Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

221–230 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#221

Post by karlgkk »

xnx wrote: post #218
krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

> requires message media to be decoded before the message is opened by the user I like seeing thumbnail previews of images in messages

I don’t know about android, but iOS has some pretty interesting architecture to prevent and sandbox that kind of attack

They put a lot of deliberate work to enable this feature in a way that is hard to exploit

And it really sounds like Google is not mentioning that stance

Re: A 0-click exploit chain for the Pixel 10

#222

Post by dnnddidiej »

thrownthatway wrote: post #159
lupire wrote: post #153

Earlier quoted context omitted.

Because many people know not trust unknown senders.

I should have said “a well crafted malicious email” or SMS etc.

Phishing is big business and ways to combat are not fool proof. Education helps. Spam detection helps.

Re: A 0-click exploit chain for the Pixel 10

#223

Post by zobzu »

zx8080 wrote: post #174
krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them! Because there is hardly one alternative: iphone (and Huawei, but maybe not everywhere). Not much to care about. We all need a new phone OS and hardware level. Urgently.

dude google is the one reporting on themselves here.

Re: A 0-click exploit chain for the Pixel 10

#224

Post by zobzu »

watchful_moose wrote: post #167
krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

Windows had autorun starting Windows 95, but stopped shipping it as a default in Windows 7 (2009). So, yeah, no we haven't learned our lesson.

extrapolating that line of thinking: "why does computer run malware, i asked it to not run malware ever!”

another fun parallel: "run this [...] and make no mistake ".

human context is just as bad as llms, i swear

Re: A 0-click exploit chain for the Pixel 10

#225

Post by zobzu »

microtonal wrote: post #206
wffurr wrote: post #148

Earlier quoted context omitted.

Apple's security posture with lockdown mode, memory tagging, and secure allocators is significantly better than Android. You can read some about it here: https://security.apple.com/blog/memory-integrity-enforcement...

I say this as a decades-long Apple user, but you fell for Apple's marketing. Yes, they do good in-depth security, but Google Pixel also supports memory tagging (MTE), secure allocators (Scudo), and has a mode similar to lockdown (Advanced Protection, which does similar mitigations and enables MTE). Also, in contrast to iPhones, Android traditionally relies a lot more on safe languages like Java and Kotlin (and now Ru…

additionally: Google reports on their own jail breaks (who is project zero?!! lol). apple does not.

in fact apple fixed several high criticality bugs like these not that long ago - they just dont talk about it other than "you must fix now".

same problems, different comms, and the more people do this, the less transparent google will be.

Re: A 0-click exploit chain for the Pixel 10

#226

Post by ptx »

codedokode wrote: post #7

I read about Pixel 9 Dolby Decoder bug, and it is based on integer overflow. It was a mistake to allow "+" operator to overflow, and this must be fixed in new languages like Rust, but it is not.

Huawei fixed it in their Cangjie language. According to the docs [1][2], it throws an exception by default and you can use an annotation to get wrapping or saturation instead.

(Cangjie seems like a pretty nice language in other ways as well. Similar to Kotlin with some improvements and no Java. Bootstrapping the toolchain from source seems difficult though.)

[1] https://docs.cangjie-lang.cn/en/docs/0.53.13/white_paper/sou...

[2] https://docs.cangjie-lang.cn/en/docs/0.53.13/spec/source_en/...

Re: A 0-click exploit chain for the Pixel 10

#227

Post by ozgrakkurt »

codedokode wrote: post #75
tialaramex wrote: post #31

Earlier quoted context omitted.

In Rust the decision about whether to pay for overflow checks or just wrap (because all modern hardware will just wrap if you don't check and that's cheaper) is a choice you can make when compiling software, by default you get checks except in release builds but you can choose checks everywhere, even in release builds or no checks even in debug. By definition in Rust it's incorrect to overflow the non-overflowing int…

> is a choice you can make when compiling software That is not a solution because it means the code can behave differently, and expose vulnerability if wrong compilation settings are chosen. The functions like "wrapping_add" have such a long names so that nobody wants to use them and they make the code ugly. Instead, "+" should be used for addition with exceptions, and something like "wrap+" or " " or "[+]" used for…

You can’t ergonomically report an error from +. Also it is terrible fundamentals to panic from fundamental operations imo.

So all operations should be function calls imo. There is not much point in having operators

Re: A 0-click exploit chain for the Pixel 10

#228

Post by Barbing »

thewebguyd wrote: post #127
GeekyBear wrote: post #115

Earlier quoted context omitted.

One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.

That should be the default behavior, not a special lock down option that also disables other features. Why can't they just make it like most email clients? No preview by default, give a banner with an option to explicitly allow a preview for that specific message or conversation?

>That should be the default behavior

It is! The phishers try to socially engineer their way into getting link previews or in fact clickable links period.

Screenshot here of the automatic link/preview disable-

https://www.bleepingcomputer.com/news/security/phishing-text...

Re: A 0-click exploit chain for the Pixel 10

#229

Post by anthk »

jiggawatts wrote: post #140
GeekyBear wrote: post #115

Earlier quoted context omitted.

One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.

Sorry, but that is an insanely defeatist attitude blended with a hint of blaming users for wanting features. Image decoders are pure functions and all should have been rewritten as 100% safe Rust years ago. Users need functionality. It’s up to us to figure out how to provide that safely. Saying to users they shouldn’t have those features isn’t sage advice, it’s admitting failure.

Rust wont save you from malicious SVG+JS files, EPS/PostScript files and so on.

Re: A 0-click exploit chain for the Pixel 10

#230

Post by anthk »

jiggawatts wrote: post #164
michaelt wrote: post #156

Earlier quoted context omitted.

The thing is, nobody's happy just previewing jpegs and pngs. Before you know it, people want to preview SVGs, PDFs, video, HTML and so on. And to do that properly means you've got to support obscure formats like JBIG2 and CCITT Fax. Malicious vector images with a billion elements to render. XML that lets one file embed another. And good luck getting the budget to re-implement them all from scratch in a better languag…

Most of these are solved problems to one degree or another. Web browsers have generally switched over to decoding legacy unsafe formats like PDF using safe managed languages, typically JavaScript. > JBIG2 and CCITT Fax Since performance isn't such a critical concern with obscure legacy formats, it really wouldn't be much more than a day or two of work for a competent developer with AI agent tooling to convert an exis…

> legacy unsafe formats like PDF using safe managed languages, typically JavaScript.

Are you ironic? If any JS and v8 have tons of CVE's.

Stop being deluded with these hip languages. Rust? you wish. Maybe inferno with proper namespaces AND in-kernel namespace support. No, not like Linux. LIke 9front.

https://app.opencve.io/cve/?product=v8&vendor=google

Post reply on HN