A Saudi woman's iPhone revealed hacking around the world • Hacker News Board

Re: A Saudi woman's iPhone revealed hacking around the world

#31

Post by walrus01 » Sat, Feb 19, 2022, 4:01 AM UTC

bredren wrote: post #22

>Fearful that her iPhone had been hacked as well, al-Hathloul contacted the Canadian privacy rights group Citizen Lab and asked them to probe her device for evidence I wonder if she had a preexisting relationship w the group or how she was connected with them. Presumably her work included a network of journalist protection orgs. But had she had a device “probed” like this before? It’s such an important point of conta…

Loujain has strong connections in the metro Vancouver BC area. People working in network security/infosec and associated with UBC IT are well aware of Citizen Lab and possibly put her in contact with them. Citizen Lab at the University of Toronto is fairly well known throughout the Canadian academic research/computer science/network engineering community.

Re: A Saudi woman's iPhone revealed hacking around the world

#32

Post by Spooky23 » Sat, Feb 19, 2022, 4:07 AM UTC

vatys wrote: post #7

shp0ngle wrote: post #6

Earlier quoted context omitted.

There are two different types of attacks. One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures. Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.

How does one know which category they are in?

Are you or someone you associate with interesting?

Negotiate big contracts? Work in aerospace or defense? Have access to inside information about a public company? Have access or are a high level political official?

Re: A Saudi woman's iPhone revealed hacking around the world

#33

Post by arunc » Sat, Feb 19, 2022, 4:10 AM UTC

TheBozzCL wrote: post #5

Steko wrote: post #3

Earlier quoted context omitted.

Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

"Cook's egg" is a recommended reading. Summary here (spoilers ahead): https://icdt.osu.edu/cuckoos-egg

Re: A Saudi woman's iPhone revealed hacking around the world

#34

Post by BeetleB » Sat, Feb 19, 2022, 4:44 AM UTC

walrus01 wrote: post #29

Loujain is a University of British Columbia graduate and was a political prisoner: https://www.google.com/search?client=firefox-b-1-d&q=loujain... https://en.wikipedia.org/wiki/Loujain_al-Hathloul Let's not forget that the present Saudi regime (MBS) is responsible for luring political opponents/journalists, killing them, and dismembering them with bone saws. https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khasho…

The irony is that he's also the one who forced the country to allow women to drive.

Re: A Saudi woman's iPhone revealed hacking around the world

#35

Post by Synaesthesia » Sat, Feb 19, 2022, 4:48 AM UTC

BeetleB wrote: post #34

walrus01 wrote: post #29

Loujain is a University of British Columbia graduate and was a political prisoner: https://www.google.com/search?client=firefox-b-1-d&q=loujain... https://en.wikipedia.org/wiki/Loujain_al-Hathloul Let's not forget that the present Saudi regime (MBS) is responsible for luring political opponents/journalists, killing them, and dismembering them with bone saws. https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khasho…

The irony is that he's also the one who forced the country to allow women to drive.

It's just a very minor victory for women's rights and it was a very impractical law anyway.

It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies.

Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.

Re: A Saudi woman's iPhone revealed hacking around the world

#36

Post by itsokimbatman » Sat, Feb 19, 2022, 4:55 AM UTC

vatys wrote: post #7

shp0ngle wrote: post #6

Earlier quoted context omitted.

There are two different types of attacks. One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures. Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.

How does one know which category they are in?

Think about who would want to spy on you, what they'd want to know, and how much they'd be willing to spend to know it.

If the most they could get out of you was a few thousand bucks from your bank account and maybe your email password, you're probably in the first category.

On the other hand, if you have access to highly confidential information (think classified government info or you're literally working on the next iPhone) or are the type of person who makes enemies of spoiled rich oligarchs in despotic nations then you're probably in the second.

Re: A Saudi woman's iPhone revealed hacking around the world

#37

Post by newyankee » Sat, Feb 19, 2022, 5:00 AM UTC

Synaesthesia wrote: post #35

BeetleB wrote: post #34

Earlier quoted context omitted.

The irony is that he's also the one who forced the country to allow women to drive.

It's just a very minor victory for women's rights and it was a very impractical law anyway. It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies. Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.

The entire reason Saudi is so powerful is because of Oil Wealth and its special relationship to US since WW2

Re: A Saudi woman's iPhone revealed hacking around the world

#38

Post by canadaduane » Sat, Feb 19, 2022, 5:04 AM UTC

arunc wrote: post #33

TheBozzCL wrote: post #5

Earlier quoted context omitted.

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

"Cook's egg" is a recommended reading. Summary here (spoilers ahead): https://icdt.osu.edu/cuckoos-egg

Was "Cuckoo's Egg" autocorrected to "Cook's egg"?

Re: A Saudi woman's iPhone revealed hacking around the world

#39

Post by DethNinja » Sat, Feb 19, 2022, 5:06 AM UTC

Would compiling image parsers with ASLR and bounds checking prevent these zero-click hacks?

I haven’t researched the exploits in detail but it seems to me Apple can develop better protection against such zero-click exploits.

At the very least, iMessages shouldn’t preview images from unknown contacts.

Re: A Saudi woman's iPhone revealed hacking around the world

#40

Post by judge2020 » Sat, Feb 19, 2022, 5:09 AM UTC

TheBozzCL wrote: post #5

Steko wrote: post #3

Earlier quoted context omitted.

Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625

Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.

These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1].

0: https://news.ycombinator.com/item?id=30322715

1: https://www.seattletimes.com/business/rights-group-verifies-...

^2: For instance, the Coinbase Super bowl ad that was only a bouncing QR code would have been a very interesting way to start WW3 if it were Russia hacking millions upon millions of americans' phones, exfiltrating any potentially sensitive information (company emails, etc) in an instant, and/or destroying the device via some exploit chain that destroys the OS and requires a full firmware factory reset to recover.