Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

41–50 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#41

Post by saagarjha »

bt848 wrote: post #30
Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

Perhaps it would behoove security-sensitive users to use such devices, but they make up a tiny fraction of all iOS devices in the field. 90% of deployed iOS devices in the USA lack the A12 CPU and the number is higher abroad. Obsolete 32-bit CPUs are more common than CPUs with PAC.

> Obsolete 32-bit CPUs are more common than CPUs with PAC.

According to this (taken soon after iPhone XS/XR went on sale) this is not true: https://www.statista.com/statistics/755593/iphone-model-devi...

Re: A deep dive into iOS Exploit chains found in the wild

#42

Post by burnout445 »

dontbenebby wrote: post #23
js2 wrote: post #12

This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.

>The only way to be safe is probably to access your financial sites These folks don't want money. And statue protects you from fraud - just set up text and email alerts so large transactions alert you ASAP.

I mean that’s generally true but depends on which state actor. North Korea definitely wants your money (or crypto) but Russia doesn’t.

Re: A deep dive into iOS Exploit chains found in the wild

#43

Post by bscphil »

ikeboy wrote: post #18
bscphil wrote: post #17

Earlier quoted context omitted.

Well, you don't necessarily have to jump from one to the other. If you currently do financial stuff on your phone, just enabling 2FA and only browsing them on your laptop is already an enormous step up. There are cases where additional precautions are warranted, but there's no reason to let the perfect be the enemy of the good.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction.

What's more, every time you download a banking app on your phone, you have to place a little bit of trust in the competence of whoever the bank outsourced the programming job to. At least with a laptop, a poorly designed website site is not (by itself) a threat to everything on your computer or other sites you visit.

Even when it comes to "more 0-days", I think you're probably missing the point. There's a lot more software written for computers that can be compromised than just the handful of programs that comprise iOS, so the raw count is not very meaningful. More practically, I'm willing to bet the odds my (Linux) laptop is compromised are far lower than my phone. I don't install apps I don't trust on my computer, but I have little choice but to on my phone.

Re: A deep dive into iOS Exploit chains found in the wild

#44

Post by kccqzy »

saagarjha wrote: post #20
Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.

And researchers gave a talk this year at DEF CON that talked about defeating this exact security mechanism.

Re: A deep dive into iOS Exploit chains found in the wild

#45

Post by bscphil »

maxdamantus wrote: post #36
jijji wrote: post #33

Earlier quoted context omitted.

The argument from the parent about using a laptop is "orders of magnitude" less safe than using a iOS or android device is just not true. It depends what you're running on each device.

When you run any given application on your laptop, it's normally run in such a way that it has all of your user's priveleges on the system; that is, it can access all files that you can access, it can look at the screen that you're looking at, it can produce any input that you can produce, it can manipulate the memory of any process that you can manipulate. When you run an application on iOS or Android, it doesn't ha…

You're right that from a defense standpoint, sandboxed OSes like Android and iOS are "better" than your average laptop. Granted. The point I (and probably your parent comment) were originally trying to make is that the amount of data stored on a phone makes it a very good target for vulnerabilities like these. None of my banking, chat, email, etc information is stored on my laptop because I access these things through the browser. That's not to say that this provides perfect security, of course, but it means someone can't come in with a zero-day that gets root on my system and just one-off uploads all my databases.

Apps that keep all this data locally, as is common on phones, are dangerous. Add the fact that most people have a phone as their two factor and you have a really bad situation when a phone is compromised. This, alone, makes phones an attractive target.

Re: A deep dive into iOS Exploit chains found in the wild

#48

Post by lawnchair_larry »

arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

Because the entity who supplied the exploit has no relation to the entity who supplies the implant and control framework. The latter is commodity developer work, easily done in house or via a defense contractor. It’s not unlikely that the exploit developer had no idea what it was being used in or how.

Re: A deep dive into iOS Exploit chains found in the wild

#49

Post by andrewnicolalde »

krn wrote: post #47

As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and how could they be fixed?

I suspect the main issue is that regardless of what Google does, manufacturers still need to make any new updates available, which most do not for anything but their most recent models.

Re: A deep dive into iOS Exploit chains found in the wild

#50

Post by pjmlp »

bscphil wrote: post #45
maxdamantus wrote: post #36

Earlier quoted context omitted.

When you run any given application on your laptop, it's normally run in such a way that it has all of your user's priveleges on the system; that is, it can access all files that you can access, it can look at the screen that you're looking at, it can produce any input that you can produce, it can manipulate the memory of any process that you can manipulate. When you run an application on iOS or Android, it doesn't ha…

You're right that from a defense standpoint, sandboxed OSes like Android and iOS are "better" than your average laptop. Granted. The point I (and probably your parent comment) were originally trying to make is that the amount of data stored on a phone makes it a very good target for vulnerabilities like these. None of my banking, chat, email, etc information is stored on my laptop because I access these things throug…

Regular people keep copies of banking, chat, emails printouts on their "My Documents", even if they use Web applications instead of native ones for those services.

Speaking of native applications, usually many regular users still use native native applications for email, chat, text processing, spreadsheets, etc.

So while you specifically might take care of having a very clean $HOME, most people don't.

Post reply on HN