Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

511–520 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#511
Question.

Back in the dark ages, a "zero day exploit" was a piece of malware which would lay in wait, doing nothing, counting down the days, until it hit day zero, and then it would trigger and do naughty things. Some folks also referred to this as a time bomb, but that was a less `|33+ term for it. We used to see a lot of these available on sites such as asta... never mind.

Fast forward to the era of "cyber" being hugely popular, and the massive flood of people doing short Kali or "Ethical Hacking" courses and getting into IT security jobs, and I see various formal IT security publications describing a zero day exploit as "ANYTHING which is known and not yet patched". To me, there is absolutely nothing about that description which relates to the "zero" or the "day" or the "zero day". I suspect this new terminology is the result of that influx of people with no background in either computer science or hacking, latching on to a cool sounding term and misunderstanding it completely.

What is your take on this? Do you go with the ye olde terminology, or the currently accepted terminology in fancy publications? Do you believe the meaning changed, and if so, when and how and why?

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#512

Earlier quoted context omitted.

You can disable iMessage and the Messages app will then just send SMS. Or you can install Signal or WhatsApp or whatever

Don’t use SMS instead of iMessage though. Then all your texts will be sent across the network without any kind of decent encryption. And WhatsApp is almost unusable unless you consent to uploading all your contacts to Facebook. (IIRC this was the red line that got crossed that caused the WhatsApp founder to quit FB post-acquisition.) Signal is a good recommendation, but you won’t be able to convince 100% of people yo…

It's a tradeoff. Do you want messages from strangers to run through a bunch of parsers that historically had problems, or do you want to take advantage of your peer group using iMessage.

I'm outside the US, so I don't even need to consider. Nobody here uses iMessage, even the people with iPhones.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#513
post #123
post #70

Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Again buffer overflow in image decoding. Would think apple might just #threatmodel and #fuzz that to death... but you would be wrong. 2.7T market cap company can't do this...

or you know, use Rust

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#514
post #369

Earlier quoted context omitted.

This is less true now, with the option to enable “advanced data protection”. Turning this setting on disables Apple’s access to your iMessage keys along with a bunch of other stuff, though of course if you get locked out, Apple can’t help you

I don’t believe this is true. You can change your iCloud password at any time, which means they definitely are not encrypting your iCloud data based on that key or a derivative. If I had to guess, they generate a key and encrypt that key with your password so it can be changed but they also aren’t able to produce it on request. The drawback here is that the encryption key for your data never changes, even if you chan…

The keys in advanced protection are derived from your device passcodes, your macOS user password and a recovery key. You'll notice you have to approve from one of your devices to use iCloud web or add a new device.

The deviation function takes a while to run and depends on the secure enclave, but you still probably want to avoid 4-digit passcodes.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#515
post #109

Earlier quoted context omitted.

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.

This is the frustrating part: that is cool from a technical perspective but terrifying when you think about this stuff being used to target journalists, activists, etc. Maybe not everyone gets the bone saw but some will - and from the sounds of it it’s people standing up to abusive people: > Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with interna…

Public Service Announcement:

Amnesty International has a program on GitHub with Citizens Lab for those keeping an eye out for additional protections

https://github.com/mvt-project/mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#516
post #482

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

Capitalist view: If they didn't emphasize it, some first-time Apple customers might be convinced by concerned friends and family to enable Lockdown Mode by default, and then might complain to Apple / return their device because it "doesn't do the things it was advertised to do" (because those features don't work in Lockdown Mode.) Realpolitik view: repressive regimes probably only allow Apple to release devices with…

How about the alternative capitalist view that they don't have to spend as much time on QA in lockdown mode? Seems like one of those things that could cause all kinds of unintentrd consequences across apps.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#519
post #131

I appreciate that a solution is for people to update immediately. It really makes me wonder if my Android phones over the years have had 1-days exploited by the sheer incompetence of the ecosystem in updating phones. Not much confidence when you get an update with security patches from 2-3 months ago.

These exploits are highly targeted, they aren't just flying around hitting random devices.

> they aren't just flying around hitting random devices.

For the moment, but only until other wankers reverse engineer the security flaws based on the updated 16.6.1 firmware from Apple. After that you too are vulnerable if you haven't updated.

Post reply on HN