Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

citizenlab.org

Post reply on HN
Print view View original

171–180 of 255 posts

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#171

Post by NeutronBoy »

StavrosK wrote: post #93
roywiggins wrote: post #65

Earlier quoted context omitted.

My Android has an unlockable bootloader but you need to actually request the key from the manufacturer. Malware can't unlock it against my will without a jailbreak. Seems like a decent arrangement to me- safe by default, but if I want to root my phone I can.

Even the Nexus unlock where you don't need a key but need to boot into fastboot is okay. I don't think many pieces of software will be able to automatically perform the steps required for that, including a confirmation on the phone and one on the computer.

It also wipes the device IIRC, so you can't fastboot unlock a device you found on the footpath and gain access to it's data.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#172

Post by eriknstr »

omgbear wrote: post #165
tkinom wrote: post #160

Earlier quoted context omitted.

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls. http://linux.die.net/man/8/tripwire

Some years ago, I had Tripwire installed for a few days but quickly removed it again because whenever I upgraded installed packages, I'd get a storm of messages about files which had changed and that was just annoying since I was the one who had initiated the action that caused the files to change, but at the same time there were so many files that changed of course, that I had no way of distinguishing legitimate changes (as they all were) from any potential illegitimate changes.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#173

Post by CameronBanga »

kchoudhu wrote: post #168
throwanem wrote: post #43

Earlier quoted context omitted.

Or this, from the detailed writeup linked elsewhere on this page: > To use NSO Group’s zero-click vector, an operator instead sends the same link via a special type of SMS message, like a WAP Push Service Loading (SL) message. A WAP Push SL message causes a phone to automatically open a link in a web browser instance, eliminating the need for a user to click on the link to become infected. It goes on to say that mess…

When your service provider is owned by the state, all you can rely on is the OS provider. Maybe we should all just go back to carrying dumbphones.

That's presuming you have more faith in your desktop/other computing systems to be safe in the long run.

Personally, I'd take iOS over any alternative, if security was my biggest concern.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#174

Post by totocino »

toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

I look at it the other way: as exploits become more and more underground, I feel safer: I know those exploits are more likely to be used by state actors against activists and other people who are doing illegal stuff, and less likely to be used against me and millions of other users to install malware on our phones (to make them send spam, to make them send expensive texts...)

So yes I feel safer now.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#175

Post by sliverstorm »

roywiggins wrote: post #65
zmanian wrote: post #48

Earlier quoted context omitted.

As consumers we don't face very good choices right now. When you buy an iPhone, you don't own it. You are a sharecropper on Apple's OS license. If you buy an Android with an unlockable bootloader, you own it. But if attacked, the adversary owns the device. It's a shitty situation but it's hard not to recommend iOS to most users.

My Android has an unlockable bootloader but you need to actually request the key from the manufacturer. Malware can't unlock it against my will without a jailbreak. Seems like a decent arrangement to me- safe by default, but if I want to root my phone I can.

Sidenote, it's valuable for devices to come to you locked, because it means the device you have received does not have 3rd party malware. A common problem in some markets for Android phones.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#176

Post by Jerry2 »

How does one monitor the infection of an iOS device and how do you capture and store all the stages of an infection?

I've never done any reverse engineering so I'm not sure how you'd go about recording what an infection like this does to your device...

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#177

Post by vfclists »

afarrell wrote: post #167
toufka wrote: post #152

Earlier quoted context omitted.

I don't think the bar is just nation-states. The bar also includes those with any of the following: - $1M Cash - skilled working knowledge of Apple's software and hardware - fast reflexes to quickly react and apply a newly-public exploit derived from any of the above Together, the number of world-wide actors who fall into one of those categories is actually fairly large. Those all have the capability to have total 'a…

They also require a few other things: - a single person or committee with the authority to sign off on $1 million for this sort of thing. - a willingness to risk the legal and PR consequences of being discovered. Which cuts out a lot of potential corporate espionage

This presumes that the exploits can only be found by companies with deep pockets, which are probably deep only because they are willing to sell them. What if there are equally good teams who are not in it for the money?

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#178

Post by emptybits »

acdha wrote: post #88
emptybits wrote: post #41

Earlier quoted context omitted.

Sad face. Right now, on my iPhone: "iOS 9.3.5 provides an important security update for your iPhone" 40.5 MB. Great! Tapped "Download and install". It's greyed out. Huh? Oh, "this important security update requires a Wi-Fi network connection to download". Really? It's only 40.5 MB. Let me decide, please, how I use my data. Am I missing a setting that allows me to install an important security update on a network of m…

Go to https://bugreport.apple.com and request that. The more duplicates they get, the more likely something is to get fixed.

Good call. Done. Also cathartic.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#179

Post by colejohnson66 »

tkinom wrote: post #160
dropalltables wrote: post #35

Earlier quoted context omitted.

Direct links to other resources: Technical analysis: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... CitizenLab analysis of the nation-state side of things: https://citizenlab.org/2016/08/million-dollar-dissident-ipho... Apple update: https://support.apple.com/en-us/HT207107

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

Doubt it. Once you have control of the system, why would you not be able to just disable the check? What they should do is enforce code signing at the processor level.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#180

Post by tetrep »

tkinom wrote: post #160
dropalltables wrote: post #35

Earlier quoted context omitted.

Direct links to other resources: Technical analysis: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... CitizenLab analysis of the nation-state side of things: https://citizenlab.org/2016/08/million-dollar-dissident-ipho... Apple update: https://support.apple.com/en-us/HT207107

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

I'm on mobile so links are annoying to get, but Apple has a great PDF on iOS security in general, which includes details on their protections against kernel patching. Windows has KPP, and Mac OS has SIP. Not familiar with anything for Linix but I'd be shocked if there weren't multiple incompatible implementations of similar features.

Realistically, this is also something virtualization can help guard against. If your OS is initialized from a known good version external to the VM, every time the VM starts, you greatly increase the difficulty for an attacker to get persistant root.

KPP: https://en.m.wikipedia.org/wiki/Kernel_Patch_Protection

SIP: https://en.m.wikipedia.org/wiki/System_Integrity_Protection

Post reply on HN