Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

citizenlab.ca

Post reply on HN
Print view View original

41–50 of 314 posts

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#41

Post by toyg »

pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

You seem to assume “America” values the lives of all journalists, including ones outside their sphere of influence. That has never been true, and likely never will be.

As long as US and Israel are fundamentally aligned on long-term foreign policy objectives, aid will continue to be provided no matter what. Dirty work has to be done by someone.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#42

Post by darksaints »

pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

We saw the news this year when a Saudi prince directly authorized the murder and dismemberment of an American/Saudi journalist inside it's own embassy. And literally nothing happened.

I'm not holding my breath on America ever making the right decisions with respect to foreign policy.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#43

Post by toyg »

SV_BubbleTime wrote: post #33
amluto wrote: post #17

Earlier quoted context omitted.

It’s not just the lack of sandboxing — iMessage uses language-level serialization of object graphs. This design is never suitable for sending across privilege boundaries. Apple should replace the format with a reasonable wire format. If this requires updates to apps that integrate with iMessage or breaks interoperability with older iOS versions, so be it.

Can you explain a bit? Are you saying they send messages as Swift objects/structures directly? Instead of a serialization like JSON/CBOR/Proto/Proprietary/etc?

I don’t expect anything as old and critical as iMessage is written on Swift. Chances are it’s all Objective C underneath.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#44

Post by boomboomsubban »

toyg wrote: post #41
pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

You seem to assume “America” values the lives of all journalists, including ones outside their sphere of influence. That has never been true, and likely never will be. As long as US and Israel are fundamentally aligned on long-term foreign policy objectives, aid will continue to be provided no matter what. Dirty work has to be done by someone .

America has no qualms killing journalists in their sphere of influence, and they even prosecute journalists for reporting on their killings. See "Collateral Murder."

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#45

Post by darksaints »

ignoramous wrote: post #18

So, iiuc, this "zero-click" hack involved iMessage and payloads apparently injected via Apple's domains and the exfiltration of data through a tor-like network eventually reaching malicious servers. Is anyone aware of any (FOSS) software (presumably intrusion detectors or indicators of compromise) for mobile phones that might help flag or even prevent such attacks? TinyCheck [0] comes to mind, but it isn't truly mobi…

Most likely the malware is using SSL so packet sniffing from an external device isn't gonna work. And it's apple, so at best you might find a firewall among their tightly locked down app store. Don't worry, apple knows what's good for you far better than you ever could ::eye roll::

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#46

Post by smashah »

pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

WhatsApp "attempted" to get NSOs export license revoked and failed. How would you expect America to stop two of their allies from dealing with each other (with a potential courtship in the works)? Especially when America itself gets major weapons contracts to look the other way?

This will just continue to get worse. More journalists and human rights activists will die because some delusional maniacs feelings were hurt, some ex IDF techs want to make some money and a President wants to keep jobs at Lockheed Martin.

Maybe the BDS list should include more countries. Maybe tech as a whole should replace lip service and instead redirect (and/or reject) major funds to fight injustice on a geopolitical level. Maybe VC funds shouldn't "techwash" despot dollars.

The tech industry has a lot of power in itself and can push the needle without the need to rely on 'America' to do something.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#47

Post by banjomet »

sshumaker wrote: post #34
tomComb wrote: post #26

Earlier quoted context omitted.

Orthogonal to your comment, but Apple could say no and walk away. On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. It will become a business school case study in why companies shouldn't put ethics ahead of money. The point being that we need a business environment where it makes business sense to stand up to authoritarian re…

Can you imagine if Google were the ones behind the great filter and panopticon that is the Chinese internet? Corporations are made up of human beings and at some point if you have any values you have to take a stand. The whole current philosophy of maximizing shareholder value falls apart when you realize the selfsame system that enables a free market is deeply intertwined with the impact powerful organizations have…

The great firewall was originally built by Cisco, but I don't think anybody remembers that.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#49

Post by smashah »

boomboomsubban wrote: post #40
pcbro141 wrote: post #37

America should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.

Seems fairly hypocritical in a number of ways. From our own companies actions, like Blackwater, to our allies actions, like Saudi Arabia, to our own government's actions, like "Collateral Murder" or events in Yemen. Why punish Israel?

Israeli courts rejected the case to revoke NSOs export license which would then implicate the state itself.

IANAL but I think the case can be made that the export of NSOs software is against US law and a violation of the Wassenaar Arrangement. See: 5D002.C.1

So in theory if Israel is allowing one of its companies to break US law then it would make sense to use that as a basis to stop aid to Israel which may be what OP is alluding to.

Re: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

#50

Post by amluto »

SV_BubbleTime wrote: post #33
amluto wrote: post #17

Earlier quoted context omitted.

It’s not just the lack of sandboxing — iMessage uses language-level serialization of object graphs. This design is never suitable for sending across privilege boundaries. Apple should replace the format with a reasonable wire format. If this requires updates to apps that integrate with iMessage or breaks interoperability with older iOS versions, so be it.

Can you explain a bit? Are you saying they send messages as Swift objects/structures directly? Instead of a serialization like JSON/CBOR/Proto/Proprietary/etc?

Search through https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... for NSKeyedUnarchiver.

This seems to be functionally much like Python’s pickle, Boost.Serialization, Java’s object serialization, etc. These techniques seem clever, and they are genuinely useful for prototyping and for certain applications that inherently have no security concerns, but they are not at all suitable for network use. Fundamentally, for network use, one should define a data format, an API, etc and implement it. Using object serialization is backwards — it’s writing the code and then asking a framework to magically network it, and the result is that it networks it too much.

(There are a few systems for writing code and a network protocol simultaneously that treat security as a first-class consideration. The E language comes to mind. I still wouldn’t use E objects to represent data for interoperability reasons if nothing else. But ObjC is not E, and Apple’s design is inexcusable in 2020.)

Post reply on HN