0-days exploited by commercial surveillance vendor in Egypt • Hacker News Board

Re: 0-days exploited by commercial surveillance vendor in Egypt

#41

Post by WarOnPrivacy » Fri, Sep 22, 2023, 7:43 PM UTC

alephnerd wrote: post #8

Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-me...

> Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military

At a federal level law/power is continually traded for cash/favors. Heck, DoJ itself gets deployed in response to lobbyist demands (eg:copyright enforcement).

From what I see this case was egregious and involved a non-favored foreign state. Maybe that's the bar at which DoJ begins to care about political ethics.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#42

Post by tester756 » Fri, Sep 22, 2023, 7:43 PM UTC

Macha wrote: post #12

waihtis wrote: post #9

Earlier quoted context omitted.

Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?

There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…

that sounds like terrible joke

sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox

and stuff still manages to escape

Re: 0-days exploited by commercial surveillance vendor in Egypt

#43

Post by xcdzvyn » Fri, Sep 22, 2023, 7:43 PM UTC

pipo234 wrote: post #37

jefftk wrote: post #24

Earlier quoted context omitted.

> certified by our beloved LetsEncrypt Are you saying that CAs should be refusing to issue certs for potentially spoofed domains?

...or Digicert, Globalsign, the Hongkong post office, whichever CA is in your truststore. I just mentioned LetsEncrypt because it's free and exceptionally easy to use. I'm not implying in any way they aren't providing a great service, it's just that that service also gets misused because it's cheap and easy.

It really sounds that way, FYI. I interpreted it as a dig at LetsEncrypt in particular.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#44

Post by vngzs » Fri, Sep 22, 2023, 7:44 PM UTC

glaucon wrote: post #34

pipo234 wrote: post #16

Earlier quoted context omitted.

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

I'm interested at your suggestion that Digicert et al are doing some sort of "keeping the streets safe" checking. I have zero experience of using them but I thought all they were doing was confirming the applicant represented some entity that matched the domain name. If I manage to get a company registered called G00gle, buy a corresponding domain and then send them my $500 are you suggesting they're going to refuse…

I don't see GP claiming CAs should be checking reputability for domain issuance certificates. But the thread originator mentioned subverting CAs! Something to remember about even the most advanced attackers is that they value the continued effectiveness of their tactics, tools and procedures. Even nation-states in possession of CA subversion abilities won't burn their malicious CA on someone if they can conduct the attack with a legitimately-issued certificate, and they won't bother with a legitimately-issued cert if they can conduct the attack without even involving a CA.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#45

Post by rany_ » Fri, Sep 22, 2023, 7:44 PM UTC

rany_ wrote: post #39

cotillion wrote: post #11

Ouch. Apparently Firefox has "Https First" also but requires the pref dom.security.https_first to be set. "HTTPS-Only Mode" is obviously best if you can do that.

You'd still need to resist the urge to not press "allow me anyway" and to be honest, even I'd click it knowing the risk (I just want to visit the damn site!). This doesn't solve anything unless the prompt is extremely suspicious (like the prompt showing for Google.com or some other site I know supports HTTPS).

Replying to myself but also, they could easily trick you into clicking some link and exploiting you that way. HTTP isn't the issue here, it's just being exploited so they don't have to get you to click some link.

In all likelihood they'd do that if the less direct/obvious method of transmission didn't work.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#46

Post by [deleted] » Fri, Sep 22, 2023, 7:45 PM UTC

glaucon wrote: post #34

pipo234 wrote: post #16

Earlier quoted context omitted.

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

I'm interested at your suggestion that Digicert et al are doing some sort of "keeping the streets safe" checking. I have zero experience of using them but I thought all they were doing was confirming the applicant represented some entity that matched the domain name. If I manage to get a company registered called G00gle, buy a corresponding domain and then send them my $500 are you suggesting they're going to refuse…

[deleted]

Re: 0-days exploited by commercial surveillance vendor in Egypt

#47

Post by Veserv » Fri, Sep 22, 2023, 7:47 PM UTC

alephnerd wrote: post #27

Veserv wrote: post #25

Earlier quoted context omitted.

I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in prod…

Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification. Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4. Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside). Least Priviliged Access, Enti…

No. The US government briefly had procurement requirements for high security deployments.

They were forced to relax them because Microsoft could not make bids that met the minimum requirements for DoD and high security projects and that made their Senators mad. They relaxed them to EAL4+ because that was the most that Microsoft could do.

They since relaxed them further to EAL2 because that is all the most large AV and cybersecurity appliance vendors could achieve. They justified it under the "swiss cheese" model where if you stack multiple EAL2 then you get EAL4 overall, which is insane. The government has since relaxed them even further since none of the companies want to do any certification since none of them can achieve a decisive edge over the others that they can write into the requirements thus disqualifying their competition, so certification is just a zero-sum game.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#48

Post by pipo234 » Fri, Sep 22, 2023, 7:53 PM UTC

glaucon wrote: post #34

pipo234 wrote: post #16

Earlier quoted context omitted.

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

I'm interested at your suggestion that Digicert et al are doing some sort of "keeping the streets safe" checking. I have zero experience of using them but I thought all they were doing was confirming the applicant represented some entity that matched the domain name. If I manage to get a company registered called G00gle, buy a corresponding domain and then send them my $500 are you suggesting they're going to refuse…

You are absolutely right, that (for plain, domain attestation) paid CAs are exactly as trustworthy as LetsEncrypt, and often much less (remember the Diginotar debacle, for example). "Keeping the streets safe" is not their responsibility, except in a very limited sense. The $500 extended validation was mostly paper work and snake oil.

My point wasn't to discredit LetsEncrypt, but to point out that Google's claim to mitigate the MITM attack vector with https-first wasn't a very strong argument. I mean, yes, sure: if you can't intercept or downgrade to HTTP the MITM doesn't work. But all the HTTP seems to do was redirect to a malicious payload. But you can also do a redirect in HTTPS.

So if you can spoof someone to go to https://g00gle.com/ it should be just as easy to launch the attack chain from there.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#49

Post by pipo234 » Fri, Sep 22, 2023, 7:54 PM UTC

xcdzvyn wrote: post #43

pipo234 wrote: post #37

Earlier quoted context omitted.

...or Digicert, Globalsign, the Hongkong post office, whichever CA is in your truststore. I just mentioned LetsEncrypt because it's free and exceptionally easy to use. I'm not implying in any way they aren't providing a great service, it's just that that service also gets misused because it's cheap and easy.

It really sounds that way, FYI. I interpreted it as a dig at LetsEncrypt in particular.

Please accept my apologies :-)

Re: 0-days exploited by commercial surveillance vendor in Egypt

#50

Post by kramerger » Fri, Sep 22, 2023, 7:54 PM UTC

Veserv wrote: post #3

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration att…

Isn't EAL1 what you get for just showing up?

Basically, here is the product. Here are some design documents. We don't have anything more. Can we get our EAL1 please?