Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-days exploited by commercial surveillance vendor in Egypt

blog.google

Post reply on HN
Print view View original

111–120 of 254 posts

Re: 0-days exploited by commercial surveillance vendor in Egypt

#111

Post by Veserv »

insanitybit wrote: post #102
Veserv wrote: post #90

Earlier quoted context omitted.

EAL4+ is useless against the prevailing threat actors as can be seen time and time again. There is no point at aiming for inadequate; even if you get there you still get nothing. EAL6-7 certifications are basically the only known, existing certifications that have any evidence supporting that they are adequate to defend against the known and expected threats. As far as I am aware, there are no other certifications ev…

I feel like you're arguing that these certifications are useless and uncorrelated with security but then you're trying to say that Apple and others are bad for not having them.

Low certification levels certify low levels of security. High certification levels certify high levels of security.

EAL4 is known to be too low against modern threats that will attack commercial users. We know this from experience where EAL4 systems are routinely defeated. Higher certification levels, such as the SKPP at EAL6/7, are known to be able to resist against much harder threats such as state actors like the NSA (defeating a NSA penetration test was a explicit requirement tested in the SKPP by the NSA themselves).

Low certification levels, like EAL4 and lower, that are the limit of the abilities of companies such as Apple and Microsoft are known to be useless against commercial threats. They are uncorrelated with protection against commercial threats because they are inadequate in much the same way that having a piece of paper in front of you is uncorrelated with surviving a gunshot. Systems that can only be certified to EAL4 and lower are certifiably useless.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#112

Post by tholdem »

kramerger wrote: post #89
throwaway38475 wrote: post #84

Earlier quoted context omitted.

They all do that. I've been in Offensive Security for 10+ years with several spent at FAANGS, and not only do they all have large security teams doing internal testing, they hire multiple contractors like Trail-of-Bits to audit every important service continuously throughout the year. Apple has way more than 10 full time researchers looking at iOS all day, trust me :). They also have a really generous bug bounty. The…

> Apple has way more than 10 full time researchers looking at iOS all day. Yes > They also have a really generous bug bounty. Hell no

Agree. Not long ago, Apple used to sue people reporting vulnerabilities to them. Imagine punishing people doing free work for you. Not a good look.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#113

Post by kramerger »

Veserv wrote: post #90
kramerger wrote: post #55

Earlier quoted context omitted.

EAL5 is mainly about having a semi- formal description and for 6-7 you also need formal verification. Outside some very limited cases, we don't have the tools to go there yet. EAL4+ is what people should aim for.

EAL4+ is useless against the prevailing threat actors as can be seen time and time again. There is no point at aiming for inadequate; even if you get there you still get nothing. EAL6-7 certifications are basically the only known, existing certifications that have any evidence supporting that they are adequate to defend against the known and expected threats. As far as I am aware, there are no other certifications ev…

> EAL4+ is useless against the prevailing threat actors

Hold on a second. Assurance level is about, well, level of assurance the developers can provide. It is in most cases just paperwork.

CC has a different mechanism to define attacker capability & resources (cant recall what it's called) and set the security goals accordingly

Re: 0-days exploited by commercial surveillance vendor in Egypt

#114

Post by Veserv »

manuelabeledo wrote: post #108
Veserv wrote: post #103

Earlier quoted context omitted.

Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack potential". You are complaining that the 40 cm high jump test does not score actual jumping ability. You are right, it is a low bar that they should all be able to pass. You can not use the 40 cm high…

I'm not really complaining, though. I'm just saying that security certifications are more about compliance than actual proof that a system cannot be easily compromised. In other words, they are more about legal requirements than guarantees. It is also misleading to assert that a device or a system are less secure because they haven't been certified. Vendors submit requests to validate against specific levels or certi…

They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it.

I am judging them by their maximum ability ever demonstrated under the most favorable circumstances and they still can certify resistance against moderate attackers. They have never developed systems that can protect against the prevailing threat landscape and they can not develop such systems. Their best is not good enough.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#115

Post by alephnerd »

KoftaBob wrote: post #40
alephnerd wrote: post #8

Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-me...

Probably part of the long running (now peaceful) rivalry they have with Israel.

Yep! Totally forgot about that!

Re: 0-days exploited by commercial surveillance vendor in Egypt

#116

Post by 77pt77 »

tholdem wrote: post #112
kramerger wrote: post #89

Earlier quoted context omitted.

> Apple has way more than 10 full time researchers looking at iOS all day. Yes > They also have a really generous bug bounty. Hell no

Agree. Not long ago, Apple used to sue people reporting vulnerabilities to them. Imagine punishing people doing free work for you. Not a good look.

Getting punished is the default.

If you refer come across anything, keep your mouth shut.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#117

Post by WarOnPrivacy »

calgarymicro wrote: post #75
WarOnPrivacy wrote: post #41

Earlier quoted context omitted.

> Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military At a federal level law/power is continually traded for cash/favors. Heck, DoJ itself gets deployed in response to lobbyist demands (eg:copyright enforcement). From what I see this case was egregious and involved a non-favored foreign state. Maybe that's the bar at which DoJ begins to care about political ethics…

> involved a non-favored foreign state Egypt is not 'non-favored'. The US has very close ties with Egypt's dictatorial regime[0], despite its awful domestic human rights record[1]. [0] https://thehill.com/blogs/congress-blog/foreign-policy/58552... [1] https://www.amnesty.org/en/latest/news/2022/09/egypt-human-r...

> Egypt is not 'non-favored'.

The WTO sets the MFN list and Egypt isn't on it so strictly speaking you aren't correct.

Besides incurring WTO favor, the US also bestows it's own preferential treatments to those same nations. Egypt has long received many of those preferences so you're right in the ways that are most relevant.

That said, I wouldn't place Egypt on US's BFFs! Top partners in crime list - the one that includes 5/8 eyes nations and Israel.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#118

Post by boothemoo »

This vulnerability was most probably used by the Egyptian authorities to hack the mobile phone of the presidential candidate Ahmed El Tantawy who is competing with the current president Abdel Fatah El Sisi over presidency.

https://x.com/jsrailton/status/1705271600868692416?s=46&t=Kq...

Re: 0-days exploited by commercial surveillance vendor in Egypt

#119

Post by roblabla »

codedokode wrote: post #100
Macha wrote: post #12

Earlier quoted context omitted.

There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…

But browsers, especially Chrome, have lots of permissions (including geolocation, accessing SD card, accessing user's personal data, camera and microphone etc.). You don't need to do anything if you can run under browser's privileges.

None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#120

Post by crtified »

toasterblender wrote: post #54

Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?

It's a good idea, but in some ways, akin to the challenge that would be presented by attempting a similar-veined "why doesn't the world's richest country just hire all the world's best military generals, leaving zero for any other country?".

The reasons why it's not possible are myriad, but boil down to the fact that the world and humanity are very big things, and one entity can't possibly get them all, or even most of them. There's too much diverse heterogenuity built into everything. Including many worldviews and loyalties that go beyond money.

Post reply on HN