Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple alerts users in 92 nations to mercenary spyware attacks

techcrunch.com

Post reply on HN
Print view View original

221–230 of 301 posts

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#221

Post by user_7832 »

saagarjha wrote: post #207
realusername wrote: post #178

Earlier quoted context omitted.

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#222

Post by cute_boi »

onedognight wrote: post #129
user_7832 wrote: post #111

Earlier quoted context omitted.

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android…

Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.

whats the point of carrying phone that doesn't even play youtube videos? If security is so important then they should probably carry nokia style 2000's phone where there is no chance of malaware?

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#223

Post by simpaticoder »

quesera wrote: post #155
bee_rider wrote: post #113

Earlier quoted context omitted.

Well dang I work in a research lab and I didn’t get an email. I’m just going to assume my research is so interesting that they sent the real badasses after me, somebody that Apple can’t catch. The truth is too ego-shattering.

Look to your left. Look to your right. Both of those people are working for a foreign government. At least one of them does not know it. Trust no one.

This comment has an off-by-one error.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#224

Post by user_7832 »

spxneo wrote: post #117
user_7832 wrote: post #111

Earlier quoted context omitted.

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android…

you changed my mind successfully thank you but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this

Happy to be able to help!

If we’re talking about having the microphone tapped etc, I don’t think anyone would still be developing 0-days for such old phones. If you want to be safer (assuming fear of old software having unpatched vulnerabilities) Nokia launched a dumb phone not too long ago.

However… GSM networks and cell tower level tracking is much harder/almost impossible to escape short of throwing away your phone. SMSes can be hijacked, hostile agents can force downgrade the connection to 3G/2g to break encryption (iirc, please correct me if wrong), and your location is generally known to your service provider and Uncle Sam.

Plus… the SIM card is its own mini computer, and lots of the firmware between that and the telephony modules is proprietary and closed source. If you’re familiar with intel ME you have an idea of what I’m talking about.

Honestly, if you’re not a journalist going after big names, or a top CEO/president etc you likely don’t need to worry about any of these. But if you are, or just want to be privacy conscious, your best bet is to never use cell towers and only use Wi-Fi/internet from public or untraceable places; along with Wi-Fi calling for telephony. Btw I’m not sure but I think Google fi and a few carriers/MVNOs offer virtual numbers, which can be a good first step for privacy.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#225

Post by internetter »

AnotherGoodName wrote: post #170
bee_rider wrote: post #8

There’s a reddit thread by somebody who got one of these: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece... The interesting thing IMO is they claim to just be some random college student. Which seems believable because if they were a real secret squirrel I guess they wouldn’t ask reddit about it, haha. I wonder if the hackers are targeting people based on phone numbers or something. (I could imagine a c…

Everyone's thinking academic secrets but have they engaged in activism in any way shape or form? Being able to take activists and discredit them is an amazing ability. I would not at all be surprised if the xz compression backdoor was an attempt by a certain government to gain the ability to discredit anyone that is against them in anyway.

Having wrote an article on XZ, I was half expecting to have this text popup, especially as I'm fairly certain i was targeted by a misinformation campaign already

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#226

Post by aembleton »

fishywang wrote: post #185
spxneo wrote: post #96

It's probably far worse with Android users that Google is not disclosing. I'm seriously considering changing to Apple after this. Not that its secure but that they are willing to go to this length to communicate it.

>It's probably far worse with Android users that Google is not disclosing. [citation needed]

https://dictionary.cambridge.org/dictionary/english/probably

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#227

Post by TheGuyWhoCodes »

EasyMark wrote: post #203
r00fus wrote: post #194

Earlier quoted context omitted.

[flagged]

[flagged]

The only one stirring up a regional war is Iran, arming terrorist groups around Israel as a proxy war. The fact they can act with impunity is a stain on the west just like the war in Ukraine that still rages on. This might not have been a bin laden level assassination but it was not that far and any other country that faces the same threat would do the same.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#228

Post by error503 »

astrange wrote: post #92
sneak wrote: post #58

Earlier quoted context omitted.

iMessage histories are backed up in the nightly automatic non-e2ee iCloud Backup, effectively backdooring iMessage’s “end to end encryption” by escrowing the plaintext to a not-endpoint. Apple can read approximately everyone’s iMessages out of their backups. It’s not private or secure, and claiming it is end to end encrypted is misleading almost to the point of being actually false.

That has nothing to do with turning it on or off since the same happens with SMS.

Nobody remotely versed in this stuff would expect SMS to be end-to-end encrypted, though to be honest the more notable fact to me here is that Apple can read any plaintext in your backups. iMessage is an over the top messaging service more akin to WhatsApp or Signal than it is to SMS, so that is a more relevant comparison. I don't know if any of the clients store plaintext messages that would be backed up to Apple in a similar manner or not, but I'd hope at least the more security focused ones do not.

Apple makes privacy claims about iMessage including 'Apple can’t decrypt the data.', which is notably false in this (common) scenario, and requires a large asterisk on those claims, IMO bordering on making them unethical, period.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#229

Post by quitit »

_the_inflator wrote: post #49

"Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware" So, maybe even provoking an Apple warning to those targets could also be part of a sophisticated operation. These targets react or have to react in a certain way. Instigate to lure people out of hiding and entice them to react, even i…

Apple advise whom to contact on their website for guidance, but they are of course not alone in dispensing this and similar advice.

Apple:

"If you have received an Apple threat notification We strongly suggest you enlist expert help, such as the rapid-response emergency security assistance provided by the Digital Security Helpline at the nonprofit Access Now. Apple threat notification recipients can contact the Digital Security Helpline 24 hours a day, seven days a week through their website. Outside organizations do not have any information about what caused Apple to send a threat notification, but they can assist targeted users with tailored security advice."

https://support.apple.com/en-lamr/102174

Amnesty International:

"The Access Now Helpline and other Security Lab civil society partners are also equipped to support individuals who have received these Apple notifications."

https://securitylab.amnesty.org/latest/2024/04/apple-threat-...

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#230

Post by terbo »

bee_rider wrote: post #8

There’s a reddit thread by somebody who got one of these: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece... The interesting thing IMO is they claim to just be some random college student. Which seems believable because if they were a real secret squirrel I guess they wouldn’t ask reddit about it, haha. I wonder if the hackers are targeting people based on phone numbers or something. (I could imagine a c…

In that thread someone asserted he received the first message after traveling to/through Cyprus

E: Thread: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece...

Post reply on HN