Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

411–420 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#411

Post by hytfyiv3j »

mike_hearn wrote: post #76
chatmasta wrote: post #61

Earlier quoted context omitted.

Or they have assets working at Apple... or they hired an ex-Apple employee... etc. That's the problem with this sort of security through obscurity; it's only secure as long as the people who know about it can keep it secret.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

> It makes you wonder what is on these guy's iPhones that's considered so valuable. Presumably, they were after emails describing more zero days in other programs.

My theory is that defensive cyber security is so hard that it's literally easier to hack the entire world(with a focus on security people) to see if anyone has breached your systems.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#412

Post by raincom »

mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

S-box is used in symmetric ciphers in cryptography. S-box = substitution box or lookup table [3][4]. You can see an example of Rijndael s-box in a python script here [1][2].

[1] https://github.com/kokke/tiny-AES-c/blob/f06ac37fc31dfdaca2e...

[2] https://anh.cs.luc.edu/331/code/aes.py

[3] https://en.wikipedia.org/wiki/S-box

[4] https://en.wikipedia.org/wiki/Rijndael_S-box

Re: Operation Triangulation: What you get when attack iPhones of researchers

#413

Post by codedokode »

_kbh_ wrote: post #367
cf1241290841 wrote: post #352

Earlier quoted context omitted.

>I really doubt it's a backdoor after reading the blog post and this thread chain from a prolific M1 MacBook hacker (macran) I think it was just an unused or very rarely used feature that was left enabled by accident. Why? Apple isnt exactly a small family business and this is quite the drastic "feature" to be left enabled by accident. How would one look from your perspective?

> Why? Apple isnt exactly a small family business and this is quite the drastic "feature" to be left enabled by accident. Mistakes happen, maybe it's used in the manufacturing or fab phase to test something. Maybe it's used by the GPU firmware itself to perform some operations. Maybe it was used by some older SoCs to do something and was just never removed. Apple may not be a small family business but silly mistakes…

But notice that this feature was present in several generations of the chip.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#414

Post by codedokode »

akira2501 wrote: post #258
cedws wrote: post #147

>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…

If I've read the rest of the documentation correctly, the exploit is actually triggered from an attached ".watchface" file, which of course, has the font vulnerability in it. I'd like to meet the person who suggested even sending .watchface files as iMessage attachments in the first place. What were you thinking? Did you not have a large enough attack surface already?

Well, at least the file extension honestly warns you that the file might watch after your face.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#415

Post by _kbh_ »

codedokode wrote: post #413
_kbh_ wrote: post #367

Earlier quoted context omitted.

> Why? Apple isnt exactly a small family business and this is quite the drastic "feature" to be left enabled by accident. Mistakes happen, maybe it's used in the manufacturing or fab phase to test something. Maybe it's used by the GPU firmware itself to perform some operations. Maybe it was used by some older SoCs to do something and was just never removed. Apple may not be a small family business but silly mistakes…

But notice that this feature was present in several generations of the chip.

[dead]

Re: Operation Triangulation: What you get when attack iPhones of researchers

#416

Post by onetokeoverthe »

WhackyIdeas wrote: post #38

It’s kind of simple imo. Apple is an American company and after Jobs died, Apple quickly signed up to working with the NSA and enrolled in the Prism programme. Apple, like any other USA company, has to abide by the laws and doing what they are told to do. If that means hardware backdoors, software backdoors, or giving NSA a heads up over a vulnerability during the time it takes to fix said vulnerability (to give time…

[dead]

Re: Operation Triangulation: What you get when attack iPhones of researchers

#417

Post by LanzVonL »

jsjohnst wrote: post #294
smallnix wrote: post #292

Earlier quoted context omitted.

That makes sense, would you agree to the revised statement: "We already know Apple cooperated with the spy agencies behind the publics back"?

No, I won’t agree to context free blanket statements which are specifically worded to imply something which is simply not provably true, especially given evidence to the opposite. If you knew anything about PRISM at all, even the technical details publicly available with the minimalist of effort on your part, you wouldn’t be asking.

The struggle itself is a clue, nobody takes time out of their day to defend Apple and PRISM on the Internet. Opsec needs enhancement.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#418

Post by kornhole »

pas wrote: post #410
kornhole wrote: post #402

Earlier quoted context omitted.

They were long reads, but thank you. They generally cover history and speculation on BRICS, but we will need to see how it works out. I have seen their meetings and open statements about intent to diversify away from the dollar for trade as a high priority. The articles don't really explain what happens if/when they do figure out international payment systems that avoid dollars. Think of this: You have a trillion dol…

Okay, so it's an especially hard topic, because the soundbites seem simple and dangerous (dedollarization, end of the dollar hegemony, BRICS will move off the dollar, the first signs of the beginning of the inevitable and long predicted extremely overdue fall of the West, etc.), but the prosaic technicality-dense details are simply long and turn out to be extremely anticlimatic. Payment systems are already here that…

Thank you for the thought out explanation to a complex topic important for us to understand.

You recognize impact to exchange rates when one currency is in more demand than another. If this causes an increase in exports sold in the devalued currency, rates could eventually stabilize, but that depends on many things. Those exports could be gold in our treasury, US land, and factories. Those assets that are fixed in place are only valuable to a foreigner if they can be assured they will not be confiscated.

I know this is simplistic, but let's walk through this flow. I print up a $100 bill and give it to China for a washing machine. China will take it because they need it to buy a barrel of oil from Saudi Arabia. That $100 floats around in the world perhaps never returning as long as others accept and use it. If Saudis start accepting Yuan in payment for oil, China does not need that $100 bill as much. They start reducing their dollar reserves and US bonds. They use those dollars to buy the gold, US land, and factories. The US then has a lot of dollars but not as many assets. The dollars become less valuable because we have so many of them but not as much demand for them. If they are afraid of US sanctions, China will be less inclined to buy assets that could be seized and so the currency is less useful to them.

Admittedly there are many other factors. We will need to see how it plays out.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#419

Post by kaba0 »

black_puppydog wrote: post #209
mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

> If the hardware feature was openly documented it'd have been found much, much sooner. Well, the point of kerckhoff's principle is that it should have been openly documented and then anyone lookindg at the docs even pre-publication would have said "we can't ship it like that, that feature needs to go."

“More eyes discover more bugs” never worked.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#420

Post by AtlasBarfed »

contingencies wrote: post #131
mike_hearn wrote: post #76

Earlier quoted context omitted.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

APTs probably routinely identify and target such developers. With multi-million dollar payouts for single bugs and high state level actor attention, employee profiling is clearly a known attack vector and internal security teams probably now brief on relevant opsec. FWIW the only Apple kernel developer I knew has somewhat recently totally removed themselves from LinkedIn.

People pretend that bugs don't exist.

Not the software kind, the good old listening devices.

There's a deep tool chest of spying. Heck, remember when keyboard presses were harvested through a wall? That was at least a decade ago. I think audio of key presses can be disambiguated.

Post reply on HN