Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

appleinsider.com

Post reply on HN
Print view View original

131–140 of 177 posts

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#131

Post by swiley »

ComodoHacker wrote: post #129
swiley wrote: post #124

Earlier quoted context omitted.

>Perfectly secure computers are an oxymoron. They don’t exist. Absolutely, but creating a platform the encourages or forces users to do the wrong thing is a regression from where we were ten years ago. >iOS is the least worst mobile option No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. T…

>so you have one piece of software to exploit and now you can attack everyone. The extreme lack of diversity makes these sorts of complex exploits much more profitable. The flip side is the lack of diversity makes patching easy. Good luck pushing an update patching a 0-day affecting 3-4 Android versions to 60% of devices.

That's why you should be using dynamic linking, something these closed mobile OSes effectively prohibit.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#132

Post by rsync »

j45 wrote: post #85

I wonder if there is a way to disable iMessage and iTunes usage. With windows server I used to have a target of balance in any attack footprint.. if Microsoft provided the OS, the component services that the server exists to provide should always try to be third party software (db, web server, etc) to try and minimize one type of escalation vulnerabilities… while possibly opening up to another, hopefully less worse s…

You can block or restrict these with the (free) tool apple publishes called “apple configurator”.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#133

Post by dr-detroit »

swiley wrote: post #71
cunthorpe wrote: post #62

Earlier quoted context omitted.

To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.

You could do far better than iOS. Worse though is that it encourages very poor infosec because when it's profitable for Apple and often makes doing things correctly difficult or impossible.

Well, I mean there's always systemd. What are we talkin here, Gentoo?

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#134

Post by nemothekid »

swiley wrote: post #130
nemothekid wrote: post #128

Earlier quoted context omitted.

> No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient Just because it's FOSS doesn't mean it's secure. If your problem is privacy then sure, the PinePhone is the least worst mobile option. If your problem is security I don't see how a phone that doesn't have hardware embedded key manager is a…

>Just because it's FOSS doesn't mean it's secure. Right, but it does mean you won't be forced to do things the wrong way because it makes Apple money. >hardware embedded key manager This means keeping copies of keys unencrypted (or encrypted with a key on the same device which is effectively the same) on the device. You're just a couple exploits away from sharing the keys at that point so many people argue that these…

>Right, but it does mean you won't be forced to do things the wrong way because it makes Apple money.

I don't understand this point. What's wrong with downloading binaries from a trusted distributor (Apple)?. If you agree that just because it's FOSS doesn't mean it's secure, then downloading binaries is as "right" as you are going to get when it comes to mobile app distribution. It's no different than downloading binaries from apt.

>This means keeping copies of keys unencrypted (or encrypted with a key on the same device which is effectively the same) on the device.

No. The whole point of the Secure Enclave means the keys never leaves the hardware - they never touch the main memory and the keys can never be read out of the chip. You are never "a few exploits away" from getting the keys because there is no mechanism to read the keys at all. This also prevents attacks on the device itself - you cannot brute force an iPhone without the Secure Enclave locking you out. I'm not certain (and I really doubt) the PinePhone is resistant to physical attacks.

>Sure but you can't even guess at which messenger I use. Attacking me means taking expensive professional time and focusing it on one person.

The article is about journalists who were targeted by a state sponsored cyber security firm. This is a moot point, not to mention security by obscurity doesn't work.

>The FOSS OS approach where knowledgeable people protect those who aren't knowledgeable (without restricting their rights) is a significantly more advanced social structure.

Except that, in practice, this is no different (and arguably worse) than just trusting Apple. It turns out knowledgeable people do not work for free, most other knowledgeable people don't read the code or recompile sources, and FOSS maintainers aren't always properly equipped to ship secured software. Heartbleed is poster child for this.

I'm not saying that it's impossible for there to be secure FOSS code, but that it's incredibly difficult to ship secure code at all in any situation. For the non-technical person it's far easier to trust platform that is hardened from the outset (like the iPhone) that has a well-funded security team (like Apple) and is recommended by other security professionals.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#135

Post by dr-detroit »

j45 wrote: post #90
swiley wrote: post #28

Earlier quoted context omitted.

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

iOS is currently the least worst mobile solution as a daily driver for the majority of people who are users before techies. It doesn’t mean it’s good enough but I’d be curious to hear your ideas for what could work as easily for the masses.

I would air gap the masses if were really trying to address the root cause of problems

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#137

Post by reader_mode »

certnlyuncertn wrote: post #102
jdavis703 wrote: post #57

Earlier quoted context omitted.

Journalists from celebrity gossip reporters to foreign affairs correspondents needs to take security seriously. Even gossip journalists receive information from sources that ranges from information that would get the source fired or blacklisted to put in jail (e.g. LA sheriffs leaking celebrity photos).

How likely is it that people are exploiting zero days against reporters in any of those examples though. That's why threat models are different for different types of journalism.

Does it take a zero day when you install random freeware crapware from the store ?

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#138

Post by tablespoon »

swiley wrote: post #124
andrewzah wrote: post #105

Earlier quoted context omitted.

Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is…

>Perfectly secure computers are an oxymoron. They don’t exist. Absolutely, but creating a platform the encourages or forces users to do the wrong thing is a regression from where we were ten years ago. >iOS is the least worst mobile option No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. T…

> No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. The rest of the options are so bad that you're probably better off without a mobile phone at all.

There's nothing about FOSS that makes something secure, and building secure software is so hard and expensive that my guess is that you need the sponsorship of a government of major corporation to do so. Some FOSS does have such sponsorships, but a lot doesn't.

IIRC I've even heard that OpenBSD, despite its reputation, may no longer more secure than Linux due to Linux's manpower advantage. I don't even have to look up the numbers, but Apple definitely has a major security manpower advantage over the people making the Pinephone.

That's not to put down the Pinephone, but we have to be reasonable about what a project like that is and what is can (and cannot) achieve.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#139

Post by fsflover »

gjsman-1000 wrote: post #23
caymanjim wrote: post #21

Earlier quoted context omitted.

It's not paranoia when it's true. While most people value the convenience of conventional phones calls and default messaging applications over true privacy, those who prefer privacy aren't being paranoid. Companies are monitoring communication to increase ad revenue; government are monitoring communication to catch criminals, enable industrial espionage, and suppress dissent. It's only paranoia if it's delusional. We…

Yes, but if you are that paranoid and worried about it, the fact remains you should not carry an electronic device. This person is so paranoid, that they believe that a cyberweapon developed by a private company in Israel that uses previously-unknown bugs in the most sandboxed messaging system you can get on a phone are going to be deployed against them, so they should not use the calling, texting, or any other "phon…

You could carry a device with kill switches and only turn them on when you need a connection. See: Librem 5 and Pinephone.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#140

Post by jonfw »

swiley wrote: post #115
LucidLynx wrote: post #97

Earlier quoted context omitted.

I suppose you have examples to propose?

It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.

> average joe

> building them from source

An average joe doesn't even know what 'build from source' means

Post reply on HN