Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

81–90 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#81

Post by vmception »

pen2l wrote: post #67
vmception wrote: post #56

> further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states I mean the whole “nation state” or “nation state backed” hackers thing was always a liiiiitle (very) ambiguous right? Does the evidence really even move the goal post or mitigate the convenient scapegoating? Politicians and CEOs and certified IT professionals are all incentiviz…

I think it is worthwhile to distinguish the two, and I think generally speaking it's the use of bespoke 0days that separates nation state attackers from all others. One can't really arrange the funding of computer scientists/mathematicians working full-time on the thankless job of finding vulnerabilities without nation-state kind of money, as opposed to employing known vulnerabilities which carry lesser chance of suc…

So nations states as clients isnt the same as being state sponsored or backed, a nation state as a former employer isnt the same either

But ultimately I’m not sure the distinction matters if the main result is that hackers get away unscathed and the victims just deflect attention to the wrong targets

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#82

Post by saiya-jin »

nlh wrote: post #53

As other have commented, this is absolutely mind-bogglingly hard core. Kudos to the NSO group engineers who designed and built this (regardless of your allegiances and whether you like or dislike that they do this and whether it's objectively good or evil or somewhere in between, you have to admit that it's deeply technically impressive). Does anyone have a sense of who they sold this to and who used this particular…

Sorry but can't agree here - this stuff is proper evil for most of world population, which includes also most of HN readers (no its not just SV and 5 other guys). Its more often than not used to oppress common citizens, freedom thinkers and truth sayers.

They are actively making this world a much worse place long term, and why - pure greed for money and power. They don't even try to act like there is some moral / law filter when choosing their customers.

NSO as company is a highly amoral business too, kind of goes hand in hand.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#83

Post by jerf »

olliej wrote: post #7
mmastrac wrote: post #4

Earlier quoted context omitted.

Not just a VM - effectively a computer. Holy crap that's amazing (ly evil).

Right? I was using VM as a short hand - it is after all a virtual just more virtual than usual :)

It's less virtual than usual; it has full access to and control over the embedding process. This is an RM, a Real Machine running in the original access space.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#84

Post by addingnumbers »

Aperocky wrote: post #61
rwaksmunski wrote: post #32

And NSO is the value option. Now imagine what nation states with an actual budget have at their disposal.

The problem with nation states is that they don't pay people. I don't think nation state can ever come up with something like this - it takes passion, genius and those qualities demand higher premiums than governments are ever willing to hand out.

Their entire business model is predicated on nation-states paying NSO more than NSO pays their employees.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#85

Post by bawolff »

anchpop wrote: post #78
nightpool wrote: post #60

Earlier quoted context omitted.

How could Signal recompress images while retaining end-to-end encryption? Wouldn't any "recompression" happen entirely on the client-side, and therefore be fair game for hackers to bypass with their own payloads?

they definitely don’t do this, but in principle they could use homomorphic encryption to do the compression server-side with zero knowledge

Not an expert on this so i might be wrong, but pretty sure in homomorphic encryption, you can't run an algorithm that reduces the size of the encrypted payload. Like you could recompress and after decrypting the result is smaller, but that only happens after decrypting.

Besides, its also totally impractical.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#86

Post by inasio »

usmannk wrote: post #3

This is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.

It seems we're now at the point where anything Turing complete can be a vector. Wow...

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#87

Post by fulafel »

athenot wrote: post #44
airstrike wrote: post #11

Earlier quoted context omitted.

That reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."

Then you can "Enhance". https://www.youtube.com/watch?v=Vxq9yj2pVWk Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.

Well, that and the explanation is missing the details. Conceptually being able to construct something like that from XOR and NOT primitives is stuff from undergrad computer engineering curriculum. But it's certainly a respectable feat to find this combination of compression format and the vulnerability therein of all the supported formats, and think to apply it like this.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#88

Post by inasio »

ivraatiems wrote: post #20

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

I don't see anything fundamentally novel here, other than we're not going to be just laughing at weird things that turn out to be Turing complete, they're all practical intrusion vectors now.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#89

Post by bawolff »

distantsounds wrote: post #75
moyix wrote: post #45

Earlier quoted context omitted.

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

go ahead, fuzz your own iOS exploit. you make it sound like someone just cranks one out before lunch.

Entirely do-able by a team of experts with multimillion dollar budgets over the course of probably many months, doesn't sound at all similar to average hn commenter being able to do it before lunch.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#90

Post by walrus01 »

nightpool wrote: post #60
mlindner wrote: post #47

Earlier quoted context omitted.

Signal lets you embed animated images but they still won't let you send native resolution images from your phone to someone else. Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.

How could Signal recompress images while retaining end-to-end encryption? Wouldn't any "recompression" happen entirely on the client-side, and therefore be fair game for hackers to bypass with their own payloads?

It's my understanding that the signal client which is sending the image reads the jpg/png/whatever image file from local storage, recompresses it local client side, and then sends the smaller version.
Post reply on HN