Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

791–800 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#791

Post by ghughes »

alkonaut wrote: post #619
londons_explore wrote: post #171

How many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.

Yeah I can't believe we are still seeing this happen over and over again. Whenever you see "zero click" you know it's one of the complex payloads like images, fonts. The answer shouldn't be "don't render images". We should be able to trust that a component that parses external data such as an image, simply can't do anything malicious regardless of input. If that means sandboxing, fine. If it means having to rewrite a…

Rewriting would introduce new bugs; it would take a large number of engineering hours away from delivering shiny new things; and a formally correct version would probably be less power-efficient.

It won't happen because these targeted attacks don't affect the bottom line whatsoever. Nobody is switching to Android just because a journalist or NGO employee occasionally gets pwned.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#792

Post by beebeepka »

skissane wrote: post #693
rmbyrro wrote: post #654

Earlier quoted context omitted.

It gives me the impression that you find "the tech community" to be a cohesive collective that has the organization to switch gears in a given direction. I wonder why you expect it to be like that. In reality, "the tech community" is extremely diverse and not cohesive at all. For one example, a large proportion of developers are barely making enough money to pay their most basic bills. They don't have enough mental s…

> In reality, "the tech community" is extremely diverse and not cohesive at all. I really dislike this phrasing "the X community" which seems to be so popular nowadays. Lumping together many millions of people worldwide who have a single thing in common–how did people end up using the word "community" to describe that?

Every time I see "the intelligence community" I just know I am reading propaganda

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#793

Post by easterncalculus »

kmeisthax wrote: post #709
fweimer wrote: post #656

Earlier quoted context omitted.

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's…

The OS vendors refuse to implement lawful intercept capability because there is no such thing as a lawful intercept capability. There is only intercept capability for any purpose because ROM bootloaders and secure enclaves cannot vet the lawfulness of a request to subvert their owners. You can make a phone relatively secure against people trying to break into it, but only if it has unique access keys for the owner. I…

You can also 3D print the TSA master keys - here's the link https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#794

Post by forcedmaddie »

dogman144 wrote: post #790
forcedmaddie wrote: post #788

I worked for NSO and later at a very similar company in Barcelona. AMA

Why did you leave? How capable are the hackers vs solid engineers working on a basket of known threat models + some additional R&D as the platforms change? What is the next iteration of these types of companies?

I left for more money.

People who work there are amongst the most skilled hackers in the world. Security is very hard and that’s why even solid engineers fail a lot in tackling that. Especially because security is a cost center for vendors, while it’s a profit center for companies like NSO. So the resources invested are relatively more.

That said, Apple did an amazing job to improve security in the past years.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#795

Post by vxNsr »

aihkas wrote: post #606
vxNsr wrote: post #490

Earlier quoted context omitted.

It’s truly shocking how misinformed you are about foreign policy. Israel attempted to maintain some level of neutrality wrt Russia bec when they show preferences, Russia punishes the local Jewish population… which they promptly did as soon as Israel showed any support for Ukraine. Israel shares a ton of intel with the US regarding many of the local terrorist organizations in the ME. Not to mention they’re flying sort…

Are you an NSO psychopath or something?! Those funny propaganda jokes you're spewing are not working. The Israeli Hasbara lies are so bad and funny (Oh we won the land instead of we are scumy occupiers and land thieves haha.) This Israeli murder cult is sad and pathetic.

your bigotry doesn't do your argument any favors. of course there isn't really an argument here, just hate.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#796

Post by eviks »

UncleMeat wrote: post #700
eviks wrote: post #527

Earlier quoted context omitted.

But it's already been a while...

How long do you think it is reasonable to go from "we are now in agreement that rewriting stuff is the right call" to "all media processing code is written in a memory safe language"?

Why do you exclude the time to get to "we are now in agreement"??

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#797

Post by alkonaut »

ghughes wrote: post #791
alkonaut wrote: post #619

Earlier quoted context omitted.

Yeah I can't believe we are still seeing this happen over and over again. Whenever you see "zero click" you know it's one of the complex payloads like images, fonts. The answer shouldn't be "don't render images". We should be able to trust that a component that parses external data such as an image, simply can't do anything malicious regardless of input. If that means sandboxing, fine. If it means having to rewrite a…

Rewriting would introduce new bugs; it would take a large number of engineering hours away from delivering shiny new things; and a formally correct version would probably be less power-efficient. It won't happen because these targeted attacks don't affect the bottom line whatsoever. Nobody is switching to Android just because a journalist or NGO employee occasionally gets pwned.

It doesn’t really matter if there are 100 new bugs for every memory unsafety bug fixed. Those new bugs in an image codec would be hangs/crashes or incorrect rendering and that’s it. And that might be serious but it’s not a security vulnerability.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#798

Post by brigade »

alkonaut wrote: post #619
londons_explore wrote: post #171

How many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.

Yeah I can't believe we are still seeing this happen over and over again. Whenever you see "zero click" you know it's one of the complex payloads like images, fonts. The answer shouldn't be "don't render images". We should be able to trust that a component that parses external data such as an image, simply can't do anything malicious regardless of input. If that means sandboxing, fine. If it means having to rewrite a…

Yes parsers are already sandboxed, and violating the sandbox boundary is where the actual valuable exploit is. Parser vulns are near worthless without the rest of the chain building on it, and the millions of man-years it would take to re-write every last one of them as "provably correct" is better spent hardening sandbox and privilege boundaries.

Which is a completely different problem than simply rewriting things in a safe language.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#799

Post by alkonaut »

brigade wrote: post #798
alkonaut wrote: post #619

Earlier quoted context omitted.

Yeah I can't believe we are still seeing this happen over and over again. Whenever you see "zero click" you know it's one of the complex payloads like images, fonts. The answer shouldn't be "don't render images". We should be able to trust that a component that parses external data such as an image, simply can't do anything malicious regardless of input. If that means sandboxing, fine. If it means having to rewrite a…

Yes parsers are already sandboxed, and violating the sandbox boundary is where the actual valuable exploit is. Parser vulns are near worthless without the rest of the chain building on it, and the millions of man-years it would take to re-write every last one of them as "provably correct" is better spent hardening sandbox and privilege boundaries. Which is a completely different problem than simply rewriting things i…

What is the cause of the sandbox escape in this case? Somewhere (too high in the stack) there is a C-ish program where someone does pointer arithmetic or an array deref in C which is the same thing.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#800

Post by vxNsr »

hot_gril wrote: post #755
vxNsr wrote: post #490

Earlier quoted context omitted.

It’s truly shocking how misinformed you are about foreign policy. Israel attempted to maintain some level of neutrality wrt Russia bec when they show preferences, Russia punishes the local Jewish population… which they promptly did as soon as Israel showed any support for Ukraine. Israel shares a ton of intel with the US regarding many of the local terrorist organizations in the ME. Not to mention they’re flying sort…

> And Israel’s absence from that symbolic list was likely a precondition to get many of those Arab and African nations on the list. Israel has ISIS locally so there’s no doubt they’re fighting isis. Israel has never fought in any battle involving ISIS or carried out any smaller strikes against them. Some others who aren't in the coalition, like Russia, have. https://en.wikipedia.org/wiki/List_of_wars_and_battles_invo…

> Even if there's significant ISIS presence in Israel (which I've never heard of), it hasn't convinced them to help fight ISIS next door. Their stance is neutral, and they don't pretend otherwise.

this is simply false. They help a ton and as I've said they've directly attacked them both within Israel's 1919 borders and assisted with attacks elsewhere in the region.

> I didn't say there was no reason, because obviously there would be, including trade. They have been allowed to stay mostly neutral.

so then why bring it up? but again, trade had nothing to do with it, its to protect the innocent people who cannot leave russia and who will be discriminated against due to their religion (much like you are doing right now).

Post reply on HN