Operation Triangulation: What you get when attack iPhones of researchers • Hacker News Board

Re: Operation Triangulation: What you get when attack iPhones of researchers

#331

Post by [deleted] » Thu, Dec 28, 2023, 4:34 AM UTC

MuffinFlavored wrote: post #317

Veserv wrote: post #250

Earlier quoted context omitted.

2-3 million dollars is not “amazing”. That is less than the cost to open a McDonalds. You can get a small business loan in the US for more than that. There are literally tens of millions of people in the world who can afford that. That is 1/5 the cost of a tank. 2-3 million dollars is pocket lint to people conducting serious business, let alone governments. It is at best okay if you are conducting minor personal busi…

> 2-3 million dollars is not “amazing”. I don't know. $2-3m for reading code in Ghidra and throwing stuff at a wall until something sticks? Maybe some fuzzing, etc. I get that you theoretically could find an exploit that for example, you send to 100 known wealthy people, and with it you steal saved cookies + device IDs from financial apps and then try to transfer their funds/assets to an account you control but... Co…

[deleted]

Re: Operation Triangulation: What you get when attack iPhones of researchers

#332

Post by throwaway2037 » Thu, Dec 28, 2023, 5:24 AM UTC

mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

> truly phenomenal research capabilities

Maybe a nation state, e.g., APT?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#333

Post by supriyo-biswas » Thu, Dec 28, 2023, 5:26 AM UTC

mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

So much misinformation in this thread. It’s a Hamming ECC, as described here[1].

[1] https://social.treehouse.systems/@marcan/111655847458820583

Re: Operation Triangulation: What you get when attack iPhones of researchers

#334

Post by saagarjha » Thu, Dec 28, 2023, 5:49 AM UTC

Despegar wrote: post #301

saagarjha wrote: post #153

Earlier quoted context omitted.

It’s been going up consistently. The number of groups that can field a full chain these days is dwindling.

Perhaps Apple should provide research devices directly to the US's and China's intelligence agencies and pit them against each other to help close more vulnerabilities. The agencies can decide on their own where to strike the balance between offense and defense, but I suspect it would lead to more closed vulnerabilities over time.

Intelligence agencies unfortunately seem to have a bad track record when it comes to disclosing vulnerabilities, they’re very offensive-focused.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#335

Post by saagarjha » Thu, Dec 28, 2023, 5:50 AM UTC

hnburnsy wrote: post #269

saagarjha wrote: post #97

Earlier quoted context omitted.

This chain isn’t delivered via an app, it is sent through iMessage. The checks for “only apps approved by Apple” are not relevant if you exploit your way past them.

Thanks I did see the researchers posted how the malware gets into memory, but I still feel like since Apple tightly controls the enviornment it ahould be able to detect anything running there that should not be.

It is very difficult to do this in general, especially for these kinds of exploits.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#336

Post by saagarjha » Thu, Dec 28, 2023, 5:52 AM UTC

manuelabeledo wrote: post #265

saagarjha wrote: post #88

Earlier quoted context omitted.

I don’t really see anything wrong with their security posture here.

For starters, it took them four years to detect an intrusion that takes advantage of a messaging service (iMessage) that wasn't the corporate choice for internal communications, and allowed the exfiltration of gigabytes of data from the C-suite and high level managers. This is Kaspersky. They had to be aware of the long history of iMessage security bugs. They could have disabled it. They chose to ignore it instead.

This is an exploit from an adversary that reversed undocumented MMIO registers to completely bypass kernel write protections. Do you honestly believe that disabling iMessage would keep them out? They’d just field the exploit using Exchange or HomeKit or any of the dozen other ways there are to get content onto the devices.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#337

Post by saagarjha » Thu, Dec 28, 2023, 5:53 AM UTC

nvm0n2 wrote: post #204

Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

Sure. Rewrite sensitive parts of their stack in memory safe languages. They have Swift after all. A lot of the iOS security improvements over time have really been more like mitigations that try to contain the damage when the giant of pile of decades old C gets exploited.

They’re working on it, but a memory-safe language doesn’t help you in some of the surface that the attackers exploited here.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#338

Post by saagarjha » Thu, Dec 28, 2023, 5:54 AM UTC

cf1241290841 wrote: post #291

As its about a 37c3 presentation here a comment from Fefe¹ in German https://blog.fefe.de/?ts=9b729398 According to him the exploit chain was likely worth in the region of a 8-digit dollar value. ¹ https://en.wikipedia.org/wiki/Felix_von_Leitner I guess somebody is going to get fired.

Why? Having exploits “burned” is part of the business.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#339

Post by jrockway » Thu, Dec 28, 2023, 5:56 AM UTC

fsckboy wrote: post #288

fishywang wrote: post #94

Earlier quoted context omitted.

We purchased an iPad with cellular, with the plan to put my home country's sim card in it so I can still receive SMS (as most of the banks there still requires SMS verification when you login), and it turns out that iPad with cellular does not really show you SMS's that's not from the carrier of the sim card.

I've never understood why iPads can't be used as phones with an ordinary cellphone SIM. Is it simply because Apple doesn't want to pay a Qualcomm licensing fee or some equivalent? Who is it in the chain/ecosystem that does not want tablets being used as full phones, the carriers? Apple?

I'm guessing it doesn't fit well with the carriers' price structure. Adding a tablet / smart watch / etc. is cheaper than adding another phone to your account. I wouldn't have a cellular iPad if it was a lot extra per month, but I think I pay $10 for both the tablet and the watch, which is fine with me.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#340

Post by saagarjha » Thu, Dec 28, 2023, 5:57 AM UTC

flakiness wrote: post #270

codedokode wrote: post #238

I see that one of the steps in exploit was to use GPU registers to bypass kernel memory protection. Does it mean that the vulnerability cannot be fixed by an update and existing devices will stay vulnerable?

I don't think there is any JIT on GPU and all the code has to go through a host-side kernel call so it should be able to protect the register I guess?

The kernel cannot protect against this, in fact the attackers have full read/write control and code execution capabilities to mount this attack. The fix is blocking this range from being mapped using features that are more powerful than the kernel.