I've a question. This 0-day is a 0-click that didn't require any document download or anything. Simply visiting a http site would do it. What if you have JavaScript disabled be default. Would this exploit still work?
0-days exploited by commercial surveillance vendor in Egypt
121–130 of 254 posts
Re: 0-days exploited by commercial surveillance vendor in Egypt
#122Earlier quoted context omitted.
EAL4+ is useless against the prevailing threat actors as can be seen time and time again. There is no point at aiming for inadequate; even if you get there you still get nothing. EAL6-7 certifications are basically the only known, existing certifications that have any evidence supporting that they are adequate to defend against the known and expected threats. As far as I am aware, there are no other certifications ev…
> EAL4+ is useless against the prevailing threat actors Hold on a second. Assurance level is about, well, level of assurance the developers can provide. It is in most cases just paperwork. CC has a different mechanism to define attacker capability & resources (cant recall what it's called) and set the security goals accordingly
The AVA_VAN (vulnerability analysis) Security Assurance Requirement (SAR). AVA_VAN.4 requires “resistance to penetration attackers with a moderate attack potential”. AVA_VAN.4 is only required for EAL5 and higher.
You could individually incorporate a higher AVA_VAN into a lower EAL as a augmentation, but few do that. You also do not get any of the other conformance assurances that a higher EAL gives you. There is a reason we use EAL as a whole instead of just quoting the AVA_VAN at each other.
Though maybe you are talking about the Security Functional Requirements (SFR) which define the security properties of your system? That is somewhat orthogonal. You have properties and assurance you conform to the properties. Conformance more closely maps to “level of security” as seen in the AVA_VAN SAR. However, the properties are just as important for the usage of the final product because you might be proving you absolutely certainly do nothing useful.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#123It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels…
The article is mainly about the iphone exploit chain: Safari exploit -> PAC bypass -> kernel exploit. Android version was pretty similar but I think needed two more exploits to bypass Linux kernel mitigations. PZ has a good technical writeup.
Who is PZ?
Re: 0-days exploited by commercial surveillance vendor in Egypt
#124Earlier quoted context omitted.
It's a small group but a wide pool. It's not like the same person finds 10 0days. And until they do find their one exploit most of them have pretty much no credentials at all. So how do you avoid hiring 10,000 up and comers that never actually come up?
The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.
They could certainly go out and try and hire some of the best iOS vuln researches. But if they hire the top 10 out there, then #11 gets a massive payrise to go and work for one of the spyware companies.
And if Apple is paying huge amounts of money and getting into bidding wars with all the other companies out there for vuln researches, that'll attract a load more people to start hunting.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#125Earlier quoted context omitted.
The article is mainly about the iphone exploit chain: Safari exploit -> PAC bypass -> kernel exploit. Android version was pretty similar but I think needed two more exploits to bypass Linux kernel mitigations. PZ has a good technical writeup.
Who is PZ?
Google's Project Zero.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#126I've a question. This 0-day is a 0-click that didn't require any document download or anything. Simply visiting a http site would do it. What if you have JavaScript disabled be default. Would this exploit still work?
it's http interception so no, I doubt javascript matters at all
Re: 0-days exploited by commercial surveillance vendor in Egypt
#127Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?
These exploits are weapons. Look at what governments pay for weapons. That's hard to compete with.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#128It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels…
The article is mainly about the iphone exploit chain: Safari exploit -> PAC bypass -> kernel exploit. Android version was pretty similar but I think needed two more exploits to bypass Linux kernel mitigations. PZ has a good technical writeup.
The only Project Zero write up recently about android sandbox escapes appears to be on a different, ALSA based and Samsung specific vulnerability.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#129It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels…
They state that they were unable to capture the follow-on stages of the Android chain, they only got the initial execution component.
Which means there’s missing a sandbox escape and privilege elevation bug.
Also yes while delivery here was apparently ISP level MiTM using lawful intercept capabilities, there’s no reason the exploit couldn’t be delivered as a 1click via a phishing link.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#130It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels…
Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
On Android, you usually need three exploits.
1. Chrome code execution (gain foothold inside Chrome process).
2. Sandbox escape (gain code execution outside the Chrome sandbox, with the privileges of the Chrome process, which aren’t very useful except to stage another exploit).
3. Local privilege escalation, usually a kernel bug or similar, to elevate to root where you can break the process “sandbox” and establish persistence.