Related recent episode of Darknet Diaries about the Predator spyware: https://darknetdiaries.com/episode/137/.
0-days exploited by commercial surveillance vendor in Egypt
91–100 of 254 posts
Re: 0-days exploited by commercial surveillance vendor in Egypt
#92Earlier quoted context omitted.
> Why do Google and Apple not simply poach these staff They do. Plenty of white hat teams hire 8200 vets, but sometimes they'd rather make their own company instead of being a cog within an amaphorous foreign corporation.
This. IIRC some famous security researcher responsible for iOS jail-breaks was poached by Apple only to leave after 3 months. Successful and skilled security people with a proven track record, don't have the paciente of putting up with the charade such large orgs require.
George Hotz
Re: 0-days exploited by commercial surveillance vendor in Egypt
#93Earlier quoted context omitted.
There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…
that sounds like terrible joke sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox and stuff still manages to escape
That’s the thing about sand. It’s course and rough and irritating and it gets everywhere.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#94Earlier quoted context omitted.
They all do that. I've been in Offensive Security for 10+ years with several spent at FAANGS, and not only do they all have large security teams doing internal testing, they hire multiple contractors like Trail-of-Bits to audit every important service continuously throughout the year. Apple has way more than 10 full time researchers looking at iOS all day, trust me :). They also have a really generous bug bounty. The…
> Apple has way more than 10 full time researchers looking at iOS all day. Yes > They also have a really generous bug bounty. Hell no
Not only is it not generous (relatively speaking), but actually getting paid can be extremely annoying.
Used to be even worse.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#95Earlier quoted context omitted.
Huge difference between being tricked into clicking a link vs just browsing the web and getting owned.
Is there?
I can probably avoid bring tricked into clicking a link, I've avoided many many attempts to trick me in the past. I probably can't avoid browsing the internet though.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#96Earlier quoted context omitted.
It's a small group but a wide pool. It's not like the same person finds 10 0days. And until they do find their one exploit most of them have pretty much no credentials at all. So how do you avoid hiring 10,000 up and comers that never actually come up?
The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.
People have said Apple can buy companies like NSO for less than they probably spend on SEIMs in a year. But as soon as they do that there will be another startup doing the same thing.
The company (GreyShift) that broke the secure enclave had ex-apple security engineers working for them.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#97Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?
I think it’s many factors. 1. They do to some extent. 2. Which researchers are you going to hire? Lemon market, whoever wants to be hired is more likely a lemon. 3. Freelancing grayhat stuff is very rock n roll. 4. I bet some they try to hire and then the square and inflexible large corpo hiring process is just absolutely unfit for hiring such a person.
> Which researchers are you going to hire? Lemon market, whoever wants to be hired is more likely a lemon.
Not really. Most people in that space who have a “day job” are almost always open to being hired for better TC/benefits/more interesting problems.
Points 3 & 4 are largely correct.
It’s very rock and roll, but a very unstable income and most of the brokerages are comically untrustworthy. Also you may develop a conscience and find it hard to sleep at night.
Point 4… usually the people who can find such bugs reliably don’t work well in large corps past the short term. The unexplained gaps in a CV also aren’t conducive to getting past HR easily.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#98Earlier quoted context omitted.
Poach them to do what? There’s not much use to Apple or Google to have an implant developer around, and just having them do nothing is likely to be frustrating if the corporate lifestyle wasn’t enough already.
> Poach them to do what? Poach them to discover 0-days in their software, as I said.
That’s not what implant developers do.
Re: 0-days exploited by commercial surveillance vendor in Egypt
#99Earlier quoted context omitted.
> Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military At a federal level law/power is continually traded for cash/favors. Heck, DoJ itself gets deployed in response to lobbyist demands (eg:copyright enforcement). From what I see this case was egregious and involved a non-favored foreign state. Maybe that's the bar at which DoJ begins to care about political ethics…
> law/power is continually traded for cash/favors I worked on the Hill and that's not how it works. Yes, lobbying happens, but the what Menendez is indicted for goes well beyond anything a lobbyist would do legally. On top of that, foreign lobbyists need to formally register with the DoJ, which obviously didn't happen, but that's just the icing on the cake.
>> law/power is continually traded for cash/favors
> I worked on the Hill and that's not how it works.
Your are asserting that law/power is not continually traded for cash/favors. That's a pretty clear assertion and I appreciate it.
To follow, you would also assert that this chain doesn't exist in any meaningful way:
Major campaign donations are used by legislator -> Legislator benefiting from funds is critical to creation of law/regulation or to enactment of federal action taken that is favorable to donor -> Influential/lucrative, positions that benefit the legislator (or their interest) are made available to the legislator (during/after the elected term) by the donor.
recap: You are asserting that what I describe above is not occurring on an ongoing basis, correct?
Re: 0-days exploited by commercial surveillance vendor in Egypt
#100Earlier quoted context omitted.
Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing,…
But browsers, especially Chrome, have lots of permissions (including geolocation, accessing SD card, accessing user's personal data, camera and microphone etc.). You don't need to do anything if you can run under browser's privileges.