Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-days exploited by commercial surveillance vendor in Egypt

blog.google

Post reply on HN
Print view View original

21–30 of 254 posts

Re: 0-days exploited by commercial surveillance vendor in Egypt

#21

Post by alephnerd »

Veserv wrote: post #3

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration att…

> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers

Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA levels (EAL4+) for Common Criteria. You just gotta pay more and purchase via the relevant Systems Integrators.

A consumer product line like the Apple iPhone isn't targeting DoD buyers. That's always been Blackberry Ltd's bread and butter

Re: 0-days exploited by commercial surveillance vendor in Egypt

#24

Post by jefftk »

pipo234 wrote: post #16
hedora wrote: post #10

Though HTTPS is better than nothing, and this attack relies on HTTP to inject the initial payload, state sponsored attackers in some countries can likely just subvert CA or CDN infrastructure instead.

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

> certified by our beloved LetsEncrypt

Are you saying that CAs should be refusing to issue certs for potentially spoofed domains?

Re: 0-days exploited by commercial surveillance vendor in Egypt

#25

Post by Veserv »

alephnerd wrote: post #21
Veserv wrote: post #3

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration att…

> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA…

I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level.

None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in products that failed a EAL5 certification without a total rewrite. It used to say that in the standard somewhere, but the standard revisions have moved it so I can not quote it directly.

[1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20

Re: 0-days exploited by commercial surveillance vendor in Egypt

#26

Post by insanitybit »

Macha wrote: post #12
waihtis wrote: post #9

Earlier quoted context omitted.

Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?

There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…

There's also SELinux on Android.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#27

Post by alephnerd »

Veserv wrote: post #25
alephnerd wrote: post #21

Earlier quoted context omitted.

> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA…

I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in prod…

Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification.

Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4.

Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside).

Least Priviliged Access, Entitelement Management, Identity Enforcement, etc are all much easier wins and concepts that haven't been tackled yet.

Companies will provide EAL5+ if the opportunity is large enough, but it won't be publicized. Iykyk. If not, chat with your SI.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#28

Post by insanitybit »

pipo234 wrote: post #16
hedora wrote: post #10

Though HTTPS is better than nothing, and this attack relies on HTTP to inject the initial payload, state sponsored attackers in some countries can likely just subvert CA or CDN infrastructure instead.

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

Huge difference between being tricked into clicking a link vs just browsing the web and getting owned.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#29

Post by alephnerd »

vuln wrote: post #17
Veserv wrote: post #3

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration att…

Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?

You as a private consumer wouldn't be able to buy one of these EAL4+ products without a relationship with a defense and security oriented reseller.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#30

Post by d3w4s9 »

AtNightWeCode wrote: post #22

I don't get it. If it is over http then you can play around with anything in a proxy. You have no TLS tunnel so it is not encrypted. It is by design.

Yes it is not encrypted and the response returned from server can be modified to anything and ask for password etc, but that is far from an exploit that runs native code.
Post reply on HN