Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

161–170 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#161

Post by riwsky »

teruakohatu wrote: post #117
pushcx wrote: post #4

It’s quite unfortunate that Apple doesn’t allow users to uninstall iMessage, it seems to be the infection vector for advanced threats like this, NSO group, etc. Presumably it’s to avoid the support burden, but they could gate it behind having Lockdown Mode enabled for a week or something to shake out the vast majority of mistaken activations.

Can someone explain to me why we can load vast quantities of untrusted code and a wide variety of image formats in our browsers all day long and be mostly safe today, but somehow even first party messenger apps seem to be a relatively easily compromised? Why can't messenger apps be sandboxed as well as browsers?

this exploit chain involved a browser vulnerability; your premise is flawed

Re: Operation Triangulation: What you get when attack iPhones of researchers

#162

Post by fortran77 »

SXX wrote: post #83
pvg wrote: post #32

Earlier quoted context omitted.

leads Kaspersky and myself to the only rational conclusion: that Apple cooperated with the NSA on this exploit. Kapersky reaches no such conclusion. That's from an FSB release.

[flagged]

This is a complete lie.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#163

Post by d0mine »

TheCaptain4815 wrote: post #101
vGPU wrote: post #86

[flagged]

I'd disagree with this. Apple execs surely know if this information gets leaked they're losing 30% market cap in a single day, why would they risk something like that when administrations change every 4-8 years?

Highly unlikely. Nobody cares.

What stock was crushed by Snowden revelations?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#164

Post by JumpCrisscross »

TaylorAlexander wrote: post #89
vGPU wrote: post #86

[flagged]

Yeah people keep talking about reverse engineering but it’s just as real a possibility that this was simply engineered to be there. Apple and the government made a big public show about the San Bernardino iPhone situation[1] but that could have easily been a cover to convince people the government can’t get in to iPhones - because eventually the government dropped the court case, got in anyway, and the whole thing wa…

> that could have easily been a cover

The problem with conspiracies is everyone involved knows it’s a secret. If you’re the CIA, it’s much less risky to compromise a chip design engineer than have everyone from the CEO down at Apple in on the plant.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#165

Post by doctorpangloss »

Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

It could author its format parsers in https://github.com/google/wuffs, and make them BSD-like open source to maximize adoption.

An even bigger change: It could allow users to choose their iMessage client freely. Why not open up the protocol? I’m sure a security focused client would be popular and in the grand scheme of things easy to author.

Perhaps they could open up more of the OS and apps. Perhaps their claims about the security of users and the App Store is kind of BS.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#166

Post by throwoutway »

cedws wrote: post #147

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…

If I were an embassy employee (covert or overt), I'd want zero iMessage features beyond ASCII and the thumbs-up/down reactions. No attachments, no GIFs, no games, no Apple Pay, no easter eggs, no rich text

Apple really needs a paranoid mode

Re: Operation Triangulation: What you get when attack iPhones of researchers

#167

Post by et1337 »

throwoutway wrote: post #166
cedws wrote: post #147

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…

If I were an embassy employee (covert or overt), I'd want zero iMessage features beyond ASCII and the thumbs-up/down reactions. No attachments, no GIFs, no games, no Apple Pay, no easter eggs, no rich text Apple really needs a paranoid mode

Lockdown mode exists: https://support.apple.com/en-us/105120

Re: Operation Triangulation: What you get when attack iPhones of researchers

#168

Post by [deleted] »

adrian_b wrote: post #107
tuetuopay wrote: post #56

Earlier quoted context omitted.

> I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture. well you are in trouble then. all of modern hardware have such hidden parts in them, and are most of the time referenced as "undocumented" instead of "unknown". I know this seems pedantic, but from a public…

"Undocumented" as used by hardware manufacturers is an euphemism for "secret".

[deleted]
Post reply on HN