Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-days exploited by commercial surveillance vendor in Egypt

blog.google

Post reply on HN
Print view View original

231–240 of 254 posts

Re: 0-days exploited by commercial surveillance vendor in Egypt

#231

Post by KirillPanov »

callalex wrote: post #139
tetrep wrote: post #76

Earlier quoted context omitted.

I think this is similar to looking at the budget of the US government and asking why they don't simply pay off all the potential criminals such that most crime in the US is then mitigated.

That’s not equivalent at all. Paying off criminals creates an incentive for there to be more criminals. Paying more security researchers does not incentivize people writing buggy C code to write even buggier C code.

Your analogy is all messed up: paying off criminals doesn't make houses harder to break into.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#232

Post by KirillPanov »

shmatt wrote: post #7

Another company founded by ex-Israeli intelligence. The funny thing about exploits is, once hundreds of employees or soldiers have access to the exploit, they don't need to physically copy the code. They just need to understand how it works, to then open 10 other companies that use the same exploit, or sell it to 20 other companies on the dark web. Although the IDF is great at stopping people from copying files outsi…

One of these days people will wake up and realize that carrying a networked gps tracker with a microphone in their pocket is a really dumb idea.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#233

Post by __s »

oefrha wrote: post #168
kadoban wrote: post #158

Earlier quoted context omitted.

If you're a nation you can just force the CAs that are in your jurisdiction to do whatever you want, or sneak in in various ways so they won't know. If you use the MITM judiciously, it's very likely that nobody will notice, or that those that notice can be compelled not to say anything.

CT means a CA can’t do whatever they want. Your comment is handwavy, do you have any details on the “various ways” you’re talking about?

https://proton.me/blog/kazakhstan-internet-surveillance (apparently they rolled back pushing this, but this shows some "various ways")

Re: 0-days exploited by commercial surveillance vendor in Egypt

#234

Post by vinay_ys »

oefrha wrote: post #168
kadoban wrote: post #158

Earlier quoted context omitted.

If you're a nation you can just force the CAs that are in your jurisdiction to do whatever you want, or sneak in in various ways so they won't know. If you use the MITM judiciously, it's very likely that nobody will notice, or that those that notice can be compelled not to say anything.

CT means a CA can’t do whatever they want. Your comment is handwavy, do you have any details on the “various ways” you’re talking about?

Browsers only enforce that certs were logged to CT logs (because they will fail a TLS connection unless a certificate has valid SCTs attached to them). The actual domain owner will have to monitor the CT logs and call out when they notice a certificate being issued that they didn't request. Without that active monitoring of CT logs by the domain owner, it won't help.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#235

Post by Semaphor »

Macha wrote: post #165
nfriedly wrote: post #163

Earlier quoted context omitted.

There are millions of android devices out there that have been abandoned by their manufacturers, so they might be omitting those details because the flaw hasn't yet been patched (and likely never will be.)

Even with Google's own flagship device, the latest security patches date from August while this announcement is much newer, so it seems unlikely _any_ Android devices have been patched.

LineageOS on OnePlus Nord, last security update: September 5

Re: 0-days exploited by commercial surveillance vendor in Egypt

#236

Post by vinay_ys »

What these 0days teach us is that if you are a person in the crosshairs of powerful adversaries you have to be super-paranoid and reduce your target surface to as small as possible.

If you are James Bond and you want to have secure communications with M, you are better off using a custom appliance type mobile device meant only to do that one function and nothing else. You will have to rely on anonymous 3rd-party burner devices to leave messages encoded in pre-agreed sequence of rotating geo-locked codebooks on random message boards. Any less opsec and you are toast!

If you are a normal human-being using connected digital devices normally, then you should assume anything you put on those devices is already stolen. If you want to keep things truly private, keep it off digital (paper, old-school analog tape etc). Then, at least they will have to physically steal it from you – which, depending on the situation, might be much harder for them, but not necessarily much safer for you. So, you lose either way.

Only real way out is to have well-functioning democratic governments with strong transparency and checks and balances with strongly enforced privacy laws to protect its constituents from both domestic and foreign adversaries and strong support for initiatives like Citizen Labs.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#237

Post by tptacek »

pvg wrote: post #214
tptacek wrote: post #203

Earlier quoted context omitted.

This is like comparing the L4-based SEPOS to macOS. They share the name "operating system", but they are not the same thing.

I can't help but pick a couple of general points from area standards-arguer man. One is 'problems of standardization in high-development-velocity fields': https://news.ycombinator.com/item?id=3577837 The other is "this is worse in security engineering broadly and outright catastrophic in cryptography engineering specifically" https://news.ycombinator.com/item?id=25451351 There's probably better/longer, I just looked…

What'd I do here? You have me worried. Did I manage to back into an argument that standards processes are good? Really I'm just trying to say two things here:

* The Common Criteria process is a farce, and things that are secure by dint of being EAL5+ are really secure because they're so small you can almost prove them with formal methods (which is not to say that everything EAL5+ has usefully applied formal methods).

* The meaning of the word "operating system" is different when we're talking about EAL5+ stuff; seL4 is an "operating system" that has been proven secure with formal methods, and it is secure, but it's secure in large part because it does almost nothing; it isn't comparable to Windows, macOS, or Linux. You couldn't build an iPhone experience on top of it (you could --- and people do --- host Unix kernels on top of L4 OS's, but when you do that you keep many/most of the security issues of that Unix kernel).

Re: 0-days exploited by commercial surveillance vendor in Egypt

#238

Post by carrychains »

bboygravity wrote: post #217
conradev wrote: post #208

Earlier quoted context omitted.

Every government with money has exploits for every device imaginable. The going price was $1m for a full exploit chain on iPhone a while ago, and I’m sure it’s gone up, but I’m also sure it is minuscule compared to the amount of money governments have. Everyone should assume this is fact, and not imagine some secret spy world. If you ever become interesting enough to hack, you will be, and there is little recourse (c…

I'd go a step further and state: everybody is interesting enough to fully automatically hack. I have 0 doubt that literally everybody is being scraped by 1 or more governments and/or companies. Because if they can, why not?

Poignant, not really. Prescient, maybe.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#239

Post by oefrha »

__s wrote: post #233
oefrha wrote: post #168

Earlier quoted context omitted.

CT means a CA can’t do whatever they want. Your comment is handwavy, do you have any details on the “various ways” you’re talking about?

https://proton.me/blog/kazakhstan-internet-surveillance (apparently they rolled back pushing this, but this shows some "various ways")

We’re discussing trusted CAs typically bundled with operating systems or browsers here. They have to follow the baseline requirements and at least maintain a semblance of innocence. Directly compromising clients with a typically untrusted root cert is out of scope, and you don’t need an evil CA in that case anyway.

Re: 0-days exploited by commercial surveillance vendor in Egypt

#240

Post by pvg »

tptacek wrote: post #237
pvg wrote: post #214

Earlier quoted context omitted.

I can't help but pick a couple of general points from area standards-arguer man. One is 'problems of standardization in high-development-velocity fields': https://news.ycombinator.com/item?id=3577837 The other is "this is worse in security engineering broadly and outright catastrophic in cryptography engineering specifically" https://news.ycombinator.com/item?id=25451351 There's probably better/longer, I just looked…

What'd I do here? You have me worried. Did I manage to back into an argument that standards processes are good? Really I'm just trying to say two things here: * The Common Criteria process is a farce, and things that are secure by dint of being EAL5+ are really secure because they're so small you can almost prove them with formal methods (which is not to say that everything EAL5+ has usefully applied formal methods).…

No no, sorry, it wasn't intended as backhanded snark.

You've had a running critique of standards stuff here for years and it's good and the other person should read it. A bit of an unsuppressed "well, maybe if they looked at the principles, then they'll see the light" nerd-response on my part. You're not going to make an iPhone out of seL4, you're also not going to come up with a Secure Enclave or an IOMMU or an encrypted serial bus or whatever by reading standards/meeting certification reqs either because, generally, that's not how standards and certifications work. For multiple developed versions of this argument, see 'tptacek!

I'm sure you're right about the details of Jor-EAL5+ and the bottle city CRYSTALS-Kandor, just saying "also right in this other way but with less lore". Not that there is anything wrong with lore.

Post reply on HN