Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

371–380 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#371

Post by codedokode »

mrandish wrote: post #315
mike_hearn wrote: post #76

Earlier quoted context omitted.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

> What kind of hardware interface does arbitrary DMA protected by a secret but weak hash function? I agree. This appears to likely be an intentional backdoor injected at the hardware level during design. At such a low-level I think it could have been accomplished with only a handful of employees in on it. There would have been no need to subvert Apple from the top down with large numbers of people at many levels bein…

It reminds me of Linux backdoor that also was made to look like a mistake (== replaced with =) [1].

[1] https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...

Re: Operation Triangulation: What you get when attack iPhones of researchers

#372

Post by [deleted] »

mike_hearn wrote: post #76
chatmasta wrote: post #61

Earlier quoted context omitted.

Or they have assets working at Apple... or they hired an ex-Apple employee... etc. That's the problem with this sort of security through obscurity; it's only secure as long as the people who know about it can keep it secret.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

[deleted]

Re: Operation Triangulation: What you get when attack iPhones of researchers

#373

Post by codedokode »

Now I am thinking Kaspersky should not have published this information. What a wrong decision. Instead they should have sold it to Russian government which I am sure could find lot of interesting uses for these "debugging features" and offer a good reward.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#374

Post by newsclues »

eastof wrote: post #351
mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

Maybe more likely they just have people inside Apple?

This is likely at the scale of Apple and the determination of State Actors.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#375

Post by ElMocambo_x4 »

halJordan wrote: post #129
sampa wrote: post #37

[flagged]

I just dont get this mentality. Here is proof positive (if you believe attribution) that the NSA is using exquisite and exotic techniques to force their way into iphones and you look at it and come up with the exact opposite conclusion that Apple is letting them into the iphone. Its not a backdoor if you're smashing in the window.

Sure, it's not like we've been made aware of a history of backdoors through the Snowden or Shadowbrokers leaks...

Re: Operation Triangulation: What you get when attack iPhones of researchers

#376

Post by uncle-betty »

supriyo-biswas wrote: post #333
mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

So much misinformation in this thread. It’s a Hamming ECC, as described here[1]. [1] https://social.treehouse.systems/@marcan/111655847458820583

More evidence for an ECC, obtained by looking at how the 10 output bits of the function depend on its 256 input bits:

Each of the 10 parity bits output by the function is the xor of exactly 104 of the 256 input bits.

Each of the 256 input bits contributes to (= is xor-ed into) either 3 or 5 of the 10 parity bits.

This is in line with the SEC-DED (single error correction, double error detection) ECC construction from the following paper:

https://people.eecs.berkeley.edu/~culler/cs252-s02/papers/hs...

Translating the above observations about the function into properties of the H matrix in the paper:

Each row of the matrix contains an identical number of ones (104).

Each column of the matrix contains an odd number of ones (3 or 5).

Re: Operation Triangulation: What you get when attack iPhones of researchers

#377

Post by avidiax »

I_Am_Nous wrote: post #171
pushcx wrote: post #4

It’s quite unfortunate that Apple doesn’t allow users to uninstall iMessage, it seems to be the infection vector for advanced threats like this, NSO group, etc. Presumably it’s to avoid the support burden, but they could gate it behind having Lockdown Mode enabled for a week or something to shake out the vast majority of mistaken activations.

In the face of this kind of threat, it's pretty obvious why Apple treated Beeper as a security risk and took appropriate measures to secure iMessage.

Beeper is the user's choice. And Apple is preventing other companies from providing a more secure iMessage alternative, e.g. one that doesn't even parse messages from people not in the contact list, or doesn't even parse anything without a click, etc.

Apple has had so many zero-click exploits in iMessage, yet they insist that you have to use Lockdown mode to do anything about it, and then proceed to bundle Lockdown mode with lots of potentially unwanted behavior.

I don't think there's any way to claim that Apple is just doing whats in the customer's best security interest.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#379

Post by Obscurity4340 »

542458 wrote: post #128
xvector wrote: post #90

Does Lockdown Mode prevent agains this?

I think lockdown drops most iMessage features, so I would suspect the answer is yes. But as far as I can tell, lockdown prevents use of mdm, so it might be a net negative for security… instead, using the mdm policy that disables iMessage might be preferable.

You can still supervise which allows for that all the same, IIRC

Re: Operation Triangulation: What you get when attack iPhones of researchers

#380

Post by rst »

throwaway2037 wrote: post #332
mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

> truly phenomenal research capabilities Maybe a nation state, e.g., APT?

Being able to put together tooling with these capabilities makes the attacker an APT by definition. These are generally assumed to be national intelligence services, though that is an assumption. (Among other things, there are multiple countries where the lines between intelligence agencies and their contractors are... fuzzy.)

And while Kaspersky is refusing to speculate at all about attribution, the Russian government has claimed (without giving specific evidence) that it's NSA.

Post reply on HN