Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

appleinsider.com

Post reply on HN
Print view View original

141–150 of 177 posts

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#141

Post by jonfw »

gjsman-1000 wrote: post #58
fjtktkgnfnr wrote: post #40

Earlier quoted context omitted.

Those are always targeted extra hard since they tend to be used by criminals. See the recent "encrypted phones" (Encrochat, Anom, ...) If you really care about security maybe it's better to get a really dumb 4G phone and share it's connection with a Linux small form tablet (but not running Android). Of course, inconvenient as hell, but much more secure, especially since you are not running the iOS/Android mono-cultur…

But then you are vulnerable to physical attacks. You don't have hardware root of trust, so installing a PIN-guessing tool is easy. Extracting the encrypted data for attacking it on a computer outside the phone is also easy.

So don't use a PIN?

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#142

Post by nonameiguess »

jackson1442 wrote: post #123
nonameiguess wrote: post #29

Apple needs to make it possible for users to choose other ways of sending and receiving messages and listening to music, or of choosing not to do either of those things if they don't want to. Obviously, you can currently install and use other applications that provide the same functionality, but you cannot uninstall or disable defaults. The most shocking experience to me in trying to evaluate the Mac ecosystem when t…

Your headphones are probably sending a play command to your computer. There should be some software you can grab that captures that command and routes it to the application of your choosing, or disables it entirely. Unfortunately it's not built in, but I think it's your headphones doing something nonstandard because my Sony XM4s and AirPods do not fire this behavior when I put them in.

I'm using XM4s and have never done anything to change whatever their own default behavior is. And this doesn't happen on any other device except the Macbook.

I guess it's worth looking into to see if there is some outside of the OS way to force the OS to route requests to the application I already have opened and foregrounded that plays sound, but I would expect that to be the default behavior. What is a "play" request to music.app even supposed to do when I have never intentionally opened the app and don't have a playlist set up? It doesn't actually play anything since there is nothing to play. It just opens the app and takes over my screen.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#143

Post by deregulateMed »

andrewzah wrote: post #105
swiley wrote: post #28

Earlier quoted context omitted.

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is…

>iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever.

Speaking of companies lying... You are holding your phone wrong, and your keyboard works fine.

Oh and your apps might have a backdoor, but it took getting sued by Epic for us to let anyone know that.

Apply lying is about as common as a politician lying.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#144

Post by nacs »

nemothekid wrote: post #99
nonameiguess wrote: post #29

Apple needs to make it possible for users to choose other ways of sending and receiving messages and listening to music, or of choosing not to do either of those things if they don't want to. Obviously, you can currently install and use other applications that provide the same functionality, but you cannot uninstall or disable defaults. The most shocking experience to me in trying to evaluate the Mac ecosystem when t…

> where I'm using bluetooth headphones, take the headphones off and put them back on, and music.app automatically opens and comes to the foreground of my desktop I think your bluetooth headphones are sending a play command to your device when it's connected. I'm sure it's annoying, but I think your macbook is doing the right thing here.

> your bluetooth headphones are sending a play command to your device

Yep this is what's happening. I have a car bluetooth addon that I purchased that does the same thing -- it sends Play commands to the phone on-connect repeatedly until something starts playing.

By default the phone will open Apple Music but if I already had been playing music on the Spotify app, it'll just start playing that instead.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#145

Post by ekidd »

andrewzah wrote: post #105
swiley wrote: post #28

Earlier quoted context omitted.

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is…

> But parsing and memory safety are hard. Like, really hard.

This doesn't have to be the case. Start by avoiding C and C++. Use Java (on Android) to write parsers. It is very hard to take a buggy parser written in Java, and to escalate to a memory corruption attack.

If you really can't use a language like Java, write your parser in safe Rust using slices over Vec. Then run a fuzzer over it. You'll find a few runtime panics, but you're vanishingly unlikely to encounter memory corruption.

Buffer overflows and memory corruption can be almost entirely avoided these days, at a price.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#146

Post by warunsl »

nonameiguess wrote: post #29

Apple needs to make it possible for users to choose other ways of sending and receiving messages and listening to music, or of choosing not to do either of those things if they don't want to. Obviously, you can currently install and use other applications that provide the same functionality, but you cannot uninstall or disable defaults. The most shocking experience to me in trying to evaluate the Mac ecosystem when t…

Happens on my non M1 Mac with Sony XM4s. I am pretty sure it is the headphones sending the play command to the computer. Apparently there is a setting in the Sony headphones app to disable this. But this did not work for me. Music.app still opens up everytime I remove the headphones and put them back on.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#147

Post by ajari »

jonfw wrote: post #140
swiley wrote: post #115

Earlier quoted context omitted.

It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.

> average joe > building them from source An average joe doesn't even know what 'build from source' means

We could have taught people such things, but there’s no profit in that. We want to maximize the number of people using our devices and our software, so that we get richer, even if it means putting some fraction of these users in grave danger. That’s simply negligence. That it’s distributed across an entire industry doesn’t change the ethics. Selling people tools that put them at risk is much different than sharing foss.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#149

Post by ascagnel_ »

tablespoon wrote: post #138
swiley wrote: post #124

Earlier quoted context omitted.

>Perfectly secure computers are an oxymoron. They don’t exist. Absolutely, but creating a platform the encourages or forces users to do the wrong thing is a regression from where we were ten years ago. >iOS is the least worst mobile option No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. T…

> No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. The rest of the options are so bad that you're probably better off without a mobile phone at all. There's nothing about FOSS that makes something secure, and building secure software is so hard and expensive that my guess is that you need…

> There's nothing about FOSS that makes something secure, and building secure software is so hard and expensive that my guess is that you needs the sponsorship of a government of major corporation to do so. Some FOSS does have such sponsorships, but a lot doesn't

The F/OSS community has a weird collective amnesia about exploits that rubs me the wrong way -- just because someone can look at it doesn't mean that someone is looking at it, or even that the person looking at it is going to fix it instead of exploit it. Heartbleed was sitting out in the open for 2+ years, despite OpenSSL being a very popular package available under a permissive license.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#150

Post by wil421 »

nonameiguess wrote: post #142
jackson1442 wrote: post #123

Earlier quoted context omitted.

Your headphones are probably sending a play command to your computer. There should be some software you can grab that captures that command and routes it to the application of your choosing, or disables it entirely. Unfortunately it's not built in, but I think it's your headphones doing something nonstandard because my Sony XM4s and AirPods do not fire this behavior when I put them in.

I'm using XM4s and have never done anything to change whatever their own default behavior is. And this doesn't happen on any other device except the Macbook. I guess it's worth looking into to see if there is some outside of the OS way to force the OS to route requests to the application I already have opened and foregrounded that plays sound, but I would expect that to be the default behavior. What is a "play" reque…

This is pretty easily fixed and took 5 seconds to google a solution. I have like 4 or 5 pairs of various headphones form AirPods to Jabra devices and they all do this when I take them off or put them on. The Bluetooth settings all have options to turn it off.

>If you remove the headphones or put them back on, this will pause or resume playback. If you're not wearing the headphones, make sure there's nothing else around the sensor because it may activate and resume playback.[1]

[1]https://www.sony.com/electronics/support/articles/00229324

Post reply on HN