Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

201–210 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#201
post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

I don't know if that is the right lesson. It's kind of like "don't click on links"... Err, no. You should be able to click any link without getting hacked.

I have always found the whole "Don't trust links" a faux-pax when it comes to user training. As it just means that the failure to secure systems in the first place has already failed.....

Re: A 0-click exploit chain for the Pixel 10

#202

Earlier quoted context omitted.

"Don't click on links" is not a solution, and it's not something people actually do, it's just something they think they do. Corporate Security will tell you that it's ok to click links to the payroll system or hr or vanta or the 'secure email service' or jira or github or to docusign or the microsoft office document that a partner company sent you or an amazon delivery notification, but not ok to click links in the…

In my company I regularly see genuine, legitimate emails that carry several huge red flags, like these conveyed to us on trainings. If I can plausibly claim I wasn't sure it was legit (ie it was sent from the outside form the sketchy looking host), I'd always report it internally as phishing attempt. Just to make the security work with it.

There's also something about "admin" and "HR" systems in companies where they ignore everything they told you not to do.

I don't think I've worked anywhere yet that does 2FA, SSO, or even a vaguely usable system that doesn't look like it was made 30 years ago in these departments.

Which is extra troubling as these systems are the ones with the PII!

Re: A 0-click exploit chain for the Pixel 10

#203

Earlier quoted context omitted.

I’m not a heavy iMessage user but I use it a bit and I haven’t noticed a difference there either. Photos still load, maybe pdfs wouldn’t work?

It basically degrades back to SMS if you turn this on. Obviously, this is fine for a lot of things, but most people generally expect more than that out of their messaging app in this day and age.

BRING BACK EMOTICONS!

Re: A 0-click exploit chain for the Pixel 10

#204

Earlier quoted context omitted.

The email client I use doesn't display images in an email until I explicitly ask it to.

Which came as a reaction to "tracking cookies" and the like being added to e-mail. It was a reaction, not a proactive response.

Rather than tracking cookies it's a form of delivery confirmation via unique url. One of the mitigations is to configure the server to unconditionally fetch (and retain) all embedded media immediately on receipt of the message. Which makes the BigTech example all the more egregious.

Re: A 0-click exploit chain for the Pixel 10

#205

Earlier quoted context omitted.

Are you at an above average risk of being targeted by a state level threat actor?

No, just keep the usual tax/finacial/health data on my devices. I consider Anthropic's Mythros security bug finder mostly marketing, but other things worry me that there might be a global hack contagion: for example, a few months ago I saw in the news that an executive at a US security company was caught selling information to a hacking group. Except for disabled Javascript compilation possibly slowing down web sites…

For the most part "AI Exploit Research" is just lots of automated fuzzing. It's nothing new, it just takes time, and they're just throwing a lot of CPU/GPU at that

Re: A 0-click exploit chain for the Pixel 10

#206
post #148

Where are the iPhone jailbreaks didn’t see anything since a long time.. what’s happening? Did I miss them or isn’t anything available? I mean props to Apple however they do it but is it a matter of time in regard to the current timeline or what is actually going on?

Apple's security posture with lockdown mode, memory tagging, and secure allocators is significantly better than Android. You can read some about it here: https://security.apple.com/blog/memory-integrity-enforcement...

I say this as a decades-long Apple user, but you fell for Apple's marketing. Yes, they do good in-depth security, but Google Pixel also supports memory tagging (MTE), secure allocators (Scudo), and has a mode similar to lockdown (Advanced Protection, which does similar mitigations and enables MTE).

Also, in contrast to iPhones, Android traditionally relies a lot more on safe languages like Java and Kotlin (and now Rust). Of course, iOS is improving there as well with Swift.

The issue is that all other Android vendors outside Google Pixel and to some extend Samsung are just terrible when it comes to device security.

Finally, it should be said that iOS was also compromised relatively quickly according to leaked Cellebrite presentations. The only system they could not compromise at the time was GrapheneOS, because they fully use Pixel hardware security features and do a lot of additional mitigations (including many that iOS doesn't use).

Also, any discussion of iOS should come with a fat disclaimer that by default iOS devices have a huge hole: most people use iCloud Backups (and are nudged towards it) without ADP, so their iCloud backups are not end-to-end encrypted and their chats, etc. can be requested by law enforcement. That you yourself use ADP does not really matter if the people you are communicating with don't. Also, Apple manages the key dictionary for iMessage, etc. so they could insert themselves. I would not be surprised if default non-E2E backups are a compromise in the extension of the NSA PRISM program that Apple already participated in before the Snowden leaks.

Of course, Google isn't any better, but just to say that Apple's security/privacy story is selective. Yes, they help protecting against some malicious groups and non-allied states, but they also make sure that US law enforcement (and probably some allied powers) can access most data.

Re: A 0-click exploit chain for the Pixel 10

#207

Earlier quoted context omitted.

Given that 42% of Android devices are unpatched as of now [1] it's an interesting decision on their part to release their research and make them all vulnerable [1] https://gs.statcounter.com/android-version-market-share [2] https://www.cybersecurity-insiders.com/survey-reveals-over-1...

That's perennially the case. A big portion of the world buys bargain-basement android devices that are unsupported right out of the box. Search "android phone" on aliexpress and there's top selling phones on the first page running android 8, android 10, etc. They're not getting security updates of any sort, let alone driver updates.

It frustrates me no end that there's so many fly-by-night Android phones available from China. But with zero way to change the software on them. It's not even like they're running weird chips either.

It would be nice to find one where the bootloader is unlockable, and you can just build a standard Android image and flash it..

Re: A 0-click exploit chain for the Pixel 10

#208

Earlier quoted context omitted.

Given that 42% of Android devices are unpatched as of now [1] it's an interesting decision on their part to release their research and make them all vulnerable [1] https://gs.statcounter.com/android-version-market-share [2] https://www.cybersecurity-insiders.com/survey-reveals-over-1...

The old way of keeping security bugs private is just completely broken now. If you aren't on a device that gets security updates you are in significant danger, regardless of what Google decides to publish. No name hackers are sitting on stacks of exploits these days and are actively using them.

"Now"

Everything you describe is absolutely nothing new. It's literally where the name "0day" comes form.

Re: A 0-click exploit chain for the Pixel 10

#209
post #59
post #51

Earlier quoted context omitted.

I just did some analysis on this last weekend, in 2024 there were roughly 100 CVEs published every day. In April we hit approximately 200 per day. Going backwards from 2023, the doubling interval for published CVEs was approximately 4 to 4 1/2 years. Since then it’s approximately two years. There has definitely been a rapid uptick.

Published CVEs seems a bad metric to use for this- unless we assume that the ratio of really nasty vulns/not-too-bad vulns is consistent.

There's been CVE's published for software that didn't even exist!

Re: A 0-click exploit chain for the Pixel 10

#210
post #61

Earlier quoted context omitted.

Also the question remains if more CVE laden code was produced in the first place, instead of automated detection improvements. It's easier to find a needle in the haystack if the haystack is 50% needles.

have the AI vibe code crappy apps so the related AI vuln finder can fix them just doubled the value and use cases of your AI solution!

They've been doing that for a long while.

Publish something to Github in a public repo? It pulls it, scans it, and reports!

Especially if you accidentally put in keys

Post reply on HN