Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

181–190 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#181

Post by saagarjha »

Gigachad wrote: post #150
orf wrote: post #62

Earlier quoted context omitted.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

I turned it on a week ago to see what it was like. I expected it to be significantly annoying, but I found basically nothing changed other than a bit of text in safari that says it's in lockdown mode. Otherwise I wouldn't have been able to to tell the modes apart. I was expecting the browser to be slower without JIT or use more battery but I haven't noticed any change, it's all still snappy. Apple over hypes the "you…

I take it that you mostly communicate with other people using services that are not iMessage.

Re: A 0-click exploit chain for the Pixel 10

#182

Post by saagarjha »

bri3d wrote: post #108
Veserv wrote: post #94

Earlier quoted context omitted.

LARPing is imagining that Lockdown mode protects you from state-level actors. It is frankly baffling why a industry that has been laughing for literal decades at even the possibility of stopping state-level actors just turns around and uncritically believes Apple's marketing team with literally zero support, evidence or proof except for a long track record of failure. You would think that extraordinary claims would d…

I strongly disagree that there is no evidence that Lockdown mode is effective; there have been numerous exposed, active iOS exploitation campaigns of which none have worked against Lockdown mode. When we're trying to prove a negative, that's actually some of the strongest evidence we can get. The economics of the device exploitation industry are completely orthogonal from bug bounty payouts; the markets only overlap…

I don't necessarily disagree but a lot of chains will bail out if they find like the Norton Antivirus app on your phone so

Re: A 0-click exploit chain for the Pixel 10

#183

Post by saagarjha »

naruhodo wrote: post #173
gruez wrote: post #64

Earlier quoted context omitted.

That's not really a fair test because you're leading the model pretty hard, even if the prompt doesn't specifically say there's a bug to be found. It's basically the same objections that people raised in the thread where someone claimed current models are just as good as mythos.

I don't agree, and I'd like to understand your point of view. To me, asking if a function has something wrong with it is just a very basic code review - something that should happen with every function. A competent, security conscious engineer would respond the same way as the model, unsurprisingly, since the model is... modelling competence.

Code review that finds problems in all code is useless.

Re: A 0-click exploit chain for the Pixel 10

#184

Post by saagarjha »

binkHN wrote: post #116

> This is rendered even easier by the fact that the kernel is always at the same physical address on Pixel OpenBSD fixed this back in 2017.

Most kernels have had KASLR support for well over a decade at this point. Linux does too but Pixel has it misconfigured.

Re: A 0-click exploit chain for the Pixel 10

#185

Post by saagarjha »

jeffbee wrote: post #32

Project Zero has to report bugs to Android through the front door, and deal with Android VRP severity classification? I always assumed they could just walk over to the Android office and advocate for their bugs, face to face.

This assumes that Android would listen to them.

Re: A 0-click exploit chain for the Pixel 10

#186

Post by saagarjha »

jeffbee wrote: post #35
NooneAtAll3 wrote: post #5

fascinating how GrapheneOS achieves high security level on the same hardware where Google failed to even randomize android's kernel location

KASLR isn't an effective mitigation against anything, and to me this is part of GrapheneOS's catalog of superficial but meaningless claims.

I feel like people who hate on KASLR are basically the IQ bell curve meme but you haven't really provided much evidence to show which tail you are on.

Re: A 0-click exploit chain for the Pixel 10

#187

Post by saagarjha »

tialaramex wrote: post #138
codedokode wrote: post #75

Earlier quoted context omitted.

> is a choice you can make when compiling software That is not a solution because it means the code can behave differently, and expose vulnerability if wrong compilation settings are chosen. The functions like "wrapping_add" have such a long names so that nobody wants to use them and they make the code ugly. Instead, "+" should be used for addition with exceptions, and something like "wrap+" or " " or "[+]" used for…

> That is not a solution because it means the code can behave differently, and expose vulnerability if wrong compilation settings are chosen. If the software is correct nothing changes. The existence of people who write nonsense but expect you to work around that doesn't change between languages, they write crap in Swift or Python or Javascript just the same. The long names are because there are, in fact, a lot of th…

Swift does those too but correctly ranks the options by likelihood of use.

Re: A 0-click exploit chain for the Pixel 10

#188

Post by angry_octet »

Worf wrote: post #145

I hope the average person will soon understand the importance of security and will be OK with making the necessary sacrifices to achieve it. Almost everyone has something to protect, be it personal information or property (money, IP). People love new technologies and features that make their lives easier, but so far only a small subset of these people have made a conscious decision to limit their exposure to risk by…

Claude summarises your rant:

TLDR: People are lazy about digital security, get badly burned, then act surprised. Don't be that person.

Re: A 0-click exploit chain for the Pixel 10

#189

Post by Gigachad »

saagarjha wrote: post #181
Gigachad wrote: post #150

Earlier quoted context omitted.

I turned it on a week ago to see what it was like. I expected it to be significantly annoying, but I found basically nothing changed other than a bit of text in safari that says it's in lockdown mode. Otherwise I wouldn't have been able to to tell the modes apart. I was expecting the browser to be slower without JIT or use more battery but I haven't noticed any change, it's all still snappy. Apple over hypes the "you…

I take it that you mostly communicate with other people using services that are not iMessage.

I’m not a heavy iMessage user but I use it a bit and I haven’t noticed a difference there either. Photos still load, maybe pdfs wouldn’t work?

Re: A 0-click exploit chain for the Pixel 10

#190

Post by saagarjha »

Gigachad wrote: post #189
saagarjha wrote: post #181

Earlier quoted context omitted.

I take it that you mostly communicate with other people using services that are not iMessage.

I’m not a heavy iMessage user but I use it a bit and I haven’t noticed a difference there either. Photos still load, maybe pdfs wouldn’t work?

It basically degrades back to SMS if you turn this on. Obviously, this is fine for a lot of things, but most people generally expect more than that out of their messaging app in this day and age.
Post reply on HN