Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

621–630 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#621

Post by stefan_ »

H8crilA wrote: post #571
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm an…

They don't just make a gun, sell it and then it's up to whoever uses it. It is well established they run the C&C servers and tailor operations - they are combatants.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#622

Post by pietro72ohboy »

kubov wrote: post #557
gzer0 wrote: post #520

[flagged]

I dont know why, but this reads like a LLM output.

Such comments are now becoming the new “low-effort shitpost” on HN. If somethings unclear or incorrect, pointing it out may be a better idea

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#623

Post by glitchcrab »

gzer0 wrote: post #530
microtonal wrote: post #524

Earlier quoted context omitted.

That’s in line with Apple’s security note, which says that it’s a vulnerability in ImageIO: https://support.apple.com/en-us/HT213906 I wonder though, wasn’t Blastdoor supposed to stop these privilege escalations in their tracks?

[flagged]

More LLM generated nonsense I suspect

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#624

Post by sz4kerto »

resolutebat wrote: post #570
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

Oh, but you see, NSO targets only "terrorists and criminals", so if you're a law-abiding citizen with nothing to hide, there's nothing to be concerned about. Right? It's not like there's any regimes out there where, say, casual investigative journalism or opposition politics would ever land you with criminal or terrorist charges, no sirree.

In Hungary, for example, which is an EU country and democracy (i.e. there are elections), investigative journalists have been targeted with Pegasus by the government.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#625

Post by runeks »

sneak wrote: post #362
jiofj wrote: post #313

Earlier quoted context omitted.

YES! Current lockdown mode proposition of all-or-nothing is inconvenient.

You can leave lockdown off, and disable iMessage.

I don't want to disable iMessage, just attachments from unknown contacts.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#626

Post by doktrin »

nebula8804 wrote: post #528
jacquesm wrote: post #251

Earlier quoted context omitted.

So stop shipping iPhones to Israel until they play ball. If they're that smart they can roll their own phones. These companies do immense damage and endanger lives the world over. Given enough time and budget there is nothing that can't be cracked and it's the very worst actors that have access to this stuff.

Ha! Thats some nice fan fiction. Look at how Elon is torpedoing himself even further trying to take on ADL(lets be frank they clearly have ties to Israel). It took far right wing people + Elon bringing the issue up to even have a discussion on pushing back against ADL (and now ADL can just say thats just clearly anti-semetic people being anti-semetic) so the issue is already dead. Apple being a public company with ma…

> It took far right wing people + Elon bringing the issue up to even have a discussion on pushing back against ADL (and now ADL can just say thats just clearly anti-semetic people being anti-semetic) so the issue is already dead.

The issue is dead because Elon's grievance is patently absurd. He's accusing the ADL of singlehandedly engineering a 60% drop in Twitter ad sales. It would be genuine comedy were it not for the fact he's handing a megaphone to the worst-of-the-worst groyper kindernazis.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#627

Post by [deleted] »

klabb3 wrote: post #580
quonn wrote: post #574

Earlier quoted context omitted.

— The tech we're all so convinced will "make the world a better place." — That was true 15 years ago … I don‘t hear this often anymore.

It sad true that tech would make the world a better place (in some ways). But not because of the infinite goodness and wisdom of the first movers, who happened to entrench themselves at the right moment in time. The same is true today. Eg LLMs have huge potential. What worries me are the sociopaths who draw the same conclusion.

[deleted]

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#628

Post by jwr »

black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

> That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place."

This calls for a larger discussion of individual choices of every one of us. It would not be an easy discussion, because things are far from simple, and yet every one of us should actively think, instead of falling into the whataboutism trap and doing nothing.

For example, there are probably thousands of tech people in Russia right now either breaking into Ukrainian systems or writing software for missiles, drones, targeting systems, etc. These systems do not write themselves. Each of those people should ask themselves if this is really what they should be doing. I am certainly asking myself if I want to ever work with people who were complicit in these crimes (and how will I know?).

I know some people who pledged to never work on any military systems. I was close to that point of view, until Russia started dropping bombs on my Ukrainian friends. Now I don't see it quite in the same light anymore.

Similarly, the NSO group is not an amorphous entity, PEOPLE work there and write these exploits. In each case, it is a conscious decision.

My point is that we can't abstract tech from moral choices. There is always right and wrong, there is always the right thing to do. It might not be universally applicable, and there will always be endless discussions on HN ("but what about..."), but each of us can and should think about how our work is applied.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#629

Post by goodluckchuck »

caisah wrote: post #577
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The ties to government are a red herring. Hacking into people’s private phones and computer systems is generally immoral and illegal.

It generally continues to be immoral and illegal when governments do it. Except it also becomes more outrageous, because governments are supposed to protect us from this sort of thing.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#630

Post by runeks »

astrange wrote: post #207
lxgr wrote: post #143

Earlier quoted context omitted.

Why not implement all image codecs in a safer language instead? That would seem to tackle the problem at its root rather than relying on an implementation's age as a proxy for safety, given that that clearly isn't a good measure.

Almost all people don't want to or aren't capable of implementing image codecs, the safer languages aren't fast enough to do it in, and the people who are capable of it don't want to learn them.

I call bullshit on this one.

I don't buy that being able to manually copy data into a memory buffer is critical for performance when implementing image codecs. Nor do I accept that, even if we do want to manually copy data into memory, a bounds check at runtime would degrade performance to a noticeable extent.

Post reply on HN