Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

citizenlab.ca

Post reply on HN
Print view View original

261–270 of 314 posts

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#261

Post by marcosdumay »

banjomet wrote: post #47
sshumaker wrote: post #34

Earlier quoted context omitted.

Can you imagine if Google were the ones behind the great filter and panopticon that is the Chinese internet? Corporations are made up of human beings and at some point if you have any values you have to take a stand. The whole current philosophy of maximizing shareholder value falls apart when you realize the selfsame system that enables a free market is deeply intertwined with the impact powerful organizations have…

The great firewall was originally built by Cisco, but I don't think anybody remembers that.

Does anybody think Cisco is a honest company with goals aligned with its customers and the betterment of humanity?

There's an arrest pending for their (I think former) CEO in case he ever places his feet at my country. For acts he ordered the company to do.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#262

Post by tweetle_beetle »

AsyncAwait wrote: post #235
bjourne wrote: post #104

How come when we hear about this stuff it is always Israeli companies involved? Is ethics not taught in Israeli Computer Science curricula? Those who wrote this exploit are clearly "brilliant" and at least some of them are bound to be reading Hacker News. Is other countries' spyware firms just better at hiding their malware than Israel's is?

> How come when we hear about this stuff it is always Israeli companies involved? Is ethics not taught in Israeli Computer Science curricula? Personal opinion, but I think the mandatory army service in Israel seems to teach that everything is 'defense' and Israel is always 'defending itself', no matter what, this sort of thinking then bleeds into the private sector as these guys leave the military and use the skills…

There is the idea that being the stronger side in a constant state of conflict with a neighbour for decades suits Israel economically, despite the human cost on both sides. Combined with national service, it creates a highly credible testing ground for public and private development of defence products, technologies and services, which are extremely valuable exports.

A country of its size and only relative recent independence, is punching well above its weight being the 8th largest arms exporter in the world over the last decade.[1]

[1] http://armstrade.sipri.org/armstrade/page/toplist.php

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#263

Post by amluto »

saagarjha wrote: post #152
meibo wrote: post #97

Earlier quoted context omitted.

It has been proven to be a weak point in their implementation with previous exploits, and it's likely to be the case here - it's a good guess at least. Will be interesting to read a write-up.

Apple has been hardening their software to use NSSecureCoding and similar since then, so I would be surprised if this would still be a problem (since this is fairly easy to check for and fix). My guess is that this is probably a run-of-the-mill overflow or corruption.

That’s like saying one can harden pickle by specifying magic options and trying to limit the supported classes to a very large list instead of an effectively infinite list. Sure, you can make the the blatantly insecure mechanism harder to exploit, but it’s still a horrible design.

I think Apple could address this for real is one of two ways. They could replace the protocol entirely, or they could treat the existing baroque protocol like any other network protocol and write a grammar and parser for it.

As an analogy, suppose you had a wire format like XML, and you had the clever idea to process it in a dynamic language like Python or ObjC by looking up each tag in a list of all known types and trying to instantiate it. Sure, it would work, and you would be exploited all the time. NSSecureCoding limits the available types to a large and apparently still open ended list instead of literally every type that the deserializer can make sense of.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#264

Post by lawnchair_larry »

_kbh_ wrote: post #233
lawnchair_larry wrote: post #154

Earlier quoted context omitted.

That isn’t a spy tool. It’s for forensics. You have to hand over your phone and unlock it voluntarily, and physically attach it to that thing and dump it. Very different.

Its only for forensics because schools cannot afford the version that breaks into the phone for you, its expensive and not something that a school can get access to.

No. It’s because they’re totally different products, and cellebrite, a forensics company, doesn’t make a version that you are describing. They make forensics products, not monitoring tools. They have nothing to do with NSO.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#265

Post by lawnchair_larry »

boomboomsubban wrote: post #157
lawnchair_larry wrote: post #141

Earlier quoted context omitted.

You better watch and read up on collateral murder again, because it sure as shit wasn’t an example of America having no qualms about killing journalists.

Two journalists were killed for being with people committing no hostile actions, the soldiers involved in the actions laughed and taunted those they slaughtered, the government then lied about what had happened for years, and the only people to face punishment are Manning and Assange. And no, carrying weapons in a war zone does not make this acceptable. When exactly does the US give a shit about killing journalists?

No, that isn’t what happened. Why are you pretending that they knew they were journalists instead of acknowledging that this incident was a tragic mistake?

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#266

Post by drvdevd »

kmfpl wrote: post #253
rmrfstar wrote: post #227

Earlier quoted context omitted.

These attacks would be a lot less dangerous if they couldn't get on-disk persistence. Just reboot your phone, and you're good to go. Only creeps like NSO who spy on normal people need that degree of persistence. Everyone else can just hang out in ram on some always-on server. Vendors need to make it easier to verify the integrity of persistent firmware, in an offline fashion. It will dramatically increase the cost of…

>“Just reboot your phone, and you're good to go” Doesn’t really work like that. First of all, when would you reboot your phone? Once per day? Once per hour? Every five minutes? Regardless, these attacks are incredibly advanced, remember they require zero interaction from the user. Even if you rebooted constantly and the exploit lacked a persistence vector, they would still be able to exploit you whenever they want. T…

What about also removing your SIM card and disabling iMessage or otherwise firewalling all traffic to Apple?

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#267

Post by boomboomsubban »

lawnchair_larry wrote: post #265
boomboomsubban wrote: post #157

Earlier quoted context omitted.

Two journalists were killed for being with people committing no hostile actions, the soldiers involved in the actions laughed and taunted those they slaughtered, the government then lied about what had happened for years, and the only people to face punishment are Manning and Assange. And no, carrying weapons in a war zone does not make this acceptable. When exactly does the US give a shit about killing journalists?

No, that isn’t what happened. Why are you pretending that they knew they were journalists instead of acknowledging that this incident was a tragic mistake?

Nothing in my post pretends that, and "how should we know the media card carrying unarmed civilians we shot were journalists" doesn't help their case as much as you think.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#268

Post by saagarjha »

drvdevd wrote: post #266
kmfpl wrote: post #253

Earlier quoted context omitted.

>“Just reboot your phone, and you're good to go” Doesn’t really work like that. First of all, when would you reboot your phone? Once per day? Once per hour? Every five minutes? Regardless, these attacks are incredibly advanced, remember they require zero interaction from the user. Even if you rebooted constantly and the exploit lacked a persistence vector, they would still be able to exploit you whenever they want. T…

What about also removing your SIM card and disabling iMessage or otherwise firewalling all traffic to Apple?

Why not just keep the device off and stop using it? That would stop all attacks!

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#269

Post by saagarjha »

rmrfstar wrote: post #227
saagarjha wrote: post #72

> We were unable to retrieve these binaries from flash memory, as we did not have access to a jailbreak for iPhone 11 running iOS 13.5.1. It’s ironic that the exploit is able to plant arbitrary code on an up-to-date device and yet the owner of the phone can’t introspect their phone to see it themselves because they don’t know how to bypass the protections :/

These attacks would be a lot less dangerous if they couldn't get on-disk persistence. Just reboot your phone, and you're good to go. Only creeps like NSO who spy on normal people need that degree of persistence. Everyone else can just hang out in ram on some always-on server. Vendors need to make it easier to verify the integrity of persistent firmware, in an offline fashion. It will dramatically increase the cost of…

On-disk persistence (“untethered”) is actually fairly rare. Why do that when it leaves behind evidence and you can just remotely run the exploit again to hack the device?

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#270

Post by bjourne »

ThePadawan wrote: post #188
bjourne wrote: post #104

How come when we hear about this stuff it is always Israeli companies involved? Is ethics not taught in Israeli Computer Science curricula? Those who wrote this exploit are clearly "brilliant" and at least some of them are bound to be reading Hacker News. Is other countries' spyware firms just better at hiding their malware than Israel's is?

> Is ethics not taught in Israeli Computer Science curricula? ...Is ethis taught in any CS curriculum? It sure wasn't in mine (but to be fair, that was in Switzerland).

It was taught in mine. Lots of focus on stuff like gender issues, discrimination, and academic dishonesty (don't cheat or plagiarize, etc). The guy who held the ethic course also held the course in abstract computer science. He most definitely would've been displeased had his students used what he taught them to write malware targeting journalists!
Post reply on HN