Hackers used zerodays to infect Windows, iOS, and Android users • Hacker News Board

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#141

Post by mike_d » Sat, Mar 20, 2021, 6:13 AM UTC

choeger wrote: post #45

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…

It did not rely on a Chrome CVE, it just included a Chrome exploit.

What they found was a server that served up the correct exploit for the platform making the request, and were able to coax a bunch of iOS and Chrome exploits out of it. This doesn't mean that the attackers didn't have other browser exploits or that Firefox exploits couldn't have been dropped into the same framework.

In fact, if you start trolling around in Tor, you're likely to find a ton of Firefox exploits because Tor Browser is obviously based on Firefox.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#142

Post by Delk » Sat, Mar 20, 2021, 6:25 AM UTC

sodality2 wrote: post #137

ipaddr wrote: post #133

Earlier quoted context omitted.

Why do you think firefox is tracking you?

It was a response to >most sites could just use that They wouldn't use it (or the VAST majority wouldn't) because it means losing tracking.

I guess in an ideal world, the default might be something simple enough (akin to Gemini), and using a more flexible and complex technology that comes with all the security and privacy implications would be distinguishable from the simpler sites and using them would require and allow user discretion. That might place web apps somewhere between plain websites and applications installed on the computer (or phone or whatever).

If implementing your site as an app rather than using something like Gemini came at the price of making people think twice, in theory there might be an incentive to only do web apps when it's actually needed.

But of course not that many people would use that kind of discretion, not to mention "ooh, shiny!"

And it's hard to put the genie back in the bottle anyway.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#143

Post by jokoon » Sat, Mar 20, 2021, 9:33 AM UTC

kube-system wrote: post #81

jokoon wrote: post #80

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less crit…

If you don't want it to happen, then why not become one of the people trying to prevent attacks from being successful? The best way to stop future attacks is to make current attacks unsuccessful.

It's more interesting to understand the motives of attacks. Often, attacks have a geopolitical or political motive.

So the whole point of security, digital or physical, is power.

For now, I really don't see the point of working in security for a single reason: there is NO REGULATION on measures of security when writing software. You can find millions of regulations for making physical products, but very few for software when it comes to security.

Of course, governments have higher standards, but law should mandate that insurance companies be able to evaluate cyber risks, so there should be regulations regarding computer security.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#144

Post by saagarjha » Sat, Mar 20, 2021, 10:02 AM UTC

modeless wrote: post #127

caslon wrote: post #108

Earlier quoted context omitted.

> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface…

> Safari and Chrome share likely near 70% This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).

The JS engine is part of Blink and WebKit, but yes, they are essentially entirely different.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#145

Post by saagarjha » Sat, Mar 20, 2021, 10:05 AM UTC

jbverschoor wrote: post #138

AlwaysRock wrote: post #114

Earlier quoted context omitted.

I think the average person doesn't know how to prevent it and believes that learning out would be beyond their abilities.

No, they just really don’t care. If they did, there would be more effort and knowledge about the subject

There is very little the average person can do to protect themselves, other than just avoiding using the internet altogether.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#146

Post by saagarjha » Sat, Mar 20, 2021, 10:07 AM UTC

corty wrote: post #31

pacificmint wrote: post #7

If a PC is infected I can (and should) reinstall everything from scratch. That should remove the malware, barring some super resistant malware that hides in the BIOS or something like that. What do you do on an iOS device? Does a full device reset reinstall the OS, or does it simply remove all user settings? I feel like the locked down nature of iOS makes it harder to attack, but if an attack goes thru it would also…

Reinstalling everything from scratch is a good start, but persistence of an exploit can easily be achieved through most data backups. Nobody wants to part with their important Word and Excel files, so those will get restored onto the fresh machine, carrying all the usual embedded macro nasties that an attacker planted there. Of course you can try to be diligent and skip everything that is potentially a problem, but i…

> persistence of an exploit can easily be achieved through most data backups

Not on iOS.

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#147

Post by saagarjha » Sat, Mar 20, 2021, 10:11 AM UTC

dave_sullivan wrote: post #27

Been playing with tools like angr lately and learning more about binary analysis. It seems to me that "automatic exploit generation" is improving quite a bit where the infrastructure for analysis is a little tricky to set up, but then you can direct that infrastructure to analyze the code for you. The bad guys and good guys are in a race to find new exploits faster (they always have been) but I've been pretty amazed…

angr is cool and all (disclaimer: I know many of the people who work on it) but we’re not really at a point where you can just point automated tooling at software and get results. That isn’t to say that code analysis tools are not heavily used by people finding exploits, but their effectiveness is limited by the difficulties of analyzing code and the fact that the “good guys” have access to pretty much the same tooling. (In fact, their tooling is better in a sense because it often runs in better conditions like with full source code and lack of a need to find a full exploit for every bug.)

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#148

Post by cutemonster » Sat, Mar 20, 2021, 10:27 AM UTC

anonymouse008 wrote: post #111

cutemonster wrote: post #110

Earlier quoted context omitted.

> telling people to use computers for less critical tasks, and disengaging from certain areas. I think I a bit can understand how you think. Looking at some health care related apps, I was surprised to see how buggy they were (the user interface) and silly built, wrt security. On the other hand, without computers, the alternative seems to be that the health care staff picks up the phone and just assumes you are the o…

Which ones may I ask? I’ve been shocked to learn how many online EHR/EMRs work... it’s a bit frightening to think it would be trivial to find large densities of ailments / preconditions to exploit at a state level.

I'm in northern/western Europe, a not that large country, some small health care providers here.

(I guess you're in the US?)

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#149

Post by strogonoff » Sat, Mar 20, 2021, 1:22 PM UTC

molsongolden wrote: post #121

strogonoff wrote: post #9

It seems that a watering hole attack by definition targets users of a particular organization, but articles on this event make no mention of which organizations would that be, sounding like it affects general public. Wondering who should be worried. Related: can community recommend some forums, periodic publications or other sources that aggregate information security news?

Risky.biz podcast r/netsec

Nice, didn’t know about Risky.biz!

Re: Hackers used zerodays to infect Windows, iOS, and Android users

#150

Post by modeless » Sat, Mar 20, 2021, 4:33 PM UTC

saagarjha wrote: post #144

modeless wrote: post #127

Earlier quoted context omitted.

> Safari and Chrome share likely near 70% This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).

The JS engine is part of Blink and WebKit, but yes, they are essentially entirely different.

I don't know about JSC, but V8 is very much a standalone project. I guess you could define it as just part of Blink but I don't think that's a very useful definition.