Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

681–690 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#681

Post by nverno »

goodluckchuck wrote: post #667
franga2000 wrote: post #635

Earlier quoted context omitted.

I don't see why the government doing it would make it more outrageous. If democratically elected leaders pass a law outlining when and how the cops should be able to access private devices, a judge looks over a specific case and signs a warrant, the cops use a hacking tool to catch a terrorist and the evidence is presented in court, this seems like the most excusable use of hacking tools that I can think of. The gove…

It does if we grant the two the same assumptions. If we assume that serious, unjustified harm would occur by failing to act, and they are in a reasonable position to act… then I’d say a private company is equally justified in doing the same thing. However, you’re assuming the government is justified merely because it’s the government.

Maybe it depends on the country, but private companies cant generally get warrants to infringe on people's rights afaik. If justified is interpreted as 'legally justified', then it would make sense that only government agents could be justified to act in this manner. Of course, government agents are known to operate outside the law as well.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#682

Post by itronitron »

fweimer wrote: post #656
caisah wrote: post #577

Earlier quoted context omitted.

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's…

>> by offering competing services

That is a slippery slope though, because the OS vendors could offer Law Enforcement everything today, and there will be a special request made for a little something extra tomorrow.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#683

Post by internetter »

goodluckchuck wrote: post #667
franga2000 wrote: post #635

Earlier quoted context omitted.

I don't see why the government doing it would make it more outrageous. If democratically elected leaders pass a law outlining when and how the cops should be able to access private devices, a judge looks over a specific case and signs a warrant, the cops use a hacking tool to catch a terrorist and the evidence is presented in court, this seems like the most excusable use of hacking tools that I can think of. The gove…

It does if we grant the two the same assumptions. If we assume that serious, unjustified harm would occur by failing to act, and they are in a reasonable position to act… then I’d say a private company is equally justified in doing the same thing. However, you’re assuming the government is justified merely because it’s the government.

Do you think private companies should be allowed to, say, arrest people?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#684

Post by acdha »

lr4444lr wrote: post #670
goodluckchuck wrote: post #629

Earlier quoted context omitted.

The ties to government are a red herring. Hacking into people’s private phones and computer systems is generally immoral and illegal. It generally continues to be immoral and illegal when governments do it. Except it also becomes more outrageous, because governments are supposed to protect us from this sort of thing.

Devil's advocate: we have a reasonable expectation that governments using due process to obtain warrants for criminal investigations have a right to break and enter into digital property or wiretap to catch and prosecute malefactors. How far do you really expect any tech outfit to vet the legitimacy of the warrants issued?

How about the legitimacy of the government? Most of the abuses are governments which have a long history of abusing their power and it wouldn’t be unreasonable to say that entire countries should not be trusted with sales.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#685

Post by the_third_wave »

computator wrote: post #414
Obscurity4340 wrote: post #336

Earlier quoted context omitted.

I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.

That fact that Apple blended iMessages, SMS text messages, and email into an extremely confusing mess may also be the reason for so many security issues related to iMessage. Perhaps not directly responsible for this particular NGO exploit, but I find iMessage's logic and behavior bewildering at times. For example: If you stop using WhatsApp for example, nothing bad happens if you try to send messages another way. But…

That is because iMessage has the same function as the night men in the Eagles song Hotel California:

   "Relax,” said the night man, “We are programmed to receive
   You can check out any time you like but you can never leave"
Somehow fittingly that song is about the excesses of American culture ... also about the uneasy balance between art and commerce [1] according to one of its authors, Don Henley while also having been interpreted as being all about American decadence and burnout, too much money, corruption, drugs and arrogance; too little humility and heart and a metaphor for hedonism, self-destruction, and greed ....

[1] https://www.smoothradio.com/features/the-story-of/eagles-hot...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#687

Post by sneak »

cj wrote: post #677
runeks wrote: post #625

Earlier quoted context omitted.

I don't want to disable iMessage, just attachments from unknown contacts.

Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box

AFAIK all iMessage attachments (since iOS 14) are quarantined via BlastDoor, any such full system takeover must include at least two escapes: one from BlastDoor, and another from the application sandbox. They also need to cope with ASLR. It's pretty heavy duty even in the most basic default configuration.

https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

Upon re-reading this, it seems like crashes in BlastDoor are reported to Apple in real-time. I think this qualifies as "clientside scanning", tbh.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#688

Post by acdha »

VHRanger wrote: post #646
saagarjha wrote: post #546

Earlier quoted context omitted.

It’s an attack vector because it’s convenient. If iMessage didn’t exist people would email you exploits.

Are there zero click exploits in email?

There’s been a long history of them, and an entire industry doing things like filtering attachments or rendering HTML emails in sandboxes.

I think the original poster made an attribution error: iMessage gets attacked because it’s popular. If it didn’t allow you to receive rich messages from anyone, people would switch to other apps which do and there’s a long history of those being exploitable, too. What makes iMessage special is that you can assume an iPhone user has it enabled without having to check whether they use WhatsApp, Telegram, Facebook Messenger, etc.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#689

Post by nverno »

bjourne wrote: post #669
H8crilA wrote: post #614

Earlier quoted context omitted.

This is true, but then you have to also socially shame a large part of the US military, for invading Iraq. At least those that didn't resign as soon as it became clear that there are no WMDs there, and the large amount of Iraqis were killed pretty much for nothing. In short - you have a point, but it's not quite that simple.

Yeah, every single US soldier who voluntarily stepped on Iraqi soil should be sent to the ICC and tried for war crimes. Some of them would be exonerated for being too stupid/brainwashed to understand that they were committing criminal acts. Others wouldn't. However, those who develop the NSO spyware are middle class Israeli citizens who easily could get a well-paying job at a less repugnant company. There are no exte…

I don't know- I imagine deserting your brothers in arms (which may include your literal brother or sister) would be akin to deserting your family in a deadly situation. Regardless of how stupid the causes, once you're in the shit and people are at risk that you care about, the reasons you're there probably arent your biggest concern. The people that should be held accountable are the ones who orchestrated and perpetuated the whole thing, not the soldiers (unless they commit war crimes obviously).

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#690

Post by abwizz »

fweimer wrote: post #656
caisah wrote: post #577

Earlier quoted context omitted.

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's…

idk seems to me that what you wish for is already here.

os-vendors are predominiantly us-american and the rest of the world has to get their lawful interception on the free market, no?

Post reply on HN