Why would the attackers target Kasperspy employees? Seems like a great way to get your exploit chain exposed
Perhaps Kasperspy is doing offensive work for someone?
Operation Triangulation: What you get when attack iPhones of researchers
401–410 of 433 posts
Re: Operation Triangulation: What you get when attack iPhones of researchers
#402Earlier quoted context omitted.
A weak dollar is good if you own a company that relies on exports. For the rest of us who are paid in dollars and need to buy imports, a weaker dollar hurts. That is one opinion. We can already see China and Japan selling off their US bonds and the BRICS countries are working on solutions to get off the dollar with high priority.
Have you read the article? :) Maybe this one will be more interesting https://www.noahpinion.blog/p/brics-is-fake
They were long reads, but thank you. They generally cover history and speculation on BRICS, but we will need to see how it works out. I have seen their meetings and open statements about intent to diversify away from the dollar for trade as a high priority. The articles don't really explain what happens if/when they do figure out international payment systems that avoid dollars. Think of this: You have a trillion dollars you printed floating around the planet. It didn't cost you much to print them, but you did get goods and services for them. If that trillion is halved to $500B, what happens?
Re: Operation Triangulation: What you get when attack iPhones of researchers
#403Earlier quoted context omitted.
Mistakes happen but Apple's reputation for strong security is well deserved. They invest heavily and the complexity of this exploit chain is evidence of that. Linux has had its fair share of trivial root login exploits that somehow got through code review.
No, that is a level of error similar to delivering cars with no airbag in them for months. In any other industry that would indicate a unimaginable level of process failure. Only in commercial software are egregious, basic mistakes swept under the rug as “mistakes happen”. Just to list a few process failures off the top of my head. No proofs of specification conformance. No specification conformance tests. No specifi…
Uh, very few folks outside of Cupertino know better than Mike how much of a total shitshow Apple were a decade or more ago. His team had to deal with their insanity on a regular basis. : - )
Since then, though, they have cleaned up their act (I've never been a fan). As a silly example, I'm pretty sure they finally check into source control the configuration of their networking equipment... Plus do a lot more to counteract the sophistication of today's nation-state attacks. They've come a long way since the hacks of 2014, when they had to scramble to enable 2FA for iCloud — previously used only for account changes or purchases. As for this vulnerability, it might be a plain bug or some NSA-style backdoor with plausible deniability, but we probably won't know which for years.
Re: Operation Triangulation: What you get when attack iPhones of researchers
#404Earlier quoted context omitted.
No, that is a level of error similar to delivering cars with no airbag in them for months. In any other industry that would indicate a unimaginable level of process failure. Only in commercial software are egregious, basic mistakes swept under the rug as “mistakes happen”. Just to list a few process failures off the top of my head. No proofs of specification conformance. No specification conformance tests. No specifi…
Uh, very few folks outside of Cupertino know better than Mike how much of a total shitshow Apple were a decade or more ago. His team had to deal with their insanity on a regular basis. : - ) Since then, though, they have cleaned up their act (I've never been a fan). As a silly example, I'm pretty sure they finally check into source control the configuration of their networking equipment... Plus do a lot more to count…
Idk who Mike Hearn is, and I'm always hesitant to call people out on HN for exactly this reason... but I think OP's airbag analogy was perfectly fair, since it was referring to the Apple bug where you could become root by simply clicking "okay" instead of entering a password. [0] It was comical in its simplicity.
But that said, overall I agree with Mike, in that Apple is clearly committed to security of their users. It's one of the main reasons I buy Apple hardware for my mobile, personal and work devices. Nobody is forcing them to put so much effort into that security, either - they do it largely by choice, and it distinguishes them from other vendors whose business models are inherently in conflict with their customers (I don't want to buy a phone from a company that derives most of its revenue from facilitating psychological warfare between advertisers and me.)
But I've always found this security to come with interesting tradeoffs. On the one hand, I'm pro-privacy and pro-user. But certain security objectives can't be achieved without reducing privacy or increasing restrictions on the user. Over the years I've come to appreciate this tradeoff, and I think Apple does a good job of balancing it. While I certainly don't feel like the device is "fully mine," I do feel like I'm getting some extra security in exchange for giving up some freedom to tinker.
[0] https://arstechnica.com/information-technology/2017/11/macos...
Re: Operation Triangulation: What you get when attack iPhones of researchers
#405That’s going to be a Chinese tool. Knowing the hardware that intimately and having all these convenient undocumented areas to play with is exactly the kind of thing you can put in place if you control the manufacturing.
Re: Operation Triangulation: What you get when attack iPhones of researchers
#406Earlier quoted context omitted.
If I were an embassy employee (covert or overt), I'd want zero iMessage features beyond ASCII and the thumbs-up/down reactions. No attachments, no GIFs, no games, no Apple Pay, no easter eggs, no rich text Apple really needs a paranoid mode
Lockdown mode exists: https://support.apple.com/en-us/105120
you can't use this with MDM unfortunately, so useless for govts, corporations, etc.
Re: Operation Triangulation: What you get when attack iPhones of researchers
#407That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…
>there's no obvious way you could find the right magic knock to operate this feature short of doing a full silicon teardown and reverse engineering (impractical at these nodes).
Then how did these researchers do it? Not being cheeky, I just don't follow security super closely.
Re: Operation Triangulation: What you get when attack iPhones of researchers
#408That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…
>there's no obvious way you could find the right magic knock to operate this feature short of doing a full silicon teardown and reverse engineering (impractical at these nodes). Then how did these researchers do it? Not being cheeky, I just don't follow security super closely.
They reverse engineered the malware.
Re: Operation Triangulation: What you get when attack iPhones of researchers
#409Re: Operation Triangulation: What you get when attack iPhones of researchers
#410Earlier quoted context omitted.
Have you read the article? :) Maybe this one will be more interesting https://www.noahpinion.blog/p/brics-is-fake
They were long reads, but thank you. They generally cover history and speculation on BRICS, but we will need to see how it works out. I have seen their meetings and open statements about intent to diversify away from the dollar for trade as a high priority. The articles don't really explain what happens if/when they do figure out international payment systems that avoid dollars. Think of this: You have a trillion dol…
Okay, so it's an especially hard topic, because the soundbites seem simple and dangerous (dedollarization, end of the dollar hegemony, BRICS will move off the dollar, the first signs of the beginning of the inevitable and long predicted extremely overdue fall of the West, etc.), but the prosaic technicality-dense details are simply long and turn out to be extremely anticlimatic.
Payment systems are already here that avoid the dollar. (From the extremely simple blockchainish digital-synthetic currencies like Ripple XRP to the classic SWIFT-like China's CIPS[1].) And these are already in use. After Russia got thrown out of SWIFT they are now basically using CIPS. (Of course they also have their own version, SPFS. "Coincidentally" its development started in 2014.)
However, on the CIPS wikipedia page you can notice that the important things needed for the actual settlement is a boring list of stuff about each member institution (account numbers, settlement procedure description, credit rating). And each member institution has its own rules about what transfers to accept. And of course in hard times trust is in low-supply, transfers start to get manually reviewed, tolerances start to decrease, everyone starts to hoard good money, thus only bad money remains.
All in all, the important thing is that there's no magic system that can handle payments without the usual institutional-societal framework. (Well, of course there are blockchainish things. For example Visa is doing something on Solana. And Solana is pretty fast and cheap. And a horror show to develop smart contracts on, but that's not really relevant now, and not important for Visa or Russia/China/banks, because they don't care much about the ethos of decentralization, they just want to have something quasi-trustless, fast, and cheap.)
> If that trillion is halved to $500B, what happens?
It depends, but, well ... nothing really. Most of money is already at rest. It represents exactly that stuff you got for it. It represents all the wealth created. It was printed to keep inflation around 1-2%. If it disappears in some computer system people will start to scratch their heads, but the ratios will remain mostly the same, so purchasing power and wages/salaries will not change.
That said if some bank decides to flood the market with cheap US Treasury bonds nothing happens. That's already in USD, the bank loses on the transaction a lot. And a lot of these reserves are in bonds.
Okay, what happens if that bank asks for the cheap bonds not USD, but let's say rubels? Okay, they will end up with a shitton of rubels. The exchange rate shifted, but nothing actually happened, sure the ratio of flow of goods and services will adjust as the overpriced rubels will be exchanged for a bit more goods and services than without this huge transaction. But what does this lead to? More exports from the typical exporters. It's not particularly good for anything that's hard to scale up, it will just result in price inflation. And then eventually the exchange rate will go back to reflect the actual flow of goods and services.
[1] https://en.wikipedia.org/wiki/Cross-Border_Interbank_Payment...