Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

91–100 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#91
post #25
post #22

Earlier quoted context omitted.

This is pure guesswork, I am not a security researcher, but my guess would be that AI is increasing the amount of low quality exploitable attack surface available, while simultaneously providing security researchers with an accelerant for their work. Which is to say, its great if you use it well and really bad if you use it poorly.

Not low quality if it works!

But it is low quality if it's vulnerable to exploits. And if that's the case, I wouldn't say it really "works".

Re: A 0-click exploit chain for the Pixel 10

#92
post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

"move fast and break things"

Re: A 0-click exploit chain for the Pixel 10

#93
post #32

Project Zero has to report bugs to Android through the front door, and deal with Android VRP severity classification? I always assumed they could just walk over to the Android office and advocate for their bugs, face to face.

If they felt it was too painful to do it the "normal" way then that would probably be the next thing for Project Zero try to get fixed.

Re: A 0-click exploit chain for the Pixel 10

#94
post #62

Earlier quoted context omitted.

Not sure how much it helps, but I just run all my Apple devices in "Lockdown mode", don't install apps (use Safari), and try to mostly use Safari in private sandboxed mode.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

LARPing is imagining that Lockdown mode protects you from state-level actors. It is frankly baffling why a industry that has been laughing for literal decades at even the possibility of stopping state-level actors just turns around and uncritically believes Apple's marketing team with literally zero support, evidence or proof except for a long track record of failure. You would think that extraordinary claims would demand extraordinary evidence.

We have seen multiple software hacks resulting in >10 million dollar payouts. Apple's bug bounty program only pays out 4 million dollars (2 million dollars (2x) more than non-Lockdown) for a zero-click total compromise that can trivially worm to take down hundreds of millions of iPhones simultaneously. Even at the low end of that cyberattack payout range that is still a >2x ROI if your successful cyberattack depends on a iPhone zero-click, with many publicly known attacks being in the 10x ROI range. Lockdown mode, at best, raises the bar slightly for commercial profit-motivated attackers and reduces their profit margin from wildly profitable to slightly less, but still, wildly profitable.

And of course I am using the Apple bug bounty program as merely a available metric with at least some semblance of objective support. There are zero certifications, audits, or analysis that Apple has even attempted that would confirm any claim of protection against state level actors.

Re: A 0-click exploit chain for the Pixel 10

#95

Do we have any evidence on how AI has affected NSO et als’ businesses? Does it render them obsolete? Or are they now superpowered?

I would expect it to supercharge them at first and become commoditized later on.

It is just like how a digital calculator affected the role of the human calculator, or how an automaton that can code would affect the job of a human programmer.

Re: A 0-click exploit chain for the Pixel 10

#96
post #94
post #62

Earlier quoted context omitted.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

LARPing is imagining that Lockdown mode protects you from state-level actors. It is frankly baffling why a industry that has been laughing for literal decades at even the possibility of stopping state-level actors just turns around and uncritically believes Apple's marketing team with literally zero support, evidence or proof except for a long track record of failure. You would think that extraordinary claims would d…

> We have seen multiple software hacks resulting in >10 million dollar payouts

This sets a nice price bar for exploitation. Is someone willing to pay 10+ million dollars to get access to your phone?

The obvious caveat here is that for a lot less than 10 million dollars someone can be hired to hit you with a metal pipe until you give up your passcode.

> click total compromise that can trivially worm to take down hundreds of millions of iPhones simultaneously

Where is the profit motive in doing this? Possibility is one thing, but a realistic threat is another.

Re: A 0-click exploit chain for the Pixel 10

#97
post #96
post #94

Earlier quoted context omitted.

LARPing is imagining that Lockdown mode protects you from state-level actors. It is frankly baffling why a industry that has been laughing for literal decades at even the possibility of stopping state-level actors just turns around and uncritically believes Apple's marketing team with literally zero support, evidence or proof except for a long track record of failure. You would think that extraordinary claims would d…

> We have seen multiple software hacks resulting in >10 million dollar payouts This sets a nice price bar for exploitation. Is someone willing to pay 10+ million dollars to get access to your phone? The obvious caveat here is that for a lot less than 10 million dollars someone can be hired to hit you with a metal pipe until you give up your passcode. > click total compromise that can trivially worm to take down hundr…

... really? Zero-click RCEs can be used on arbitrarily many phones until they are discovered which usually takes on the order of months. You do not need to burn them on every individual target.

As a example of how they might be used in that fashion for profit, NSO group had a revenue of 240 million dollars in 2020. Many of their customers were governments who wanted to spy on activists and journalists. NSO group was in the business of economies of scale to democratize access to journalist devices by reusing a small stockpile of exploits across many targets with enough revenue to assure a steady stream of new exploits as fast as they were burned.

Re: A 0-click exploit chain for the Pixel 10

#98
post #97
post #96

Earlier quoted context omitted.

> We have seen multiple software hacks resulting in >10 million dollar payouts This sets a nice price bar for exploitation. Is someone willing to pay 10+ million dollars to get access to your phone? The obvious caveat here is that for a lot less than 10 million dollars someone can be hired to hit you with a metal pipe until you give up your passcode. > click total compromise that can trivially worm to take down hundr…

... really? Zero-click RCEs can be used on arbitrarily many phones until they are discovered which usually takes on the order of months. You do not need to burn them on every individual target. As a example of how they might be used in that fashion for profit, NSO group had a revenue of 240 million dollars in 2020. Many of their customers were governments who wanted to spy on activists and journalists. NSO group was…

You’re right, I misstated. It’s not 10 million per exploitation, it instead limits the pool of people who can exploit you to those willing and have the ability to spend 10 million+ on an exploit.

That is still quite a small pool, and there are other network effects preventing any Joe blogs with that much capital from launching an exploitation campaign.

Re: A 0-click exploit chain for the Pixel 10

#99
post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

How are they going to make trillions of dollars if not!?

Re: A 0-click exploit chain for the Pixel 10

#100
post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

> Haven't we learned our lesson on this?

What is the purported lesson we should have learned? Users choose phones with rich messaging features. This was a major selling point for iPhone, first, with iMessage, and later with Android until iOS caught up with RCS.

Post reply on HN