Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

11–20 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#11
post #8
post #4

Earlier quoted context omitted.

At least they’re trying? Meanwhile Google has spent 2 decades refusing to release a messenger that encrypts by default because they think they should be able to mine all your personal conversations. I take that back, they announced encrypted messaging, then never released it, then probably fired the engineer who said it’d be a feature in allo (or whatever their last attempt was).

Isn't Messages E2E by default?

How is that related? Encryption doesn’t really protect against malicious payloads being sent. Quiet the opposite actually as they can’t be scanned / stripped on the server.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#13
post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

They're slowly rewriting the whole thing in Swift which should eventually eliminate most of the non architectural attack vectors. Most of them were mitigated in iOS 14 where they did some rather large architectural changes.

Edit: Further info: https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#14
post #8
post #4

Earlier quoted context omitted.

At least they’re trying? Meanwhile Google has spent 2 decades refusing to release a messenger that encrypts by default because they think they should be able to mine all your personal conversations. I take that back, they announced encrypted messaging, then never released it, then probably fired the engineer who said it’d be a feature in allo (or whatever their last attempt was).

Isn't Messages E2E by default?

RCS is E2EE: https://support.google.com/messages/answer/10262381?hl=en

Though it can fall back to SMS in case you don't have data, which isn't E2EE. I'm not sure what the UX flow is like in that case, whether it warns you and asks for permission to send over less secure channel.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#15
post #4
post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

At least they’re trying? Meanwhile Google has spent 2 decades refusing to release a messenger that encrypts by default because they think they should be able to mine all your personal conversations. I take that back, they announced encrypted messaging, then never released it, then probably fired the engineer who said it’d be a feature in allo (or whatever their last attempt was).

I guess there is something now called "Rich Communication Services (RCS)"[0] in Messenges which supposedly is e2e encrypted.

[0]: https://support.google.com/messages/answer/13508703?sjid=102...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#16
post #11
post #8

Earlier quoted context omitted.

Isn't Messages E2E by default?

How is that related? Encryption doesn’t really protect against malicious payloads being sent. Quiet the opposite actually as they can’t be scanned / stripped on the server.

Yeah it is irrelevant but tw04 brought it up.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#17
post #12

I wonder if the lockdown mode would have prevented this attack? Has an iPhone in the lockdown mode been hacked so far, using a zero day vulnerability (not tricking the user to install a malicious program)?

It does. The page even recommends lockdown mode as a mitigation for affected parties (people who aren't updated)

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#18
post #4
post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

At least they’re trying? Meanwhile Google has spent 2 decades refusing to release a messenger that encrypts by default because they think they should be able to mine all your personal conversations. I take that back, they announced encrypted messaging, then never released it, then probably fired the engineer who said it’d be a feature in allo (or whatever their last attempt was).

No that's not true. Google just fails miserably at anything social, but almost every chat attempt from them eas encrypted, and now they are pushing RCS, which is also E2EE.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#19
post #12

I wonder if the lockdown mode would have prevented this attack? Has an iPhone in the lockdown mode been hacked so far, using a zero day vulnerability (not tricking the user to install a malicious program)?

Apparently it has before. Although not sure of this specific exploit.

https://techcrunch.com/2023/04/18/apple-lockdown-mode-iphone...

CL link : https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-ret...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#20
post #3

> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.

Some of the problems with iMessage have to do with the fact that it's integrated with the system SMS app. It seems that there are a large number of legacy requirements in the GSM spec that require the Messages app to be privileged in some way, especially with regards to automatic processing of data received. There have been plenty of iMessage or Messages related vulnerabilities.

I do wish there was a way to turn off automatic downloading of attachments like images etc. from at least non contacts. I think many/most other chat applications, by default, sanitize and/or format images and media on upload on the server by transcoding image data to prevent things like this and save bandwidth (e.g. Facebook/Meta appears to recompress images server side). However, there are obviously security and privacy considerations to doing this, and the client is not exactly something you want to trust to do this, so I can understand why they would be reluctant to implement something like this.

Perhaps this is one potential use of Treacherous (trusted) computing/remote attestation - the client runs a remotely attested signed binary code that will read an image file, encode the pixels as a jpg, and output a signed output that will only be accepted by the server if untampered.

Obviously, there would be issues with that approach as well, but it could potentially prevent the use of the iMessage network to send "crafted" media files.

Post reply on HN