Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

61–70 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#61

Post by carlmr »

Vexs wrote: post #59
jcims wrote: post #51

Earlier quoted context omitted.

I just did some analysis on this last weekend, in 2024 there were roughly 100 CVEs published every day. In April we hit approximately 200 per day. Going backwards from 2023, the doubling interval for published CVEs was approximately 4 to 4 1/2 years. Since then it’s approximately two years. There has definitely been a rapid uptick.

Published CVEs seems a bad metric to use for this- unless we assume that the ratio of really nasty vulns/not-too-bad vulns is consistent.

Also the question remains if more CVE laden code was produced in the first place, instead of automated detection improvements.

It's easier to find a needle in the haystack if the haystack is 50% needles.

Re: A 0-click exploit chain for the Pixel 10

#62

Post by orf »

mark_l_watson wrote: post #58
yogorenapan wrote: post #17

Earlier quoted context omitted.

I've reported security bugs to Apple before. Was a couple years back but I remember it taking around 6 months to patch (there was a couple back and forth for me to get a more reliable POC). Maybe 2 months from when I submitted a POC with 100% reproducibility

Not sure how much it helps, but I just run all my Apple devices in "Lockdown mode", don't install apps (use Safari), and try to mostly use Safari in private sandboxed mode.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you.

If you’re not then this seems quite paranoid, bordering on LARPing.

Re: A 0-click exploit chain for the Pixel 10

#63

Post by om42 »

Vexs wrote: post #59
jcims wrote: post #51

Earlier quoted context omitted.

I just did some analysis on this last weekend, in 2024 there were roughly 100 CVEs published every day. In April we hit approximately 200 per day. Going backwards from 2023, the doubling interval for published CVEs was approximately 4 to 4 1/2 years. Since then it’s approximately two years. There has definitely been a rapid uptick.

Published CVEs seems a bad metric to use for this- unless we assume that the ratio of really nasty vulns/not-too-bad vulns is consistent.

Another reason published CVEs isn't a great metric is that one of the largest contributors to the number of CVEs significantly increasing in the past couple years has been that the Linux kernel now submits almost all bugs as CVEs which wasn't the case before.

Re: A 0-click exploit chain for the Pixel 10

#64

Post by gruez »

shay_ker wrote: post #3

Hmmm... I'd like someone to double check my thinking here. I posted this exact prompt for gpt 5.5 xhigh: ``` does this look right to you? don't do any searches or check memory, just think through first principles static int vpu_mmap(struct file fp, struct vm_area_struct vm) { unsigned long pfn; struct vpu_core core = container_of(fp->f_inode->i_cdev, struct vpu_core, cdev); vm_flags_set(vm, VM_IO | VM_DONTEXPAND | VM…

That's not really a fair test because you're leading the model pretty hard, even if the prompt doesn't specifically say there's a bug to be found. It's basically the same objections that people raised in the thread where someone claimed current models are just as good as mythos.

Re: A 0-click exploit chain for the Pixel 10

#65

Post by [deleted] »

ftqalj wrote: post #52
revolvingthrow wrote: post #6

Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often? Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on

If one reads between the lines in part 1, the code in question was introduced due to AI features and the exploit was found by humans : https://projectzero.google/2026/01/pixel-0-click-part-1.html So AI usage increases bugs and humans have to weed them out!

[deleted]

Re: A 0-click exploit chain for the Pixel 10

#66

Post by krupan »

I followed the link to the Pixel 9 bug/exploit and saw this:

"Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user"

Haven't we learned our lesson on this? Don't read and act on my sms messages without me asking you to!

Re: A 0-click exploit chain for the Pixel 10

#67

Post by adikso »

jcims wrote: post #51
revolvingthrow wrote: post #6

Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often? Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on

I just did some analysis on this last weekend, in 2024 there were roughly 100 CVEs published every day. In April we hit approximately 200 per day. Going backwards from 2023, the doubling interval for published CVEs was approximately 4 to 4 1/2 years. Since then it’s approximately two years. There has definitely been a rapid uptick.

I wouldn't look at the numbers. There used to be a lot of "scam" CVEs before LLMs, that weren't actual vulns. Nowadays its more popular to collect CVEs, and there is a lot of people scanning with LLMs and reporting without checking (like it was in case of cURL). These CVEs are often not verified by anyone.

There probably is more vulnerabilities found, but the amount of CVEs is not a good metric.

Re: A 0-click exploit chain for the Pixel 10

#69

Post by krupan »

revolvingthrow wrote: post #6

Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often? Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on

There definitely is hype around AI as a security tool right now. Someone else pointed out that the rate of CVEs has gone up, but that doesn't tell is why.

This article doesn't mention AI helping find this bug. Seems like humans can still do that on their own.

Re: A 0-click exploit chain for the Pixel 10

#70

Post by mark_l_watson »

LPisGood wrote: post #60
mark_l_watson wrote: post #58

Earlier quoted context omitted.

Not sure how much it helps, but I just run all my Apple devices in "Lockdown mode", don't install apps (use Safari), and try to mostly use Safari in private sandboxed mode.

Are you at an above average risk of being targeted by a state level threat actor?

No, just keep the usual tax/finacial/health data on my devices.

I consider Anthropic's Mythros security bug finder mostly marketing, but other things worry me that there might be a global hack contagion: for example, a few months ago I saw in the news that an executive at a US security company was caught selling information to a hacking group.

Except for disabled Javascript compilation possibly slowing down web sites, not getting some attachments in messages, and some graphics not showing up on some web sites, having Lockdown mode set doesn't seem to affect anything I do. For dev I use VPSs with ssh set for ensuring SSH agent forwarding is strictly disabled, as are reverse tunnels.

It seems like doing little things like this make sense because it is such a tiny hassle to be a little safer.

Post reply on HN