Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

271–280 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#271

Post by TaylorAlexander »

LargeTomato wrote: post #233
TaylorAlexander wrote: post #173

Earlier quoted context omitted.

Maybe but then again what’s another secret when at a high level these firms are already very secretive. It’s not apple but I think a lot about how Eric Schmidt of google was directly meeting with US military officials and talking about how important US defense was. You can end up with a situation where the chip designer and some higher up both know what is happening and the higher up is there as a check to provide co…

There are different levels of secret. I would never leak a normal company secret. But a national security secret is a different story.

I do wonder if the people earning millions of dollars a year think the same way however. Considering how compartmentalized Apple is it would not take many people to be in on this.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#272

Post by Brybry »

nvm0n2 wrote: post #200
cedws wrote: post #147

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…

iOS has a reputation for having the best security, but how many times have Android/WhatsApp had these sorts of silent-instant-root exploits via invisible messages? I don't remember it happening. Maybe the strategy of writing lots of stuff in Java is paying off there.

Android has had zero click exploits. For example, Stagefright [1]

And even better, there are plenty of old Android phones out which will be vulnerable to various exploits because of weak OTA update support policies.

[1] https://en.wikipedia.org/wiki/Stagefright_(bug)

Re: Operation Triangulation: What you get when attack iPhones of researchers

#273

Post by malaya_zemlya »

mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

>also is indicative of a massive organization with truly abysmal levels of internal siloing.

Or a joint project between several organizations.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#274

Post by twobitshifter »

cedws wrote: post #147

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…

i wonder why attachments would ever be loaded from unknown contacts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#275

Post by Mattwmaster58 »

wyre wrote: post #207
transpute wrote: post #184

Earlier quoted context omitted.

> reboot your iPhone at least weekly with the Hard Reset key sequence, https://www.wikihow.com/Hard-Reset-an-iPhone

Sorry for the lay question but what’s the benefit of the hard reset over a general restart?

Layperson here so just guessing. If not using the hard reset method, the exploit might fake the reboot sequence to maintain its own persistence. AFAIK, a hard reset is built in hardware and thus impossible to fake.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#276

Post by Sayrus »

madeofpalk wrote: post #249
sangnoir wrote: post #235

Earlier quoted context omitted.

One could argue the same about alternatives to Safari, and yet Chrome has proven to be more secure than Safari (based on Pwn2Own results).

I would not argue that about web browsers, because there’s plenty others out there. I don’t think Google would make a iMessage client for iOS.

But others probably would. Maybe the user-experience on the security focused clients will be degraded (missing features or disabled features for the sake of privacy and security, lower performance due to some other security features), but you'd still have this kind of niche clients.

Browsers are not the only thing concerned here, there are many sectors impacted by this philosophy. Qubes-OS for Linux Distributions, replacing containers (and especially Docker) with daemon-less or even MicroVM (Firecracker, Podman, ...). I'm sure there are also heavily sandboxed clients for Matrix, SMS or Emails.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#277

Post by twobitshifter »

hnburnsy wrote: post #10

>The resulting shellcode, in turn, went on to once again exploit CVE-2023-32434 and CVE-2023-38606 to finally achieve the root access required to install the last spyware payload. Why isn't Apple detecting the spyware\malware payload? If only Apps approved by Apple are allowed on an iPhone, detection should be trivial. And why has no one bothered to ask Apple or ARM about this 'unknown hardware'? >If we try to descri…

>Apple declined to comment for this article.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#278

Post by ipython »

codedokode wrote: post #238

I see that one of the steps in exploit was to use GPU registers to bypass kernel memory protection. Does it mean that the vulnerability cannot be fixed by an update and existing devices will stay vulnerable?

The mitigation is that the mmio range in question has been marked as unwritable in the device trees on recent versions of iOS.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#279

Post by StayTrue »

caskstrength wrote: post #216
StayTrue wrote: post #85

Earlier quoted context omitted.

This happened at a company I worked at so it’s not out of the question. I figured it out by reverse engineering and quit on the spot. They tried to tell me I’d never work again if spying on users was a dealbreaker. They showed me a natsec slide deck that identified other collaborating companies as a way of making their point. Among them was Apple.

You are telling me that natsec people give every rando the full list of participants in the conspiracy? That just doesn't make sense for any (semi)competent security agency to disclose.

I would say all the info was already known, for example Apple’s participation in PRISM.
Post reply on HN