Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

Post reply on HN
Print view View original

121–130 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#121

Post by Taywee »

lionkor wrote: post #102
benreesman wrote: post #70

Earlier quoted context omitted.

Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…

The flaw in the idea of "rewrite it in rust" is that, next to the memory issues, the biggest issues are logic bugs. Rewriting something from scratch isnt going to magically not have bugs, and the legacy system likely has many edge cases covered that a modern new implementation will have to learn about first.

An improvement is an improvement. A flaw of seatbelts is that some people still die when they wear them. That's not a valid argument to not wear seatbelts.

Re: ‘Zero-click’ hacks are growing in popularity

#122

Post by xavxav »

benreesman wrote: post #112
xavxav wrote: post #101

Earlier quoted context omitted.

> Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust won't solve logic bugs but it can help bring up the foundations . So long as memory safety bugs are so pervasive we can't even properly reason on…

How much do I win if I can panic Rust without any “unsafe” whatsoever? Maybe I’ll index into some Unicode or something, haven’t decided.

A crash is signficiantly better than corruption. If you can force an `unwrap` you can cause a denial of service but with corruption, all bets are off.

Re: ‘Zero-click’ hacks are growing in popularity

#123

Post by falsenapkin »

xyzzy123 wrote: post #4

"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.

It's baffling that they won't at least disable previews for senders not in your contacts. Ideally they would provide a way to block certain types of senders outright. I will NEVER want to receive an iMessage from an unknown email address, but that's where all of the spam crap comes from.

Recently I was on my phone when I received an email address iMessage and the toast showed an absolutely insane link, when I opened iMessage (not even that conversation) to go delete the thread my phone screen went blank quickly 2 or 3 times in a row, something I've never seen before. I deleted the thread and turned the thing off.

Re: ‘Zero-click’ hacks are growing in popularity

#124

Post by kibwen »

zuzun wrote: post #71
xavxav wrote: post #45

Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…

Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.

Unsafe code is rarely necessary, especially unsafe code that isn't just calling out to some component in C. You can easily forbid developers from pushing any code containing `unsafe` and use CI to automatically enforce it.

Re: ‘Zero-click’ hacks are growing in popularity

#125

Post by benreesman »

kibwen wrote: post #118
benreesman wrote: post #114

Earlier quoted context omitted.

And frankly I don’t see how it’s even remotely fair to call a no-nonsense statement that some things are simplified versions of other things with a cheeky metaphor “condescending”. I could just as easily throw around words like “anti-intellectual” if my goal was to distract from the point rather substantially replying.

But Rust isn't remotely a simplified version of Haskell, and I'm not sure where you got that impression. It's inspired by several languages, but is predominantly a descendant of ML and C++. The only similarity they have is that Rust traits resemble Haskell typeclasses, but even there they are quite different in semantics and implementation.

Question mark operator is bind for Result? Derives show? Run that argument past someone who can’t quote chapter and verse.

Re: ‘Zero-click’ hacks are growing in popularity

#126

Post by [deleted] »

daniel-cussen wrote: post #111
can16358p wrote: post #83

Earlier quoted context omitted.

I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage. Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).

No, I would not blame the teams or their managers. You can't just blame a manager you've never met just because he's a manager, we're talking about the manager of Apple Music, they could very well be capable and well-minded, likely personally capable of coding. So let me give you another example in the same vein as C, where everybody uses a technology that is terrible, questioning it only at the outset, and then just…

[deleted]

Re: ‘Zero-click’ hacks are growing in popularity

#127

Post by Digit-Al »

sva_ wrote: post #8
stunt wrote: post #2

As a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.

This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…

You have to admire the ingenuity. Just wish it was being put to better use. I can't even fathom the amount of effort required to, basically, create an entire scripting language running in an environment like that.

Re: ‘Zero-click’ hacks are growing in popularity

#128

Post by Arrezz »

I have always wondered if the increasing technical complexity of the world and the bugs it will bring is faster than the efforts of bughunters/security industry. Often times it feels like a losing battle but I would love to see some research on the subject, might be hard to get any solid data however.

Re: ‘Zero-click’ hacks are growing in popularity

#129

Post by testermelon »

secondaryacct wrote: post #69
bouke wrote: post #36

Earlier quoted context omitted.

Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.

In window titles, that s fine. I like my French accents too but I can give them up for the hypervisor communication...

Japanese, Korean, Chinese, Arabic, Hebrew, Russian, Tamil, Thai, etc begs to be remembered.

Re: ‘Zero-click’ hacks are growing in popularity

#130

Post by benreesman »

kibwen wrote: post #118
benreesman wrote: post #114

Earlier quoted context omitted.

And frankly I don’t see how it’s even remotely fair to call a no-nonsense statement that some things are simplified versions of other things with a cheeky metaphor “condescending”. I could just as easily throw around words like “anti-intellectual” if my goal was to distract from the point rather substantially replying.

But Rust isn't remotely a simplified version of Haskell, and I'm not sure where you got that impression. It's inspired by several languages, but is predominantly a descendant of ML and C++. The only similarity they have is that Rust traits resemble Haskell typeclasses, but even there they are quite different in semantics and implementation.

I like Rust in a lot of ways, I write a fuckload of it and I get value from doing so. Not “praise the lord” value, but real value.

But the attitude is an invitation to getting made fun of. It’s absurdly intellectually dishonest when Rust-as-Religion people actively hassle anyone writing C and then get a little precious when anyone mentions Haskell and then extremely precious when they step on the landmine of the guy who likes Rust enough to know the standard, the compiler, the build tool, the people who wrote the build tool, and generally enough to put it in its place from a position of knowledge.

SSH servers? Yeah, I’d go with Rust. Web browsers? In a perfect world, lot of work. Even for Mozilla who timed the fuck out on it.

Everything ever so no security problem ever exists ever again? Someone called it the “green energy of software security” on HN like this year.

It’s not the coolest look that one of my “blow off some steam” hobbies is making those people look silly, but there are worse ways to blow off some steam.

Post reply on HN