Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

291–300 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#291

Post by genewitch »

GekkePrutser wrote: post #260
goblinux wrote: post #181

Earlier quoted context omitted.

Darknet Diaries is so good. To anyone who hasn't listened, highly recommend. Jack hits a homerun each week and the story about JSR and NSO was buck wild

I wish they would write articles too.. I don't have the patience to listen to podcasts :) But I've been told it's really good.

A good podcast app may help. For slower podcasts, instead of speeding it up - which may chipmunk or otherwise cause artifacts - podcast addict trims silence. You may miss stuff below the gate threshold, but it is still slick.

I only listen to 2 podcasts, I don't really and have never really liked the format. I prefer reading with music or silence, and have always loved weblogs for that. However, it's worth a shot to find a podcast app that "clicks" with your style of input.

With podcasting 2.0, the new features should allow producers that don't want to be part of an ecosystem to still make some income, plus you get streaming album art where supported, and liner notes and all sorts of other goodies.

I think podcastindex has a list of compatible 2.0 podcasting apps, but I'm unable to check.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#292

Post by _vvhw »

"And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure and complex formats, remotely exposing probably hundreds of thousands of lines of code."

90% of zero-days could be stopped at the front door by file format checkers doing static analysis on popular file formats (like ZIP, MS-CFB, Office, image, PDF) exchanged via message/email to reduce semantic gaps in the file format and weird-machine ambiguities that will inevitably be abused by attackers.

The problem is simple. Most codecs (and even vulnerable anti-virus software) were written in a time when Postel's law was the norm. It's much easier to write a file format checker as defense-in-depth for the vulnerable codec than to rewrite the codec, especially since a codec's interface typically can't expose policy decisions like a checker's interface can.

As a community, we could solve this problem tomorrow.

However, the file format checkers to defend don't exist, because the major email/message providers don't want to invest in them, because nobody would see this work. Even if we build them, they don't want to invest in tuning the false positive rate, because people want lax security not strict security on all message/email attachments they open.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#293

Post by TheDong »

arduinomancer wrote: post #286

Just to understand, what is the blast radius of this exploit? Do they just have access to the whole process memory of the iMessage process? Or does it go beyond that?

A project zero post from early 2020 talks about the iMessage architecture and impact of iMessage exploits: https://googleprojectzero.blogspot.com/2020/01/remote-iphone...

The BlastDoor sandbox was added since then (which project zero also has a post on), but this exploit happened outside the blastdoor sandbox, so that doesn't change anything.

If previous iMessage exploits are anything to go on, it's likely this gives unsandboxed root access to all memory on the device.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#294

Post by Operyl »

weaksauce wrote: post #261
goblinux wrote: post #181

Earlier quoted context omitted.

Darknet Diaries is so good. To anyone who hasn't listened, highly recommend. Jack hits a homerun each week and the story about JSR and NSO was buck wild

yeah it really is refreshing to hear a podcast for the masses that actually gets technical details correct. It's a pet peeve when people simplify it and get it really wrong.

He sometimes messes up the small details, but frankly they’re tiny enough that it doesn’t destroy the overall experience

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#295

Post by jeffbee »

_vvhw wrote: post #292

"And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure an…

The "major email" people are pretty much the only people funding practical technology of the kind you just whined about.

https://github.com/google/wuffs

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#296

Post by Dylan16807 »

xiphias2 wrote: post #105
ASalazarMX wrote: post #40

Earlier quoted context omitted.

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.

They don’t really have to, they can just mine Bitcoin by reversing SHA256 in polynomial time, inspect https messages to banks, or send Bitcoin to themselves by creating an ECDSA signature… or just set up a software as a service and have the biggest business in the world.

n^10 is a polynomial too.

The equality of P and NP would not itself mean there are fast solutions.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#297

Post by flyinglizard »

FridayoLeary wrote: post #247
flyinglizard wrote: post #215

Earlier quoted context omitted.

There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.

I think it's barbaric to calmly send a request for more slaves (Jews other minorities) for the factory work, due to them inconveniently dying too fast. Because of the inhuman working conditions. I read that he did that all. He wasn't merely a patriotic, unaffected scientist, he played a part in the holocaust.

You’re moving the goalposts - the subject discussed was the participation of scientists in weapon programs. He might have been a scum (I think it’s trivializing what happened in Germany at that time, I digress), but his participation in the war effort is not unethical in itself. Thousands of kilometers away, other scientists toiled on a weapon that makes all the weapons the Nazis developed seem benign.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#298

Post by flyinglizard »

earthscienceman wrote: post #240
flyinglizard wrote: post #215

Earlier quoted context omitted.

There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.

I'm not sure what world you live in where saying "I don't care if I'm making missiles for Germany or the USA" is not an ethical violation and is somehow patriotism... but I don't want to live in it with you.

You’re being unfair by enforcing a modern perspective, shaped by the victors, on an enemy from 80 years ago. Were Soviet weapons scientists unethical too?

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#299

Post by [deleted] »

walrus01 wrote: post #43

> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and sk…

[deleted]

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#300

Post by Dylan16807 »

kingaillas wrote: post #137
nafey wrote: post #120

Earlier quoted context omitted.

Is proving P = NP equivalent to knowing how any intractable problem can be solved? Is it possible for P=NP and yet a class of intractable problems to remain unsolved?

It would mean that a large class of problems that have solutions that can be verified quickly can be solved quickly. Which cuts both ways. While that means most protocols used for cryptography would need to be replaced (hashing, digital signatures, etc) it also means other combinatorics algorithms (traveling salesman, protein structure prediction) would become solvable which may been boon for logistics and/or computa…

'quickly' is doing a lot of work in that sentence.

"A proof that P = NP could have stunning practical consequences if the proof leads to efficient methods for solving some of the important problems in NP."

Note the "if". It is extremely important to the meaning. It's very possible for P to equal NP, but for that "if" to be false.

Post reply on HN