Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

781–790 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#781

Post by monkpit »

This kind of thing always confuses me. How can anyone assume any machine is NOT compromised already… Like… ever?

You really have no way of knowing that a box is not owned as soon as it has connectivity (and possibly even before that).

I feel like many people have the idea that security is “these machines are good until we detect some intrusion”.

But it seems like the more sane default is “every machine is compromised and I should never trust anything ever” if you take security seriously.

Maybe the latter is gaining popularity, but I still feel like the former ideology is pretty prominent.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#782

Post by Hackbraten »

Dylan16807 wrote: post #775
saagarjha wrote: post #773

Earlier quoted context omitted.

Code to calculate size of preallocated array is incorrect. Size ends up too small or underflows. Buffer is reused across calls. Buffer is actually mapped across processes and thus page-aligned. Code to check how much space is needed checks number of pages versus actual number of bytes, and fails to clear leftover data correctly. Code receives RGBA buffer but expects some other encoding. Accidentally reads out of boun…

> Code to calculate size of preallocated array is incorrect. Size ends up too small or underflows. If you go outside the array you copied/mapped out of the sandbox, then that doesn't let the attacker code escape the sandbox, you just put some of your own data onto the screen. If you mean the sandbox isn't given enough memory, then that will make the sandbox exit when it hits unmapped addresses. And how did you screw…

> And how did you screw up length x width x 4?

There’s a million ways to screw that up. People botch SCM merges. People are hungover. People are distracted. People are tired. People are heartbroken. People are going through divorces. People have parents dying. People forget numbers. People make copy-paste mistakes. All the time.

> The sandboxed process doesn't have any way to exfiltrate data.

You can abuse it to gain a (known-page-offset) write primitive in the other, non-sandboxed process to which the buffer is also mapped.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#783

Post by hospitalJail »

monkpit wrote: post #781

This kind of thing always confuses me. How can anyone assume any machine is NOT compromised already… Like… ever? You really have no way of knowing that a box is not owned as soon as it has connectivity (and possibly even before that). I feel like many people have the idea that security is “these machines are good until we detect some intrusion”. But it seems like the more sane default is “every machine is compromised…

> “every machine is compromised and I should never trust anything ever”

This is where I am already at.

However, you can't totally live like this in 2023. You need to take some risks.

I just can't believe how bad iPhone security is STILL. Capitalism prioritizes profits over all, it seems Apple has no problem cutting on security and spending on marketing the word "SECURITY" with black text and a white background.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#784

Post by ghughes »

londons_explore wrote: post #171

How many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.

Then they'll exploit the webview followed by the sandbox. [1]

As of iOS 14, incoming messages are parsed in a tight sandbox [2]. It'll be interesting to hear how this attack got around that.

[1] https://en.wikipedia.org/wiki/JailbreakMe

[2] https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#785

Post by doktrin »

nebula8804 wrote: post #666
doktrin wrote: post #665

Earlier quoted context omitted.

You seem to be implying the issue is the messenger and his dimwitted minions, when really it's the message itself. If these guys are as nefarious as you're implying, surely the richest man on the planet could dig up something that's not prima facie absurd?

There has been plenty of material to reference but all those topics do not benefit space karen so he does not bring them up. [1]: https://en.wikipedia.org/wiki/Anti-Defamation_League#Recepti...

Thanks for clarifying. I'm not familiar enough with this organization to either stake a position for or against, but one passing observation based on that wiki page :

> Right-wing groups and pundits, including right-wing Jewish groups, have criticized ADL as having moved too far to the left under Jonathan Greenblatt, labeling it a "Democratic Party auxiliary"

> In August 2020, a coalition of progressive organizations launched the "Drop the ADL" campaign, arguing that "the ADL is not an ally" in social justice work. The campaign consisted of an open letter and a website, which were shared on social media with the hashtag "#DropTheADL". Notable signatories included the Democratic Socialists of America, Movement for Black Lives, Jewish Voice for Peace, Center for Constitutional Rights, and Council on American–Islamic Relations.[179] The open letter stated that the ADL "has a history and ongoing pattern of attacking social justice movements led by communities of color, queer people, immigrants, Muslims, Arabs, and other marginalized groups, while aligning itself with police, right-wing leaders, and perpetrators of state violence.

Always interesting to see entities criticized for being both too far left and too far right.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#787

Post by Obscurity4340 »

nequo wrote: post #499
Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

> Everyone should use it because it disables a lot of nonsense that doesn't serve you and probably even saves battery power. Lockdown mode acts as a natural ad block which is great (as a reader). But it also disables JIT. I assume this causes wasted CPU cycles and perhaps, on balance, worse battery life?

On the balance, I have found the opposite to my experience. Your phone spends more time passively carrying out a multitude of background tasks and analystics stuff then it does with you actively web browsing.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#789

Post by beebeepka »

comprev wrote: post #708
megous wrote: post #651

Earlier quoted context omitted.

Elections != democaracy. In Russia, there are also elections. So are they in Syria, and so on.

Sometimes known as "Model-T election" "Any customer can have a car painted any color that he wants so long as it is black."

Under capitalism man exploits man. Under socialism it's just the opposite.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#790

Post by dogman144 »

forcedmaddie wrote: post #788

I worked for NSO and later at a very similar company in Barcelona. AMA

Why did you leave?

How capable are the hackers vs solid engineers working on a basket of known threat models + some additional R&D as the platforms change?

What is the next iteration of these types of companies?

Post reply on HN