Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

citizenlab.ca

Post reply on HN
Print view View original

11–20 of 314 posts

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#11

Post by jojobas »

canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

They didn't build themselves a tiered walled garden to be on an equal footing with others, either capability or speed-wise.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#13

Post by grezql »

canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

I wonder if this weakens their "security" argument in the appstore walled garden case.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#14

Post by mhh__ »

grezql wrote: post #13
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

I wonder if this weakens their "security" argument in the appstore walled garden case.

It seems like a fairly slam dunk argument that at very least they can't be trusted to do it of their own accord.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#15

Post by shakna »

keyle wrote: post #6
mulmen wrote: post #4

Earlier quoted context omitted.

This is a dupe but seems to go into more technical detail. There’s no mention of iMessage in The Guardian’s coverage.

It's all sensational articles though. Show me the bug they used to exploit iMessage. That'd be far more interesting that this Cold War madness we read everyday.

Whilst some details of the attack are still under wraps as Apple is still working on a fix, there is a considerable amount of detail under "The Attacks" [0].

The initial vector appears to exploit imagent, to cause the download and install Pegasus, in most cases. This is likely because imagent runs under the root user.

[0] https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#16

Post by mhh__ »

canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

This is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#17

Post by amluto »

canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

It’s not just the lack of sandboxing — iMessage uses language-level serialization of object graphs. This design is never suitable for sending across privilege boundaries. Apple should replace the format with a reasonable wire format. If this requires updates to apps that integrate with iMessage or breaks interoperability with older iOS versions, so be it.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#18

Post by ignoramous »

So, iiuc, this "zero-click" hack involved iMessage and payloads apparently injected via Apple's domains and the exfiltration of data through a tor-like network eventually reaching malicious servers.

Is anyone aware of any (FOSS) software (presumably intrusion detectors or indicators of compromise) for mobile phones that might help flag or even prevent such attacks?

TinyCheck [0] comes to mind, but it isn't truly mobile. TrackerControl [1] and Guardian Firewall [2] are perhaps the closest to something like this but concentrate on privacy more than on security.

[0] https://github.com/KasperskyLab/tinycheck

[1] https://trackercontrol.org/

[2] https://guardianapp.com/

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#19

Post by lemonspat »

mhh__ wrote: post #16
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

This is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.

I look at the “Apple cares about privacy” as a qualified “more than them other OS &mobile firms”, not “enough that you should blindly trust us”. No one’s security is perfect

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#20

Post by verroq »

mhh__ wrote: post #16
canofbars wrote: post #9

Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.

This is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.

When it come to security (and literally everything else), don't even both with with the "trust" part and skip directly to "verify".
Post reply on HN