Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

671–680 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#671

Post by lr4444lr »

H8crilA wrote: post #571
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm an…

> Israel is constantly trying to woo Saudi Arabia so that they can be allies during a potential war with Iran.

You have that reversed. Recent Iranian regimes have been especially hostile toward Israel, but that's nowhere near as longstanding an enmity as Saudi/Iran.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#672

Post by bjornsing »

Good to see NSO loosing a valuable exploit chain. If this becomes common enough they’ll think twice about (enabling) targeting legitimate civil society organizations, for purely economic reasons: the risk of detection and reporting of vulnerabilities is much higher than when targeting terrorists and criminals.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#673

Post by dcormier »

black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

Darknet Diaries had an episode about them a while back. It’s a good listen (as that podcast always is).

https://darknetdiaries.com/episode/100/

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#674

Post by withinboredom »

dkindler wrote: post #657
allie1 wrote: post #604

Earlier quoted context omitted.

To sell the software, they need approval from Israel’s govt, as the software is treated as a weapon

The US gov't almost certainly has a say as well.

The US has their own version, called the NSA. Available to hire via really simple framing. Guaranteed whomever is caught will be in prison for years just to get a trial to prove they're innocent.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#675

Post by cj »

jxcl wrote: post #369
sneak wrote: post #361

Earlier quoted context omitted.

It's also insecure. The sync keys for iMessage are backed up in the non-e2ee iCloud Backup, which means that iCloud serves as a key escrow for iMessage's e2ee, rendering it useless (as Apple, which is definitively not an endpoint, has a private key of the participant and can read all the messages in real-time). iMessage should be assiduously avoided.

This is less true now, with the option to enable “advanced data protection”. Turning this setting on disables Apple’s access to your iMessage keys along with a bunch of other stuff, though of course if you get locked out, Apple can’t help you

> if you get locked out, Apple can’t help you

Unfortunately, I can attest to this.

I probably spent 100+ hours doing everything possible to regain access to an iCloud account with advanced data protection.

I lost the password and the recovery key (with no 2nd apple device that was logged in). The only outcome in that scenario is losing your iCloud account completely.

Lesson: enable advanced security, but save your recovery key!

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#676

Post by withinboredom »

black_puppydog wrote: post #594
H8crilA wrote: post #571

Earlier quoted context omitted.

Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm an…

There's multiple responses echoing this idea that it's a defense company like any other and thus an evil we'll have to accept exists. That may be true, but these companies (NSO group is by no means worse than the rest of them, just more notorious) have been caught over and over again, selling these "weapons" to dictators, companies, etc, who in turn use them to spy on journalists and activists, not terrorists or anyt…

> have been caught over and over again, selling these "weapons" to dictators, companies, etc

Meanwhile, a nice silent worm propagates among their network... I have 0-faith that the version they have sold to bad actors is clean when they probably are begging you to take their software into your internal network.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#677

Post by cj »

runeks wrote: post #625
sneak wrote: post #362

Earlier quoted context omitted.

You can leave lockdown off, and disable iMessage.

I don't want to disable iMessage, just attachments from unknown contacts.

Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#678

Post by yyyk »

black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

Actual headline: mentions NSO group and nothing about Apple.

Top comment (+50 comments): Why do we talk about Apple so much and so little about NSO group.

The absurdly pro-Apple PR on HN is tough to bear. I have to say it's so overt it made me more hostile to Apple (NSO is obviously a worthy topic, but we do discuss it).

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#679

Post by acdha »

jeroenhd wrote: post #478
acdha wrote: post #194

Earlier quoted context omitted.

They do, but some of these bugs are beyond what fuzzing can do. We don’t know that this is a buffer overflow or how complex the exploit chain was - the one linked above was anything but something you’d get by fuzzing. I agree it is disappointing that this stuff isn’t all Rust or Swift yet but that’s in process. Of particular interest, did you notice how the new Lockdown mode is apparently a countermeasure? I would no…

Can't you trigger this by fuzzing? Sure, the JBIG VM won't be, but some random fuzzing should easily trigger out of bounds reads or writes. Lockdown mode alters the iMessage user flow to such an extent that I don't see Apple enabling it by default. I don't think Lockdown prevents the RCE exploit, but I do think it simply blocks iMessage interactions from unknown numbers, so that the exploit can't even load.

The older one? Probably but I think the way it combined multiple overflows would have required a fairly advanced fuzzer, especially to look exploitable. The main point I had was that while fuzzing would have found interesting ways to crash ImageIO with PDFs, most people wouldn’t have expected that to be reachable without a click from iMessage. The relevant teams could have been rewriting everything they care about in Rust and this still would have happened because it was an obsolete usage of a format they don’t even use but which could be pulled in by the old GIF preview path.

I agree that most Lockdown mode features won’t be pulled in but looking at that list, note how many stop a NSO zero-click by adding a “have you ever interacted with this person?” filter to iMessage, FaceTime, HomeKit, etc. That makes me wonder whether a more polished UI might be acceptable to normal users where new numbers are basically text-only with warnings.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#680

Post by judiisis »

fweimer wrote: post #656
caisah wrote: post #577

Earlier quoted context omitted.

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's…

Well Google and apple already have a lawful intercepting solution,they just don't have full zero day backdoor
Post reply on HN