Operation Triangulation: What you get when attack iPhones of researchers • Hacker News Board

Re: Operation Triangulation: What you get when attack iPhones of researchers

#131

Post by contingencies » Wed, Dec 27, 2023, 8:00 PM UTC

mike_hearn wrote: post #76

chatmasta wrote: post #61

Earlier quoted context omitted.

Or they have assets working at Apple... or they hired an ex-Apple employee... etc. That's the problem with this sort of security through obscurity; it's only secure as long as the people who know about it can keep it secret.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

APTs probably routinely identify and target such developers. With multi-million dollar payouts for single bugs and high state level actor attention, employee profiling is clearly a known attack vector and internal security teams probably now brief on relevant opsec. FWIW the only Apple kernel developer I knew has somewhat recently totally removed themselves from LinkedIn.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#132

Post by halJordan » Wed, Dec 27, 2023, 8:02 PM UTC

sampa wrote: post #79

chatmasta wrote: post #49

Earlier quoted context omitted.

Reading between the lines of TFA, it seems the researchers may also suspect that to be the case: > Our guess is that this unknown hardware feature was most likely intended to be used for debugging or testing purposes by Apple engineers or the factory, or that it was included by mistake. Because this feature is not used by the firmware, we have no idea how attackers would know how to use it. However, keep in mind that…

well of course nobody would have NSA_friendly_override() in the source plausible deniability is essential in such cases, hence the term bugdoor

This is the same conspiracy mindset of flat earthers, and you deserve your own netflix mockumentary over it.

Because a bug is a bug, it's very nature means you cannot prove it isn't malicious, therefore you take it as positive proof of malice and sit pretty bc no one can prove a negative.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#133

Post by stavros » Wed, Dec 27, 2023, 8:04 PM UTC

Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

What do you mean "no real progress"? The price used to be $100.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#134

Post by halJordan » Wed, Dec 27, 2023, 8:05 PM UTC

mike_hearn wrote: post #70

contingencies wrote: post #55

Earlier quoted context omitted.

Begins @ 27:21 In addition contents of the presentation, in terms of timeline... 2018 (September): First undocumented MMIO-present CPU launched, Apple A12 Bionic SOC. 2021 (December): Early exploit chain infrastructure backuprabbit.com created 2021-12-15T18:33:19Z, cloudsponcer.com created 2021-12-17T16:33:50Z. 2022 (April): Later exploit chain infrastructure snoweeanalytics.com created 2022-04-20T15:09:17Z suggestin…

It's really a pity they explain all the mistakes that helped the malware be detected.

It's not, it really isnt. Honestly just apply this mentality to one other scenario to test the waters. We should stop publishing yara rules because it flips our hand to the malware makers? It's nonsense to even say.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#135

Post by Despegar » Wed, Dec 27, 2023, 8:05 PM UTC

stavros wrote: post #133

Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

What do you mean "no real progress"? The price used to be $100.

I mean progress from today.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#136

Post by stavros » Wed, Dec 27, 2023, 8:07 PM UTC

Despegar wrote: post #135

stavros wrote: post #133

Earlier quoted context omitted.

What do you mean "no real progress"? The price used to be $100.

I mean progress from today.

I don't understand what you mean. They've always been making progress, driving the price up. They can just keep doing what they're doing, and there will be progress from today.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#137

Post by halJordan » Wed, Dec 27, 2023, 8:07 PM UTC

xvector wrote: post #90

Does Lockdown Mode prevent agains this?

It likely does. Lockdown mode stops most ios auto-processing wrt to message attachments and this was delivered via a message attachment.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#138

Post by Despegar » Wed, Dec 27, 2023, 8:10 PM UTC

stavros wrote: post #136

Despegar wrote: post #135

Earlier quoted context omitted.

I mean progress from today.

I don't understand what you mean. They've always been making progress, driving the price up. They can just keep doing what they're doing, and there will be progress from today.

Is that actually true? Has the price of these exploits been going up year after year, or has it topped out at some level?

Re: Operation Triangulation: What you get when attack iPhones of researchers

#139

Post by develatio » Wed, Dec 27, 2023, 8:12 PM UTC

Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

I am by no means a security expert whatsoever. Period. But reading the article carefully, there is a step in the chain of exploits (CVE-2023-32435) which depends on exploiting Safari. Apple implemented a "Lockdown mode" (https://support.apple.com/en-us/105120) which might have handled this (?).

Answering more broadly to your question, the "step-change" that you're asking for is precisely the "Lockdown mode" in iOS devices. It disables most of the features in order to reduce the attack surface of the device.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#140

Post by _ink_ » Wed, Dec 27, 2023, 8:15 PM UTC

WalterBright wrote: post #15

The extra hardware registers might have been discovered by examining the chip itself. One could find where the registers were on it, and notice some extra registers, then do some experimenting to see what they did.

Maybe, or somebody talked.