Ouch.
Apparently Firefox has "Https First" also but requires the pref dom.security.https_first to be set.
"HTTPS-Only Mode" is obviously best if you can do that.
0-days exploited by commercial surveillance vendor in Egypt
11–20 of 254 posts
Re: 0-days exploited by commercial surveillance vendor in Egypt
#12It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels…
Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing, implies there should be an exploit chain but we've only been told of the first.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#13Another company founded by ex-Israeli intelligence. The funny thing about exploits is, once hundreds of employees or soldiers have access to the exploit, they don't need to physically copy the code. They just need to understand how it works, to then open 10 other companies that use the same exploit, or sell it to 20 other companies on the dark web. Although the IDF is great at stopping people from copying files outsi…
For every 1 zero day, there are around 10-20 others that haven't been publicized. You can make plenty of money by trying to find a niche and concentrating on that (eg. android exploitation, iOS exploitation, Windows exploitation, APAC buyers, US Defense buyers, Middle Eastern buyers, EU buyers, etc).
Re: 0-days exploited by commercial surveillance vendor in Egypt
#14Earlier quoted context omitted.
Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…
Gotcha, thank you.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#15Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-me...
Hey, they nearly destroyed the Ottoman Empire in the 1840s...
Re: 0-days exploited by commercial surveillance vendor in Egypt
#16Though HTTPS is better than nothing, and this attack relies on HTTP to inject the initial payload, state sponsored attackers in some countries can likely just subvert CA or CDN infrastructure instead.
Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt!
Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me
Re: 0-days exploited by commercial surveillance vendor in Egypt
#17Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration att…
Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?
Re: 0-days exploited by commercial surveillance vendor in Egypt
#18Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-me...
[deleted]
Re: 0-days exploited by commercial surveillance vendor in Egypt
#19Another company founded by ex-Israeli intelligence. The funny thing about exploits is, once hundreds of employees or soldiers have access to the exploit, they don't need to physically copy the code. They just need to understand how it works, to then open 10 other companies that use the same exploit, or sell it to 20 other companies on the dark web. Although the IDF is great at stopping people from copying files outsi…
[deleted]
Re: 0-days exploited by commercial surveillance vendor in Egypt
#20[deleted]
[deleted]