Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

citizenlab.org

Post reply on HN
Print view View original

181–190 of 255 posts

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#181

Post by diamondlovesyou »

colejohnson66 wrote: post #179
tkinom wrote: post #160

Earlier quoted context omitted.

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

Doubt it. Once you have control of the system, why would you not be able to just disable the check? What they should do is enforce code signing at the processor level.

Too bad that has it's own issues. Android/Google definitely has the clout to be able to call the shots (ie force the processor manufacturer to issue them a CA cert for their own use), but what would happen if ARM then became a dominant server arch?

Also, putting code signing in the processor wouldn't fix the problem: code signing already happens in higher levels (ie higher than userland), so moving the verification a level up would likely take the exploitable bugs with it. The problem remains.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#182

Post by jeff_marshall »

digi_owl wrote: post #69
hackuser wrote: post #51

Should exploits like this be treated as munitions, with sale to foreign governments restricted? Or any sale at all restricted? Some thoughts: * The only uses for the exploits are either illegal or by government security organizations * I don't think you can just make an explosive and sell it to a foreign government; I think there are strict export controls (though I know very few details, I only read about companies…

> * In the 1990s, strong encryption was called a 'munition' and export was restricted. That turned out to be impractical (it was available in many countries and the Internet has no borders), morally questionable (restricting private citizen's privacy), and it fell apart. IIRC, thats still on the books. Its just one of those sleeping paragraphs since the PGP release.

Only "Military or intelligence cryptographic (including key management) systems" are included in the current US munitions list [1]. Everything else is handled by the Department of Commerce as part of the export administration regulations (EAR) [2].

[1]https://www.pmddtc.state.gov/regulations_laws/documents/offi...

[2] https://www.bis.doc.gov/index.php/policy-guidance/encryption

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#183

Post by nacs »

nogbit wrote: post #146
biot wrote: post #46

Earlier quoted context omitted.

From the article: "The kit appears to persist even when the device software is updated and can update itself to easily replace exploits if they become obsolete."

And, even if your phone is updating it may be doing a fake update and then show you that you did update to whatever version Apple says is "safe" for this exploit but in fact Pegasus was in control the entire time. Get a new phone ASAP.

... or you could just hook it up to iTunes and let iTunes flash the whole phone with the latest iOS from scratch (9.3.5 fixes these exploits) instead of letting the on-device updater do it.

No need for a whole new phone.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#184

Post by itayperl »

Osmium wrote: post #128

Aside, but does anybody else find the switch from right-to-left to left-to-right really jarring in this screenshot? https://citizenlab.org/wp-content/uploads/2016/08/image13-76... It has the effect of introducing a line-break into the middle of a line, rather than at either end. I've never encountered this before and it took my brain a few seconds to catch on. I'd be really curious how native bilingual readers of bot…

BiDi sucks, and as an RTL language speaker you learn to live with it.

My native language is Hebrew, and we don't bother translating most technical terms to Hebrew. You end up with technical documents looking something like this:

".yadot patch a desaeler Apple .iOS 9.3 ni ytilibarenluv privilege-escalation a dnuof srehcraeser ehT"

In newspapers, where lines are typically short, you get the effect in the screenshot in question. E.g.:

   "Everyone gets a day .ni tnew eH
            .dias eh ",off tomorrow
You can't really get used to that. You actually have to read the second line sideways from the middle!

By the way, typing mixed text is even worse than reading it. You have to press alt+shift every 2-3 words to switch layout. If that's not bad enough, Office 2007 (if I'm not mistaken) introduced a 0.5-1sec lag after each keyboard layout switch. Imagine typing out an entire document like that. I lost my nerve a couple of times.

In many cases we avoid this issue by simply writing technical documents in English, but sometimes that's not an option.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#185

Post by Forbo »

totocino wrote: post #174
toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

I look at it the other way: as exploits become more and more underground, I feel safer: I know those exploits are more likely to be used by state actors against activists and other people who are doing illegal stuff, and less likely to be used against me and millions of other users to install malware on our phones (to make them send spam, to make them send expensive texts...) So yes I feel safer now.

Perhaps you feel that way because you have the luxury of living in a place where human rights are respected. That these exploits are being used by regimes to shut down opposition is terrible in its own right.

Edit: As for net effect on global society, I think having my phone be part of a botnet that sends spam is less impactful than disrupting democratic progress.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#186

Post by cloudjacker »

darkarmani wrote: post #170
cloudjacker wrote: post #142

Earlier quoted context omitted.

a) Selling tools itself doesn't violate the CFAA act. A separate entity uses the tools and assumes that liability, which as we see is mitigated by sovereign immunity. b) And even if selling tools began to violate CFAA, then NSO itself would be sued. As it is a separate entity than the investors, which is the whole point of limited liability....

If you can tie the tool to any circumvention of copyright protections -- pretty broad argument (DMCA), you can be sued or arrested.

and then you lean on USC Title 17 Chapter 12 § 1201 (f) : the interoperability with other software defense, broad argument.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#188

Post by [deleted] »

toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

[deleted]

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#189

Post by startling »

SanPilot wrote: post #149

I'm a beginner when it comes to software development (mostly web development), but it seems to me that the majority of complex exploits like this involve some type of memory overflow and subsequent code execution. Shouldn't there be methods for detecting these kinds of things in source code or more priority given to preventing it in the C/low-level community?

There are. "(Kernel) address space layout randomization" is one of them. It was circumvented here; that's part of why this is impressive.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#190

Post by TechNewb »

metafunctor wrote: post #66

Is there any way to check if an iOS device has Pegasus installed, without installing and registering for the Lookout app?

I'm curious about this to. Does anyone know if there are steps that one could use with Xcode to see if any of these files exist?
Post reply on HN