Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

261–270 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#261

Post by dagmx »

halJordan wrote: post #129
sampa wrote: post #37

[flagged]

I just dont get this mentality. Here is proof positive (if you believe attribution) that the NSA is using exquisite and exotic techniques to force their way into iphones and you look at it and come up with the exact opposite conclusion that Apple is letting them into the iphone. Its not a backdoor if you're smashing in the window.

Yeah I don’t understand these conspiracy theories.

If the NSA had partnered with Apple, they sure as hell would have asked for something much more convenient and resilient.

I think it’s just down to a lot of people not understanding hardware and falling back to “magical” thinking

Re: Operation Triangulation: What you get when attack iPhones of researchers

#262

Post by transpute »

codedokode wrote: post #238

I see that one of the steps in exploit was to use GPU registers to bypass kernel memory protection. Does it mean that the vulnerability cannot be fixed by an update and existing devices will stay vulnerable?

https://x.com/alfiecg_dev/status/1740025569600020708

  It’s a hardware exploit, using undocumented registers. It can only be mitigated against, but not fully patched.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#263

Post by jsjohnst »

freeflight wrote: post #227
jsjohnst wrote: post #176

Earlier quoted context omitted.

> We already know Apple and Google cooperate with the spy agencies very eagerly. The evidence clearly indicates otherwise…

How so? Any competent intelligence service will not just depend on the goodwill of a corporation to secure access to assets and intelligence. If they cooperate that's good and convenient, but that does not mean the intelligence service will not set in place contingencies for if the other side suddenly decides not to play ball anymore.

I said nothing about anything you stated, that’s all clearly possible, I specifically refuted the unsupported claim that Apple “eagerly cooperate with spy agencies”, where there’s ample evidence to support an opposite claim.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#264

Post by jacooper »

kornhole wrote: post #110
lame-robot-hoax wrote: post #45

Earlier quoted context omitted.

How did sanctions backfire?

Germany's economy shrunk last year while Russia's grew. Dedollarization has accelerated which will impact the US not immediately but in near future.

To be fair, other European countries are doing better. It's a Problem specific to Germany and their mishandling of the energy shock.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#265

Post by manuelabeledo »

saagarjha wrote: post #88
manuelabeledo wrote: post #46

Earlier quoted context omitted.

To be fair, that was just Kaspersky taking a jab at Apple, after being absolutely gutted by hackers because of their own poor security posture.

I don’t really see anything wrong with their security posture here.

For starters, it took them four years to detect an intrusion that takes advantage of a messaging service (iMessage) that wasn't the corporate choice for internal communications, and allowed the exfiltration of gigabytes of data from the C-suite and high level managers.

This is Kaspersky. They had to be aware of the long history of iMessage security bugs. They could have disabled it. They chose to ignore it instead.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#266

Post by jpalawaga »

doctorpangloss wrote: post #165
Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

It could author its format parsers in https://github.com/google/wuffs , and make them BSD-like open source to maximize adoption. An even bigger change: It could allow users to choose their iMessage client freely. Why not open up the protocol? I’m sure a security focused client would be popular and in the grand scheme of things easy to author. Perhaps they could open up more of the OS and apps. Perhaps their claims ab…

[flagged]

Re: Operation Triangulation: What you get when attack iPhones of researchers

#267

Post by twobitshifter »

patrickhogan1 wrote: post #108

Knowing more about the exfiltration component where it sends data to a remote server would be helpful. According to the article it’s sending large audio microphone recordings. I assume a company like Kapersky would explicit deny all outgoing network connections and then approve one by one.

yeah, I’m wondering the same. Maybe they can’t point a finger at who did it, but there were no clues on the exfiltration?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#268

Post by hnburnsy »

aidenn0 wrote: post #112
hnburnsy wrote: post #36

Earlier quoted context omitted.

>It was complex because of all of the defenses put in place by Apple and others. I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture. This makes everything written on this page worthless... >Prevent anyone except you from using your devices and accessing your i…

> I don't know jack about hardware but it would seem obvious that when one designs a chip, you make sure it does not have 'unknown hardware registers' or unknown anything when you get it back from the manufacture. Either Apple or Arm has employees that know what these registers do. They are likely used for debugging and/or testing. A lot of those registers can do very interesting things, since e.g. fault-injection is…

Very interesting, thanks dor the insight. Would you fault Apple for not disabling these?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#269

Post by hnburnsy »

saagarjha wrote: post #97
hnburnsy wrote: post #10

>The resulting shellcode, in turn, went on to once again exploit CVE-2023-32434 and CVE-2023-38606 to finally achieve the root access required to install the last spyware payload. Why isn't Apple detecting the spyware\malware payload? If only Apps approved by Apple are allowed on an iPhone, detection should be trivial. And why has no one bothered to ask Apple or ARM about this 'unknown hardware'? >If we try to descri…

This chain isn’t delivered via an app, it is sent through iMessage. The checks for “only apps approved by Apple” are not relevant if you exploit your way past them.

Thanks I did see the researchers posted how the malware gets into memory, but I still feel like since Apple tightly controls the enviornment it ahould be able to detect anything running there that should not be.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#270

Post by flakiness »

codedokode wrote: post #238

I see that one of the steps in exploit was to use GPU registers to bypass kernel memory protection. Does it mean that the vulnerability cannot be fixed by an update and existing devices will stay vulnerable?

I don't think there is any JIT on GPU and all the code has to go through a host-side kernel call so it should be able to protect the register I guess?
Post reply on HN