvoted.

What's the point? It'll get feedback and get better at dressing up the noise.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#617

Post by TheDong »

ramraj07 wrote: post #469
goldinfra wrote: post #415

I don't need to be able to accept iMessage messages from random numbers. I'd be happy to enable "Prevent messages from unknown numbers" for example. Is this possible?

Is this needed on top of lockdown mode?

I don't want the huge number of inconveniences of lockdown mode. I just want to have apple block messages from unknown senders to iMessage server-side, before they forward any untrusted data to any of my devices.

lockdown mode also doesn't add server-side filtering for unknown imessage senders, so that doesn't seem as good for this purpose.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#619

Post by alkonaut »

londons_explore wrote: post #171

How many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.

Yeah I can't believe we are still seeing this happen over and over again. Whenever you see "zero click" you know it's one of the complex payloads like images, fonts. The answer shouldn't be "don't render images". We should be able to trust that a component that parses external data such as an image, simply can't do anything malicious regardless of input.

If that means sandboxing, fine. If it means having to rewrite all the image parsers from the ground up in a safe language or formally prove them correct, fine. Just get on with it. Apple is rich enough to be able to run their own space program ten times over, I think they could write provably correct imaging libs too.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#620

Post by TheDong »

HDThoreaun wrote: post #537
eviks wrote: post #518

Again iMessage? Would be nice if you could expel insecure components like that from your walled apple paradise

Every app is insecure they just choose iMessage because every iPhone has it and you can send the payload with just a phone number making it slightly easier to exploit.

"slightly easier"?

For someone to send me a message on signal, they have to either social engineer me into adding a number I don't know, or they have to steal a device from one of my existing contacts, get it unlocked, and send from it.

There is no way for them to go from knowing my phone number to me receiving and processing an untrusted image without them first somehow becoming a contact.

iMessage has no option to require friending first, before receiving unsolicited messages.

That doesn't seem like a "slightly easier" thing, but a rather significant difference.

Post reply on HN