Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

141–150 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#141

Post by eviks »

woodruffw wrote: post #72
gustavus wrote: post #3

[flagged]

There's a fundamental category error at play here: exploit chains like this one and the one behind FORCEDENTRY[1] cost millions, if not tens of millions, of dollars to discover and weaponize, even before operationalization. The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains. Put another way:…

It may cost a million, but it doesn't follow that every use(r) costs the same (could even also call this a category error).

Neither is "going to get you" a given, maybe another agency is in charge of the alternative methods of getting you, and they have different priorities that doesn't include your target (or alternative ways are much more expensive or too slow to be worth it)

Re: Operation Triangulation: What you get when attack iPhones of researchers

#142

Post by malfist »

mike_hearn wrote: post #76
chatmasta wrote: post #61

Earlier quoted context omitted.

Or they have assets working at Apple... or they hired an ex-Apple employee... etc. That's the problem with this sort of security through obscurity; it's only secure as long as the people who know about it can keep it secret.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

> But the really suspicious thing is the hash. What kind of hardware interface does arbitrary DMA protected by a secret but weak hash function? Is there any legitimate usage for such a thing? I've never heard of such an interface before.

Never attribute to malice that which can be attributed to incompetence. There are plenty of examples in the wild of going halfway with strong security, but halfway still leaves the barn door open.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#143

Post by londons_explore »

What are the chances this MMIO register could have been discovered by brute force probing every register address?

Mere differences in timing could have indicated the address was a valid address, and then the hash could perhaps have been brute forced too since it is effectively a 20 bit hash.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#145

Post by westhanover »

Despegar wrote: post #138
stavros wrote: post #136

Earlier quoted context omitted.

I don't understand what you mean. They've always been making progress, driving the price up. They can just keep doing what they're doing, and there will be progress from today.

Is that actually true? Has the price of these exploits been going up year after year, or has it topped out at some level?

Yes it has been going up.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#146

Post by fishywang »

transpute wrote: post #121
fishywang wrote: post #94

Earlier quoted context omitted.

We purchased an iPad with cellular, with the plan to put my home country's sim card in it so I can still receive SMS (as most of the banks there still requires SMS verification when you login), and it turns out that iPad with cellular does not really show you SMS's that's not from the carrier of the sim card.

> iPad with cellular does not really show you SMS's that's not from the carrier of the sim card. Does iPad support SMS? The cellular line is usually only for data, https://www.howtogeek.com/710767/how-to-send-sms-text-messag... iPads can't send SMS text messages through Apple's Messages app. Even if you have an iPad with a cellular data plan for mobile internet on the go, you still can't send SMS text messages.

Apple's own user guide (https://web.archive.org/web/20201223140550/https://support.a...) suggests otherwise:

>In the Messages app , you can send text messages as SMS/MMS messages through your cellular service, or ...

Also my own experience is that it at least can receive SMS text messages, just it won't show you if it's not from your carrier (if it's from your carrier, it shows you via a popup window or something, can't really remember as that was several years ago).

Re: Operation Triangulation: What you get when attack iPhones of researchers

#147

Post by cedws »

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it.

This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job?

This is really disappointing to see time and time again. If a simple app to send and receive messages is this hard to get right, I have very little hope left for software.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#148

Post by LanzVonL »

Isn't the most obvious answer that Apple, like other US tech firms such as Google, simply creates these wild backdoors for the NSA/GCHQ directly? Every time one's patched, three more pop up. We already know Apple and Google cooperate with the spy agencies very eagerly.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#149

Post by woodruffw »

eviks wrote: post #141
woodruffw wrote: post #72

Earlier quoted context omitted.

There's a fundamental category error at play here: exploit chains like this one and the one behind FORCEDENTRY[1] cost millions, if not tens of millions, of dollars to discover and weaponize, even before operationalization. The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains. Put another way:…

It may cost a million, but it doesn't follow that every use(r) costs the same (could even also call this a category error). Neither is "going to get you" a given, maybe another agency is in charge of the alternative methods of getting you, and they have different priorities that doesn't include your target (or alternative ways are much more expensive or too slow to be worth it)

The point is that it's incorrect to think of the US (or any other country's) IC as a force of nature, blasting out 0days to random civilians just for kicks. These things are expensive, very expensive, and are carefully orchestrated. They don't look anything like the average civilian's security breach, which is somewhere between "accidentally leaked their own password" and "TSA asks you to unlock your phone."

Re: Operation Triangulation: What you get when attack iPhones of researchers

#150

Post by OneLeggedCat »

vGPU wrote: post #86

[flagged]

> several of MMIO addresses the attackers used to bypass the memory protections weren’t identified in any device tree documentation, which acts as a reference for engineers creating hardware or software for iPhones. Even after the researchers further scoured source codes, kernel images, and firmware, they were still unable to find any mention of the MMIO addresses

It sure quacks like a duck.

Post reply on HN