241–250 of 255 posts
Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often? Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on
Earlier quoted context omitted.
Could you be any more specific about what features they've removed such that the hardening functions work? Because I think there are none
They're quite open about it. https://grapheneos.org/features#attack-surface-reduction
Erm, okay if this makes you think the phones don't have WiFi or NFC or something, you've been misinformed
Earlier quoted context omitted.
One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you. It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.
Sorry, but that is an insanely defeatist attitude blended with a hint of blaming users for wanting features. Image decoders are pure functions and all should have been rewritten as 100% safe Rust years ago. Users need functionality. It’s up to us to figure out how to provide that safely. Saying to users they shouldn’t have those features isn’t sage advice, it’s admitting failure.
https://hacks.mozilla.org/2021/12/webassembly-and-back-again...
(Of course, new code is preferred in Rust over C, for sure.)
I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…
Earlier quoted context omitted.
I don't necessarily disagree but a lot of chains will bail out if they find like the Norton Antivirus app on your phone so
In this case the body of evidence is still quite powerful though, given that not only do we not have any forensic evidence of compromise from a phone with Lockdown Mode, but in all public cases where chains were RE'd back out of the forensic evidence, they don't work when tested on Lockdown Mode! So, there's even signal that the lack of forensics indicating Lockdown Mode compromises is not due to artificial targeting…
Earlier quoted context omitted.
In this case the body of evidence is still quite powerful though, given that not only do we not have any forensic evidence of compromise from a phone with Lockdown Mode, but in all public cases where chains were RE'd back out of the forensic evidence, they don't work when tested on Lockdown Mode! So, there's even signal that the lack of forensics indicating Lockdown Mode compromises is not due to artificial targeting…
That is a total strawman. The standard of “effective” being used by the person I was responding to and Apple themselves is “protects against state actors targeting you”, not “has any benefit whatsoever” or even “has a material benefit”. Protecting against state actors is not a instantaneous property of the present. It demands durable protection against compromise by state actors who can easily spend tens to hundreds…
I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…
Even that's not sufficient. Consider an email client that doesn't parse images until you interact with the message. So you click on it, realize it's dodgy, but it's too late now because all the complex bug prone machinery has already been triggered. Or my favorite, I marked an extremely suspicious message with what was almost certainly a malicious attachment as junk in a certain BigTech webmail client (the only other…
Literally the only thing even remotely pressuring these firms to implement better security is bad PR (and it barely does that), so by not being explicit you are bypassing this
Earlier quoted context omitted.
Sure, in an ideal world different from this one. You should be able to do anything on any device and never worry about security. Unfortunately, since we don't live in that world, we need to not open links, emails, text messages, etc, if they are sketchy. A better solution may someday exist, but as of yet has not been found.
"Don't click on links" is not a solution, and it's not something people actually do, it's just something they think they do. Corporate Security will tell you that it's ok to click links to the payroll system or hr or vanta or the 'secure email service' or jira or github or to docusign or the microsoft office document that a partner company sent you or an amazon delivery notification, but not ok to click links in the…
And yet, there is currently no better solution I'm aware of, so that is what they must do.
"Just let anybody click and open anything" is not a solution, either.
Earlier quoted context omitted.
That is a total strawman. The standard of “effective” being used by the person I was responding to and Apple themselves is “protects against state actors targeting you”, not “has any benefit whatsoever” or even “has a material benefit”. Protecting against state actors is not a instantaneous property of the present. It demands durable protection against compromise by state actors who can easily spend tens to hundreds…
Apple is almost certainly spending hundreds of millions if not billions on software security.
I said that “protects against state actors” means the cost of finding a exploit as generally applicable and powerful as a zero-click RCE needs to cost on the order of hundreds of millions to billions of dollars per exploit to be problematic for state actors to field.
That amount of resources is a competent team of 100 skilled individuals finding zero zero-click RCEs after 3 years of full time investigation. That could credibly be called secure against state actors, though would still not be out of reach of a real military operation as a hundred million dollars is still just the cost of a single jet fighter.