Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

citizenlab.org

Post reply on HN
Print view View original

221–230 of 255 posts

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#221

Post by locusm »

omgbear wrote: post #165
tkinom wrote: post #160

Earlier quoted context omitted.

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls. http://linux.die.net/man/8/tripwire

iowatch is a nice simple alternative.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#222

Post by belorn »

eridius wrote: post #147
toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

You say Apple's security isn't sufficient. It certainly appears that as time goes on Apple's security is pretty sufficient for most users. We're talking about exploits worth 1+ million dollars being used in a targeted attack against a single individual (or, more likely, a relatively small number of targeted individuals over time). This isn't something that the overwhelming majority of users need to be concerned about…

I think its a bit naive to believe that a 1+ million worth exploit will remain a secret until the patch is shipped, at which point it is worth exactly nothing. There are so many way that the exploit will trickle down to more people until reach mass use.

To mention a few ways: The buyer might want to recover the purchasing price by reselling. If its a government agency, they might want to establish credential with future sellers. Reverse engineers have a 1+ million dollars incentive, and they have a much smaller window to sell it before it becomes worthless.

Its like piracy. First its the group with so called FTP access. During that period of time, maybe a release is worth X amount of dollars, but whats the chance that it remains there and never reach a mass audience?

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#223

Post by gengkev »

redwards510 wrote: post #55
jonknee wrote: post #26

Earlier quoted context omitted.

And quite the heads up move by Ahmed Mansoor to recognize the suspicious text for what it was and send it to the research team instead of clicking the link. If this thing really has been going since iOS 7 that means he is the outlier in taking precautions.

FTA: He had been targeted previously by FinFisher AND Hacking Team's malware. Avoiding malware is nothing new to this guy, something this NSO Group should have taken into account when they came up with their spear-phishing attack.

NSO Group claims not to launch attacks itself; rather it only sells tools to do so. So it might even be that the same government has targeted him with all three hacking tools.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#224

Post by keyme »

driverdan wrote: post #202

To people who work for companies that sell / invest in products that are used in unethical ways (Francisco Partners, NSO, Cisco, etc), how do you justify it to yourself?

How do the people working for Citizen Lab / lookout justify to themselves blowing active operations by countless police forces around the world?

Ops like Mexico vs Cartels?

Also, since when is selling weapons to governments unethical?

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#225

Post by _nedR »

eggy wrote: post #200

Unless you are a high-value target, Apple's security seems fairly sufficient for normal use (I have Android ;)). Companies like NSO Group that state that they play both sides without any moral compass seem like a great target for Anonymous or others. Imagine the client list, and banking information as a trail to blaze!

This guy seems to be quite the high-value target to warrant 3 zero-days, on ios no less.

edit: What platform would be recommended, if you happen to be a high value target though. Using iOS at least seems to raise the cost of infiltration significantly judging by this http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin....

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#226

Post by oarsinsync »

zmanian wrote: post #48
toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

As consumers we don't face very good choices right now. When you buy an iPhone, you don't own it. You are a sharecropper on Apple's OS license. If you buy an Android with an unlockable bootloader, you own it. But if attacked, the adversary owns the device. It's a shitty situation but it's hard not to recommend iOS to most users.

I guess ambiguity / assumed apple fanboyism is why you're downvoted, but if I'm understanding you correctly, then I feel largely the same way.

Apple's walled garden and "moral" approach to guarding their garden is incredibly frustrating, but the sheer number of vulnerabilities affecting different levels of the Android stack is so disheartening. This is true of my PC/Mac as well, all it takes is someone to plug in a malicious USB stick and it'll infect the firmware on the USB host, and that's it, game over. Can spread from there to disk firmware, also growing increasingly complicated and opaque, and who knows where else.

It's reaching a point where I trust my iOS device more than any other, depressingly because of the walled garden. I can't build suitable fences around my kit myself to protect myself against every new vuln (now even monitors can have their firmware exploited and screenloggers installed), giving up trying and sacrificing some freedom for that sense of security is terrible, but feels like the only logical course of action at this point.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#227

Post by ars »

omgbear wrote: post #165
tkinom wrote: post #160

Earlier quoted context omitted.

Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?

Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls. http://linux.die.net/man/8/tripwire

On debian you can also use debsums which has the advantage that the checksums come from the distribution directly.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#228

Post by PhantomGremlin »

acomjean wrote: post #92
snowwrestler wrote: post #85

Earlier quoted context omitted.

I don't get the point you're trying to make here. We've lost control because there's a serious vulnerability? We've lost control because Apple can patch the OS?

Well its sort of a general thing. We can't even control what runs on our devices and they run so fast you might not even notice something new running. Also stopping hacker from getting in remotely is hard for 24/7 connected devices. Even on desktop machines (Linux or Mac for me), there are processes running that I don't really know what they are doing. The OS is actually very complex and you could insert another proc…

Even on desktop machines (Linux or Mac for me), there are processes running that I don't really know what they are doing.

I don't run Linux so I can't comment on that one, but surely there are "simple" Linux distributions that don't start countless unrecognizable processes?

Mac is a hopeless case; a veritable plethora of inexplicable processes.

In contrast, I just logged in to my OpenBSD firewall. I was able to easily recognize everything that was running. The OpenBSD startup procedure is very simple to understand. It's easy to know exactly what processes are started and why.

tl;dr: horses for courses

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#229

Post by vetinari »

l_zzie wrote: post #155
corndoge wrote: post #53

Earlier quoted context omitted.

And if an iPhone is attacked the attacker...doesn't own the device? I don't follow your reasoning.

On iPhone, user-mode exploits remain sandboxed. On Android, on rooted devices, user mode code tends to be able to get root.

Apples and oranges.

On iPhone, user-mode exploits may remain sandboxed, unless they break from sandbox too. On jailbroken iPhones, that last step may be pre-made for them.

On Android, user-mode exploits may remain sandboxed too, unless they break from the sandbox - same as iPhone. On rooted Android devices, the last step may be pre-made for them.

You can not compare stock iPhone and rooted Androids - just like you can not compare jailbroken iPhone and stock Android.

Re: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender

#230

Post by loup-vaillant »

totocino wrote: post #174
toufka wrote: post #45

There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious…

I look at it the other way: as exploits become more and more underground, I feel safer: I know those exploits are more likely to be used by state actors against activists and other people who are doing illegal stuff, and less likely to be used against me and millions of other users to install malware on our phones (to make them send spam, to make them send expensive texts...) So yes I feel safer now.

You're not an activist yet. It's probably unwise to dismiss this possibility out of hand: governments change, and you might find yourself in strong enough disagreement that you'll need to speak up or act. Or your employer might do something so nefarious you'll feel the need to blow the whistle.

If there is ever a point when you feel the need to rise up, but can't because you gave in to government and corporate surveillance and lock down in the first place, that would be a pity.

Post reply on HN