Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

111–120 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#111

Post by ogurechny »

woodruffw wrote: post #72
gustavus wrote: post #3

[flagged]

There's a fundamental category error at play here: exploit chains like this one and the one behind FORCEDENTRY[1] cost millions, if not tens of millions, of dollars to discover and weaponize, even before operationalization. The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains. Put another way:…

Your “threat model analysis” takes for granted that a “civilian” is a billion times less important than a “nation-state”. It makes no sense to waste any time analyzing anything after such a conclusion. Therefore, something is wrong here.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#112

Post by aidenn0 »

hnburnsy wrote: post #36
whartung wrote: post #19

Earlier quoted context omitted.

It can be defended against. The detail is that the only way to harden those defenses is to toss it out in the world and let folks poke holes in it. This was an extremely complex exploit. It was complex because of all of the defenses put in place by Apple and others. It required State level resources to pull it off. We also don't know what, if any, external skullduggery was involved in the exploit. Did someone penetra…

>It was complex because of all of the defenses put in place by Apple and others. I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture. This makes everything written on this page worthless... >Prevent anyone except you from using your devices and accessing your i…

> I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture.

Either Apple or Arm has employees that know what these registers do. They are likely used for debugging and/or testing.

A lot of those registers can do very interesting things, since e.g. fault-injection is an important part of testing. A security-minded implementation will allow these to either be fused off or disabled very early in the boot process. The latter is probably more common, and any disconnect between the hardware and software side can cause this step to get missed.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#113

Post by woodruffw »

saagarjha wrote: post #87
woodruffw wrote: post #72

Earlier quoted context omitted.

There's a fundamental category error at play here: exploit chains like this one and the one behind FORCEDENTRY[1] cost millions, if not tens of millions, of dollars to discover and weaponize, even before operationalization. The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains. Put another way:…

There haven’t really been all that many hardware exploits for us to judge Apple on this, have there?

Not that I know of. There are other hardware-ish exploits (like checkm8), but I think most have been purely software.

(Hopefully what I said wasn't interpreted as a value judgement about hardware security specifically -- the only point I was trying to make is that ICs spend significant resources discovering exploits on all of these platforms.)

Re: Operation Triangulation: What you get when attack iPhones of researchers

#115

Post by hnburnsy »

patrickhogan1 wrote: post #108

Knowing more about the exfiltration component where it sends data to a remote server would be helpful. According to the article it’s sending large audio microphone recordings. I assume a company like Kapersky would explicit deny all outgoing network connections and then approve one by one.

There is a series of posts on this including one that details the malware payload...

https://securelist.com/trng-2023/

Re: Operation Triangulation: What you get when attack iPhones of researchers

#116

Post by tedunangst »

hnburnsy wrote: post #36
whartung wrote: post #19

Earlier quoted context omitted.

It can be defended against. The detail is that the only way to harden those defenses is to toss it out in the world and let folks poke holes in it. This was an extremely complex exploit. It was complex because of all of the defenses put in place by Apple and others. It required State level resources to pull it off. We also don't know what, if any, external skullduggery was involved in the exploit. Did someone penetra…

>It was complex because of all of the defenses put in place by Apple and others. I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture. This makes everything written on this page worthless... >Prevent anyone except you from using your devices and accessing your i…

> I don't know jack about hardware

Could have stopped writing right there.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#117

Post by teruakohatu »

pushcx wrote: post #4

It’s quite unfortunate that Apple doesn’t allow users to uninstall iMessage, it seems to be the infection vector for advanced threats like this, NSO group, etc. Presumably it’s to avoid the support burden, but they could gate it behind having Lockdown Mode enabled for a week or something to shake out the vast majority of mistaken activations.

Can someone explain to me why we can load vast quantities of untrusted code and a wide variety of image formats in our browsers all day long and be mostly safe today, but somehow even first party messenger apps seem to be a relatively easily compromised? Why can't messenger apps be sandboxed as well as browsers?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#118

Post by chasil »

hnburnsy wrote: post #10

>The resulting shellcode, in turn, went on to once again exploit CVE-2023-32434 and CVE-2023-38606 to finally achieve the root access required to install the last spyware payload. Why isn't Apple detecting the spyware\malware payload? If only Apps approved by Apple are allowed on an iPhone, detection should be trivial. And why has no one bothered to ask Apple or ARM about this 'unknown hardware'? >If we try to descri…

There is a PNG in the original article with detail of the malware gaining a foothold on a device:

https://cdn.arstechnica.net/wp-content/uploads/2023/12/trian...

As you can see, it starts with a PDF coming into iMessage, and that PDF has a font that is able to exploit ROP gadgets.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#119

Post by gghffguhvc »

saagarjha wrote: post #88
manuelabeledo wrote: post #46

Earlier quoted context omitted.

To be fair, that was just Kaspersky taking a jab at Apple, after being absolutely gutted by hackers because of their own poor security posture.

I don’t really see anything wrong with their security posture here.

Article says large data files were sent from device to servers. Perhaps they could have configured their networks to detect/block this part.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#120

Post by woodruffw »

ogurechny wrote: post #111
woodruffw wrote: post #72

Earlier quoted context omitted.

There's a fundamental category error at play here: exploit chains like this one and the one behind FORCEDENTRY[1] cost millions, if not tens of millions, of dollars to discover and weaponize, even before operationalization. The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains. Put another way:…

Your “threat model analysis” takes for granted that a “civilian” is a billion times less important than a “nation-state”. It makes no sense to waste any time analyzing anything after such a conclusion. Therefore, something is wrong here.

I think you've misunderstood. The point was that there are (to simplify) two different threat models at play here: one where your most powerful adversary is somewhere between your family and domestic law enforcement, and another where you are worth $10+ million to a nation state.

99.99% of the world lives in threat model 1; our goal as security minded people is to protect these people. These people want general purpose networked computers in their pockets.

0.01% of the world lives in threat model 2; our goal is also to protect these people. But these people don't get protected while also having general purpose networked computers in their pockets.

Both groups are civilians, and both deserve security. But they also have different demands; if Apple forced Lockdown Mode's usability restrictions onto a billion people tomorrow, a large percentage of them would switch to materially less secure hardware and software vendors.

Post reply on HN