Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi woman's iPhone revealed hacking around the world

reuters.com

Post reply on HN
Print view View original

151–160 of 184 posts

Re: A Saudi woman's iPhone revealed hacking around the world

#151

Post by saagarjha »

Terry_Roll wrote: post #16
TheBozzCL wrote: post #5

Earlier quoted context omitted.

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

The problem with cpu's is they dont know what instructions are supposed to run in order. Pipeline cache goes a little way towards getting the instructions in order, but ultimately a cpu does not know what instructions it has to run in order for a group of instructions to not be malicious. Think of a cpu like an old human telephone exchange where the operator is plugging in different cables to different sockets and ho…

You should look up Rice's theorem, because what you are suggesting is intractable and has nothing to do with the design of CPUs.

Re: A Saudi woman's iPhone revealed hacking around the world

#152

Post by saagarjha »

aborsy wrote: post #51

Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?

Apple has recently started notifying people who they suspect to have been targeted by state-sponsored attackers. I believe Google has a similar program in place for a while.

Re: A Saudi woman's iPhone revealed hacking around the world

#153

Post by saagarjha »

zionic wrote: post #54
aborsy wrote: post #51

Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?

Because Animoji was more important. Incase anyone was wondering, yes the amount they spent on that particular feature vastly eclipsed their spend on the kinds of teams that could have caught this.

I really don't get why you would make a statement like this with such confidence. Apple employees hundreds of people on its security teams and pays each of those engineers fairly well. Animoji is a spin off of their Face ID work, which you could arguably call a security feature in its own right but not strictly a red team.

Re: A Saudi woman's iPhone revealed hacking around the world

#154

Post by saagarjha »

a1a106ed5 wrote: post #43
jtsiskin wrote: post #23

Earlier quoted context omitted.

Not to sound like a broken record but…. This was yet another memory management bug that would have been prevented if using a memory safe language

On a brighter note, apple is currently in the process of converting almost all iMessage components to Swift for this reason. I'm sure it is taking many engineering hours, and image parsers/open source libraries like this are the most difficult to convert.

Just one component, the one that parses incoming messages. The problem here is that it parsed the message and decided to pass it to ImageIO, which is written in C++.

Re: A Saudi woman's iPhone revealed hacking around the world

#155

Post by user_7832 »

PickledHotdog wrote: post #126
viktorcode wrote: post #104

Earlier quoted context omitted.

What Apple stands to gain from a backdoor? It's clear what the cost of risk is, but what is the gain?

Just spitballing, but market access to China and the like?

Why use a backdoor if you have the frontdoor, the walls, the roof.. and the entire server?

Censorship, Surveillance and Profits: A Hard Bargain for Apple in China - https://nyti.ms/3oAvIVH

> Apple has largely ceded control to the Chinese government.

Chinese state employees physically manage the computers. Apple abandoned the encryption technology it used elsewhere after China would not allow it. And the digital keys that unlock information on those computers are stored in the data centers they’re meant to secure.

Re: A Saudi woman's iPhone revealed hacking around the world

#156

Post by user_7832 »

BeetleB wrote: post #34
walrus01 wrote: post #29

Loujain is a University of British Columbia graduate and was a political prisoner: https://www.google.com/search?client=firefox-b-1-d&q=loujain... https://en.wikipedia.org/wiki/Loujain_al-Hathloul Let's not forget that the present Saudi regime (MBS) is responsible for luring political opponents/journalists, killing them, and dismembering them with bone saws. https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khasho…

The irony is that he's also the one who forced the country to allow women to drive.

Call me cynical but no part of that seems anything other than a PR move, and a weak one at that. He's just trying to build an image, though how successful he's been is sometimes shown though (non-malicious) comments like yours.

Re: A Saudi woman's iPhone revealed hacking around the world

#157

Post by tapas73 »

GekkePrutser wrote: post #80
zakary wrote: post #76

Earlier quoted context omitted.

The simple answer is that to the people that really matter in decisions like that, those in the intelligence and the state departments of countries like the US, software like Pegasus is an important tool in staying ahead of adversaries. And in order to do its job effectively, it’s best if people don’t know about it. Pegasus may be sanctioned, but another company will make a product to takes its place and the game wil…

How does it help to stay ahead of adversaries when they're selling it to basically everyone including most adversaries?

you can sell basic version. Leaving premium to your self.

Re: A Saudi woman's iPhone revealed hacking around the world

#158

Post by ectopod »

bagacrap wrote: post #146

I guess enemies of a state should be using feature phones?

Feature phones are notorious for having terrible security. Most of them can be quietly hacked with an SMS from the carrier. And they support MMS so you're not immune to image parsing bugs either.

Re: A Saudi woman's iPhone revealed hacking around the world

#159

Post by Jerrrry »

miohtama wrote: post #145
ironSkillet wrote: post #144

Earlier quoted context omitted.

If a hack can be called beautiful, this fits the bill. How do people come up with these?

Being trained in Israeli intelligence corps, moving to civilian life, retaining your spook skills and being funded by Saudi billionaire prince who hates human right activism and criticism.

You actually only have to check 2/5 of those boxes.

Re: A Saudi woman's iPhone revealed hacking around the world

#160

Post by Jerrrry »

saagarjha wrote: post #149
Scoundreller wrote: post #73

Earlier quoted context omitted.

This is why I run a 1-task only Windows VM inside a Linux VM on a Mac. Ain’t nobody ripping through x3 0-days for my chats.

If you're a targeted journalist, they'll go through more than three to get you. Full chains are fairly long these days.

lmao bro does all that in front of his IoT Samsung toaster, that has a speaker...speakers are microphones.
Post reply on HN