Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-days exploited by commercial surveillance vendor in Egypt

blog.google

Post reply on HN
Print view View original

181–190 of 254 posts

Re: 0-days exploited by commercial surveillance vendor in Egypt

#181

Post by manonthewall »

OneLessThing wrote: post #134
toasterblender wrote: post #54

Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?

I am this person. I work as a researcher finding 0-days. From the employee perspective: Wages are equal. Big Tech work is less interesting (build big bug finding machines that find have high quantity of bugs) and report the bugs that sit into some bug tracker only to maybe be fixed in 3 months. Offensive security work is more interesting. It requires intimate knowledge of the systems you research, since you only need…

[dead]

Re: 0-days exploited by commercial surveillance vendor in Egypt

#182

Post by kadoban »

astrange wrote: post #175
kadoban wrote: post #169

Earlier quoted context omitted.

What browsers actually do that? And do all CAs support it? Besides, if you have enough access to the CA, you can just get whatever cert is in the transparency log, though that's almost certainly harder for most nations and CAs.

> What browsers actually do that? Chrome, Safari, Firefox. > And do all CAs support it? Yes, the browsers made them. > Besides, if you have enough access to the CA, you can just get whatever cert is in the transparency log No, the CA doesn't have the private key of certs.

That's great! I guess my knowledge is out of date, happy to be wrong about that.

> No, the CA doesn't have the private key of certs.

Woops, yeah good point.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#183

Post by djbusby »

roblabla wrote: post #119
codedokode wrote: post #100

Earlier quoted context omitted.

But browsers, especially Chrome, have lots of permissions (including geolocation, accessing SD card, accessing user's personal data, camera and microphone etc.). You don't need to do anything if you can run under browser's privileges.

None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.

Above says access to SD card. I think that means write ability. Which means persistence.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#184

Post by djbusby »

tester756 wrote: post #42
Macha wrote: post #12

Earlier quoted context omitted.

There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…

that sounds like terrible joke sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox and stuff still manages to escape

The Buffalo buffalo buffalo... thing

https://en.m.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buff...

Re: 0-days exploited by commercial surveillance vendor in Egypt

#185

Post by Tijdreiziger »

nerdbert wrote: post #170
malaya_zemlya wrote: post #162

Earlier quoted context omitted.

As far as I can tell, the verification that DigiCert performs is 1. the company exists in various Business listings 2. the phone number listed in whois has a human behind it and the human confirms the phone number belogs to the company. Source: Have to be that human from time to time

Only if you pay $$$$ for OV/EV. If you get the normal DV cert they don't provide any more verification than Letsencrypt. And since browsers have moved away from indicating OV/EV certs to end users, not many organizations are paying for those anymore.

Can confirm as someone who has to renew a non-Let’s Encrypt cert every year (for reasons). The CA sends an automated email to the email address listed in WHOIS, you click a link in the email, and they issue the certificate. No human interaction necessary.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#186

Post by astrange »

djbusby wrote: post #183
roblabla wrote: post #119

Earlier quoted context omitted.

None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.

Above says access to SD card. I think that means write ability. Which means persistence.

Persistence means you can write to something that'll cause your malware to run again after reboot, but external storage isn't enough to do that without another exploit in the boot path, right?

Re: 0-days exploited by commercial surveillance vendor in Egypt

#187

Post by Veserv »

tptacek wrote: post #179
Veserv wrote: post #177

Earlier quoted context omitted.

Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?

The archetypical EAL5 product is a smartcard or cryptographic coprocessor (same thing, different package). They're certifiable because they don't do much. But if you'd like an example from the EAL4 list: start with FortiOS.

EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect against “casual and inadvertent attacks”.

The general crappiness of EAL4 goes all the way back to the Orange Book where EAL4 maps approximately to Level C2 (contemporaneous projects got certified to those levels simultaneously). That level was intentionally meant for toys before they put on their big person pants and release a grown up product with actual security [1]. It is a mystery why anybody thinks EAL4 and security belong in the same sentence.

[1] https://www.stevelipner.org/links/resources/The%20Birth%20an...

Re: 0-days exploited by commercial surveillance vendor in Egypt

#188

Post by astrange »

toasterblender wrote: post #87
hattmall wrote: post #80

Earlier quoted context omitted.

It's a small group but a wide pool. It's not like the same person finds 10 0days. And until they do find their one exploit most of them have pretty much no credentials at all. So how do you avoid hiring 10,000 up and comers that never actually come up?

The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.

If you inject a lot of money into the industry I think it'll result in more people learning how to do it.

Though, the reason governments found the best exploits for the longest time wasn't by hiring geniuses, but by giving people long periods of time and freedom to do kinds of research nobody else was motivated to do.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#189

Post by [deleted] »

reqo wrote: post #92
FirmwareBurner wrote: post #88

Earlier quoted context omitted.

This. IIRC some famous security researcher responsible for iOS jail-breaks was poached by Apple only to leave after 3 months. Successful and skilled security people with a proven track record, don't have the paciente of putting up with the charade such large orgs require.

George Hotz

[deleted]

Re: 0-days exploited by commercial surveillance vendor in Egypt

#190

Post by corbezzoli »

oefrha wrote: post #168
kadoban wrote: post #158

Earlier quoted context omitted.

If you're a nation you can just force the CAs that are in your jurisdiction to do whatever you want, or sneak in in various ways so they won't know. If you use the MITM judiciously, it's very likely that nobody will notice, or that those that notice can be compelled not to say anything.

CT means a CA can’t do whatever they want. Your comment is handwavy, do you have any details on the “various ways” you’re talking about?

I think it’s true that they can do “whatever they want”, but only once, because they’ll lose the right once found. The issue is the time between breach and punishment.
Post reply on HN