Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

801–810 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#801

Post by hot_gril »

aihkas wrote: post #606
vxNsr wrote: post #490

Earlier quoted context omitted.

It’s truly shocking how misinformed you are about foreign policy. Israel attempted to maintain some level of neutrality wrt Russia bec when they show preferences, Russia punishes the local Jewish population… which they promptly did as soon as Israel showed any support for Ukraine. Israel shares a ton of intel with the US regarding many of the local terrorist organizations in the ME. Not to mention they’re flying sort…

Are you an NSO psychopath or something?! Those funny propaganda jokes you're spewing are not working. The Israeli Hasbara lies are so bad and funny (Oh we won the land instead of we are scumy occupiers and land thieves haha.) This Israeli murder cult is sad and pathetic.

Not an appropriate comment for here.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#802

Post by hospitalJail »

quonn wrote: post #574
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

— The tech we're all so convinced will "make the world a better place." — That was true 15 years ago … I don‘t hear this often anymore.

The cost of living is absurdly low. I do believe tech made it possible.

The only concern I have is greed from landlords and medical practitioners.

The cost of resources has plummeted, the cost of scarce things (land and medical licenses) continue to go up.

(Although limited medical licensees is a US corruption thing, its not inherent)

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#803

Post by hot_gril »

vxNsr wrote: post #800
hot_gril wrote: post #755

Earlier quoted context omitted.

> And Israel’s absence from that symbolic list was likely a precondition to get many of those Arab and African nations on the list. Israel has ISIS locally so there’s no doubt they’re fighting isis. Israel has never fought in any battle involving ISIS or carried out any smaller strikes against them. Some others who aren't in the coalition, like Russia, have. https://en.wikipedia.org/wiki/List_of_wars_and_battles_invo…

> Even if there's significant ISIS presence in Israel (which I've never heard of), it hasn't convinced them to help fight ISIS next door. Their stance is neutral, and they don't pretend otherwise. this is simply false. They help a ton and as I've said they've directly attacked them both within Israel's 1919 borders and assisted with attacks elsewhere in the region. > I didn't say there was no reason, because obviousl…

And yet you can't point to any evidence of Israel actually fighting ISIS, just your word...

> who will be discriminated against due to their religion (much like you are doing right now)

... and supposedly I'm a bigot if I show you otherwise. Not cool, I'm done here.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#804

Post by [deleted] »

rnk wrote: post #779
goodluckchuck wrote: post #696

Earlier quoted context omitted.

Depending on the circumstances, absolutely. Assuming that serious unjustified injury or death would occur if they failed to act, there should be some legal window in which they’re allowed to prevent the harm. Private companies (and individuals) should not be required to stand by helplessly while people are hurt. Indeed, legally, private individuals and companies are allowed to act in emergencies. For example, I gener…

This is obviously a bad idea, private companies or individuals having the power to arrest people because they want to? Look at the recent few years of history in the US where multiple experienced and distinguished (at least by resume), members of the us govt, senators, reps, tried to subvert an elections, dozens of lawyers told them it was illegal, we have their email and texts telling them. That group still acted to…

[deleted]

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#805

Post by brigade »

alkonaut wrote: post #799
brigade wrote: post #798

Earlier quoted context omitted.

Yes parsers are already sandboxed, and violating the sandbox boundary is where the actual valuable exploit is. Parser vulns are near worthless without the rest of the chain building on it, and the millions of man-years it would take to re-write every last one of them as "provably correct" is better spent hardening sandbox and privilege boundaries. Which is a completely different problem than simply rewriting things i…

What is the cause of the sandbox escape in this case? Somewhere (too high in the stack) there is a C-ish program where someone does pointer arithmetic or an array deref in C which is the same thing.

Are you asking what the full exploit chain is here specifically? Because that obviously hasn't been written up yet.

But for the last one, it's the difference between https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... (parser vulnerability leading to not-really arbitrary code execution and memory corruption) and https://googleprojectzero.blogspot.com/2022/03/forcedentry-s... (logic errors leading to a sandbox escape) Notably, the sandbox escape itself did not do anything that would have been prevented by a memory safe language.

The security model of a sandboxed process is that even full arbitrary code execution cannot do anything the sandbox says the process cannot do, and the process the parsers run in is sandboxed to only be able to communicate to other processes through very limited interfaces that have no access to network or disk.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#806

Post by jbverschoor »

udev wrote: post #457
nssexpression wrote: post #452

Earlier quoted context omitted.

This was likely in a codebase that has been fuzzed extremely heavily. There are a lot of bugs that fuzzing cannot possibly reach. I'm guessing NSO group has a lot of talented vulnerability researchers who do code auditing. Companies need to invest in hiring and training these individuals and paying them what they are deserve. Throwing fuzzers at things and calling them secure is part of the problem.

What code auditing? Are you claiming NSO has access to iMessage and iOS source code? NSO seems to be finding more and more bugs by poking a black-box alone, while Apple cannot seem to be able to fix by looking at the source code with all the fuzzing and verification tools, and much more $$$ at their disposal.

Only requires one corrupt dev

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#807

Post by jbverschoor »

goffer wrote: post #103
pseudo0 wrote: post #23

Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.

China not worried about 0-clicks on Apple. They are worried about US-Apple collusion with iOS software.

I think they're more concerned that Apple is moving parts of manufacturing out of China.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#808

Post by highwaylights »

_cenw wrote: post #514
highwaylights wrote: post #483

Earlier quoted context omitted.

I don’t believe this is true. You can change your iCloud password at any time, which means they definitely are not encrypting your iCloud data based on that key or a derivative. If I had to guess, they generate a key and encrypt that key with your password so it can be changed but they also aren’t able to produce it on request. The drawback here is that the encryption key for your data never changes, even if you chan…

The keys in advanced protection are derived from your device passcodes, your macOS user password and a recovery key. You'll notice you have to approve from one of your devices to use iCloud web or add a new device. The deviation function takes a while to run and depends on the secure enclave, but you still probably want to avoid 4-digit passcodes.

They are, but they also must be encrypted n separate times where n is the number of signed in devices.

Mac iPad iPhone Recovery Key

Each of the above would have a separate uniquely encrypted device backup key as a result of the derivation function. I can change the password on any of those (or regenerate the recovery key) without a full iCloud re-encryption or duplication of my iCloud data - therefore Apple must be holding a key in escrow that is the actual decryption key. One would assume it's that key that is encrypted against the derivation function, as then it could still be credibly argued as end-to-end, but that's just an assumption I'm making.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#809

Post by hiatus »

hbt wrote: post #771
bdhe wrote: post #767

Earlier quoted context omitted.

To compare US elections to Russian or Syrian elections is both incredibly naive and dangerous. In one country, you have a leading political opponent having stolen classified docs treated with kid gloves; in the other, you have political opponents poisoned and literally blown out of the sky.

or you know, publicly shot in the head for standing up against the deep state and keep delaying the release of secret files even after 50 years.

Who are you referring to?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#810

Post by rollcat »

nicce wrote: post #632
rollcat wrote: post #616

Earlier quoted context omitted.

What's the point? It'll get feedback and get better at dressing up the noise.

Do we want to encourage the use of LLMs in discussion? Soon there will be just LLMs...

> Do we want to encourage the use of LLMs in discussion?

Quite the opposite, but I think we need a better strategy. Downvoting a single offending comment is giving the spammer precise feedback on what worked and what didn't. Bot accounts should just be banned.

Post reply on HN