Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

191–200 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#191

Post by mike_hock »

chimeracoder wrote: post #175
zx8080 wrote: post #174

Earlier quoted context omitted.

Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them! Because there is hardly one alternative: iphone (and Huawei, but maybe not everywhere). Not much to care about. We all need a new phone OS and hardware level. Urgently.

> Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them "Google does not care about zero-day vulnerabilities" is an absolutely ludicrous claim.

The care from day one on.

Re: A 0-click exploit chain for the Pixel 10

#192

Post by microtonal »

zx8080 wrote: post #174
krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them! Because there is hardly one alternative: iphone (and Huawei, but maybe not everywhere). Not much to care about. We all need a new phone OS and hardware level. Urgently.

0days does not matter for them!

This does not make much sense at all and is also not in line with empirics. It does not make much sense, because if flagship Android's security reputation worsens, more high-value customers (which are interesting to ad publishers) will go to iPhone. I think this is already an issue for Google because the most popular iPhones are all flagship models, whereas the most popular Android models are low- to mid-range Samsung A series:

https://counterpointresearch.com/en/insights/global-smartpho...

This reduces the opportunity for Google to extract money from their ecosystem (Ads, Google One, etc.) and gives it to Apple.

Second, it does not line up with empirics, because after Apple, Google has been the manufacturers most aggressively pushing hardware security. E.g. Pixels have had a Titan M secure enclave for a long time now (most Android manufacturers do not have any and rely on TrustZone), Google Pixel was one of the first devices to adopt memory tagging (MTE), etc. They do a lot of work to try to reduce the blast radius of 0-days, there is a reason why e.g. GrapheneOS has so far only supported Google Pixel devices.

The problem is more the lack of privacy.

Re: A 0-click exploit chain for the Pixel 10

#193

Post by microtonal »

jiggawatts wrote: post #140
GeekyBear wrote: post #115

Earlier quoted context omitted.

One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.

Sorry, but that is an insanely defeatist attitude blended with a hint of blaming users for wanting features. Image decoders are pure functions and all should have been rewritten as 100% safe Rust years ago. Users need functionality. It’s up to us to figure out how to provide that safely. Saying to users they shouldn’t have those features isn’t sage advice, it’s admitting failure.

They are actually pushing Rust quite hard now in Android:

https://blog.google/security/rust-in-android-move-fast-fix-t...

Even to the baseband firmware:

https://blog.google/security/bringing-rust-to-the-pixel-base...

Re: A 0-click exploit chain for the Pixel 10

#194

Post by microtonal »

Xirdus wrote: post #120
JumpCrisscross wrote: post #100

Earlier quoted context omitted.

> Haven't we learned our lesson on this? What is the purported lesson we should have learned? Users choose phones with rich messaging features. This was a major selling point for iPhone, first, with iMessage, and later with Android until iOS caught up with RCS.

Well, one could argue that the lesson from CVE-2017-0780[1] should've been "don't automatically decode rich messages from untrusted sources". [1]: https://www.trendmicro.com/en_us/research/17/i/cve-2017-0780...

Stagefright is even older:

https://en.wikipedia.org/wiki/Stagefright_(bug)

Re: A 0-click exploit chain for the Pixel 10

#195

Post by marysol5 »

krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

I was at an "AI Security" talk recently, that centred around "While we blindly will injest inputs to and from AI, and that's a security issue. There's nothing we can do, so just deal with the aftermath".

Including saying "If a threat actor updates your internal documentation, they can use that to influence the AI".

If a THREAT ACTOR IS UPDATING DOCUMENTATION, YOU'RE COMPROMISE!

We're not talking about "Wikipedia Vandals" here

Re: A 0-click exploit chain for the Pixel 10

#196

Post by marysol5 »

thewebguyd wrote: post #127
GeekyBear wrote: post #115

Earlier quoted context omitted.

One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.

That should be the default behavior, not a special lock down option that also disables other features. Why can't they just make it like most email clients? No preview by default, give a banner with an option to explicitly allow a preview for that specific message or conversation?

You know that E-Mail clients blocking stuff came after right?

Re: A 0-click exploit chain for the Pixel 10

#197

Post by marysol5 »

michaelt wrote: post #156
jiggawatts wrote: post #140

Earlier quoted context omitted.

Sorry, but that is an insanely defeatist attitude blended with a hint of blaming users for wanting features. Image decoders are pure functions and all should have been rewritten as 100% safe Rust years ago. Users need functionality. It’s up to us to figure out how to provide that safely. Saying to users they shouldn’t have those features isn’t sage advice, it’s admitting failure.

The thing is, nobody's happy just previewing jpegs and pngs. Before you know it, people want to preview SVGs, PDFs, video, HTML and so on. And to do that properly means you've got to support obscure formats like JBIG2 and CCITT Fax. Malicious vector images with a billion elements to render. XML that lets one file embed another. And good luck getting the budget to re-implement them all from scratch in a better languag…

At what point do we just refuse to parse obscure rarely used formats

Re: A 0-click exploit chain for the Pixel 10

#198

Post by marysol5 »

fg137 wrote: post #123
sneak wrote: post #117

Earlier quoted context omitted.

I think it's "don't use parsers written in unsafe languages".

I think it's simpler: don't touch untrusted content unless/until you need to.

But that just moves it from 0-touch, to 1-touch (which is of course better).

But users are morons.

We STILL NOW, have people getting phished and pwning their employers.

Re: A 0-click exploit chain for the Pixel 10

#199

Post by marysol5 »

GeekyBear wrote: post #130
fc417fc802 wrote: post #129

Earlier quoted context omitted.

Even that's not sufficient. Consider an email client that doesn't parse images until you interact with the message. So you click on it, realize it's dodgy, but it's too late now because all the complex bug prone machinery has already been triggered. Or my favorite, I marked an extremely suspicious message with what was almost certainly a malicious attachment as junk in a certain BigTech webmail client (the only other…

The email client I use doesn't display images in an email until I explicitly ask it to.

Which came as a reaction to "tracking cookies" and the like being added to e-mail.

It was a reaction, not a proactive response.

Re: A 0-click exploit chain for the Pixel 10

#200

Post by marysol5 »

krupan wrote: post #134
YmiYugy wrote: post #128

Earlier quoted context omitted.

Getting users to open a message isn’t a terribly high bar. As a user I would not find it acceptable if needed to be careful with which message I open. We tried putting the responsibility on the user with email attachments and I think it’s fair to say it’s been a disaster. Malicious attachments are probably the most important distribution vector for malware.

This isn't even an exploit if the crappy AI or whatever that's trying to do something fancy never "processes" the message. At least give me a choice before you automatically do that

ESPECIALLY when we're trying to be concious about the amount of resource that "AI" uses. I don't need to burn GPU cycles on something I can read with my own eyes.
Post reply on HN