Earlier quoted context omitted.
> Never disliked the lack of non-ascii support. Ah, the elusive quadruple-negative.
Each negative means +1 standard deviation verbal iq.
+1 for the reader. -1 for the writer.
‘Zero-click’ hacks are growing in popularity
191–200 of 408 posts
Re: ‘Zero-click’ hacks are growing in popularity
#192Earlier quoted context omitted.
To me there's a difference between RCE and Zero click. RCE occurs on a system with a listening daemon/service (e.g. web, SQL, DNS SSH). Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).
There is no meaningful distinction between the two. > Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone). Historically these have been referred to as RCE. FWIW You are essentially describing a service listening on the network. It’s silly to try t…
[deleted]
Re: ‘Zero-click’ hacks are growing in popularity
#193Years ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
I was about to say the same thing in response to people claiming security is getting worse. Zero-Click is just another name for a worm. I guess mayyybe you could consider Zero-Click as more like a class of worm whose entry into the system is visible (you can see that you got the strange message or image).
And you're definitely right that they are far more rare. Worms used to be nasty is now fast and easily they spread. Security has come a long way since then.
That said, we could go further on security. But is selling people on using more secure software and hardware. Even something as simple as bounds checking has a cost. Look at the reception of the Windows 11 change to have Virtualization Based Security turned on by default. People are upset about it because it takes away performance for security that they claim they don't need on their home computer.
And then there's resistance from developers. For some reason people get really upset about mechanisms designed to improve security without increasing runtime overhead when they make compile time take longer. If your application is used by any significant number of people, surely the amount of runtime you're saving dwarfs the amount of extra time to compile.
Re: ‘Zero-click’ hacks are growing in popularity
#194> 'Zero-click' hacks
A.K.A. 'Hacks' (as opposed to social engineering)
Re: ‘Zero-click’ hacks are growing in popularity
#195Re: ‘Zero-click’ hacks are growing in popularity
#196There are no laws in Israel preventing companies like NSO from building and selling zero-day and zero-click exploits? Without proper regulations the Israeli government is creating a sophisticated and dangerous platform for these kind of illegal attacks.
Israel are arguably the worlds biggest beneficiary of the arms trade. Why would they have anything against selling weapons?
Only in your active imagination. In reality it is roughly in 8th place with 3% marketshare.
https://www.weforum.org/agenda/2019/03/5-charts-that-reveal-...
Re: ‘Zero-click’ hacks are growing in popularity
#197"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.
More likely: our gov gag ordered us to keep up.
Re: ‘Zero-click’ hacks are growing in popularity
#198Earlier quoted context omitted.
To me there's a difference between RCE and Zero click. RCE occurs on a system with a listening daemon/service (e.g. web, SQL, DNS SSH). Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone).
There is no meaningful distinction between the two. > Zero-click describes an issue on a client system where usually a user would have to click something to trigger it, but doesn't as parsing/processing happens before the user actually sees anything (e.g. via an SMS on a phone). Historically these have been referred to as RCE. FWIW You are essentially describing a service listening on the network. It’s silly to try t…
That's a view of the world for sure :) Personally I don't think it's irrelevant. From a threat modelling perspective, exposed services are expected to be attacked.
Client services with zero interaction, have traditionally been regarded as safer, usually for client side attacks we'd expect a trigger from user action (e.g. a link being clicked, a PDF file being opened).
Just because you don't find something to be useful as a distinction in your line of work doesn't necessarily mean that it's not useful to anyone ...
Re: ‘Zero-click’ hacks are growing in popularity
#199Re: ‘Zero-click’ hacks are growing in popularity
#200Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Following this idea, using a memory managed language like Go, Java or C# should also prevent most security issues (at least in non-core systems). Somehow I don't think this would work.