19 ms·

The Fully Remote Attack Surface of the iPhone

425 points by lelf 7y ago

zabuni 7y ago
What's really cool is that they released all the code they used to create the attacks. https://github.com/googleprojectzero/iOS-messaging-tools https://github.com/googleprojectzero/iOS-messaging-tools Just went to the talk. TL;DR: iMessage uses old serialization libraries, they are terrible.
- jhatax 7y ago
  The final few paragraphs touch upon how expansive the attack surface can be due to this serialization code. So, yes the libraries are terrible. Asking the HN audience: Is there a set of design principles that the iMessage team can follow to make these more resilient to such attacks while retaining their usability? As a non-Apple employee whose globally dispersed family relies on iMessage to stay in touch, I have a vested interest in the security of my family’s iPhones. I know it’s rare for Apple employees to comment, but it would be great if someone from Apple can comment on whether these libraries are being re-architected in some way. This will cut through any FUD that arises from this disclosure / discussion.
lawnchair_larry 7y ago
One thing I like about this post is how it enumerates all of the dead ends that involved a lot of investment but produced no fruit. This is what is difficult about exploiting hard targets. What the general public doesn’t see is the massive amounts of “wasted” time involved in bug hunting. Instead, they see the headline about how some wunderkind exploited X in a matter of seconds or minutes, conveniently omitting the part where that person spent the last year staring at code, writing tools, fuzzers, test harnesses, and finding nothing at all - not knowing if they would ever find anything, or if there is even a bug to be found.
- jchw 7y ago
  There is something to be said though, and that is that there is always something to be found somewhere. Lacking toolchains that can fully eliminate bugs, there will always be bugs. And even if there were legitimately no bugs, that doesn’t mean there won’t be bugs introduced in future releases, or bugs even outside the software itself. The low hanging fruit has definitely been thoroughly picked these days, at least in software like iOS. But yet with pretty much near certainty, exploits find a way. Perhaps even more fascinating, is that closing off one class of exploits always seems be followed by new kinds of exploits, like clockwork. You’d think eventually this would stop happening, but so far it hasn’t. CPU side channel attacks may not be completely new, but they’ve emerged as one of the new big targets as of late. I really know little about security personally and obviously the amount of work that goes into serious security research should never be underestimated but I’m impressed at the inevitability of security bugs. Very few large programs escape a regular cycle of bugs. Maybe OpenBSD is the best example of Pretty Secure software.
  - wahern 7y ago
    > The low hanging fruit has definitely been thoroughly picked these days The problem is that vendors aren't in the business of perfecting existing software. They're in the business of pushing out big, bold, feature-rich changes and additions. There's always new low hanging fruit.
    - panic 7y ago
      The vulnerabilities found in the article support your argument: SMS and MMS, which barely ever change or get new features, were much more secure than iMessage, which constantly gets new features and architectural changes.
      - wahern 7y ago
        There was a Microsoft Research paper several years ago which looked at the relationship of exploits to age of code in BSD kernels. The number of exploits in older code diminished over time, but that was often offset by the higher prevalence of exploits in newer code. That much is intuitive, but it's good that there's some well researched empirical evidence showing that that's the case. We can hypothesize that better languages and better mitigations (e.g. ASLR) can improve the situation across the board, and I don't doubt that that's the case, but I haven't yet seen the evidence. (Maybe I missed it?) It's probably too early as it's difficult to make apples-to-apples comparisons across those aspects.
- taf2 7y ago
  Sounds like fishing
- snowwrestler 7y ago
  This might also be useful to counter the sometimes line of complaint that Google only runs Project Zero to make their competitors look bad. While they found some exploitable bugs on the iPhone here, they also found (and reported) that quite a few systems did not seem currently exploitable. It seems clear this is not a hit job, at least to me.
  - luch 7y ago
    Sorry but it will take more than a blogpost for me to believe it. When P0 recruits two prominent Chrome hackers (Ned Williamson & Samuel Gross) and make them work directly on iOS, it look like a hit team to me.
    - dmortin 7y ago
      Only if the guys working on other systems are less talented. If equally talented guys work on other systems then it's not a hit job, and I'm sure google puts its best guys to find holes in google products.
    - kbenson 7y ago
      If Google's idea of a hit squad is to pay a few hundred thousand dollars worth of salary to have people do your own bug searching for you and give you a few months to fix it before letting anyone know (or until after you've fixed it, if sooner), then sign any company I'm working for up, and I'm sure there are plenty of other companies that would love the attention too. Apple gets attention from them because a lot of people have apple hardware and software. That means problems there have a higher impact than on some less used product. Apple is more than welcome to respond with its own researchers finding Android and other software bugs, and we'd all be better off if they did.
      - close04 7y ago
        I don't think Apple has a problem with this unless it's irresponsible disclosure. They get a service from P0 and they're quite fast at fixing the issue which works to their advantage. When an exploit is published it will always say "Apple already fixed the issue" which works just great for their image with customers.
mrgalaxy 7y ago
> VVM works by fetching voicemail messages from an IMAP server maintained by the device’s carrier. The server URL and credentials for this server are provided to the device by the carrier over SMS. Visual voicemail is just IMAP and SMS? Wow, for some reason I assumed there would be some distinct protocol for that. It's pretty interesting that it's implemented using the existing software the phone already runs on.
- josho 7y ago
  And frustrating to learn that an open protocol with free implementations is locked behind a carrier that often requires significant fees for this feature.
  - jtl999 7y ago
    and AFAIK clients for said implementation of this protocol don't exist for other platforms (Android)
    - fragmede 7y ago
      T-Mobile, at least, has a VVM app for Android.
  - todd3834 7y ago
    How much does visual voicemail cost? I've never really noticed any significant fees on my bill related to it.
    - Falling3 7y ago
      $2.99 for me. Not a huge cost, but certainly frustrating considering the non-existent burden to the provider.
      - rizwank 7y ago
        Who charges for VVM?
snazz 7y ago
How many people were working on this project for how long? Also, is APNs something they took a look at? No mention of it in the article, which is surprising. Maybe they figured that it would be impossible to inject something into a push notification.
- cjbprime 7y ago
  The blog post describes who did the work, right? Looks like one person for half of it, joined by another person for the second half.
saagarjha 7y ago
> We looked at this extension in great detail, looking for a way to spawn a WebKit instance on the receiving device, but did not find any. The WebKit processing always appears to be done by the sender. This is done for privacy reasons, AFAIK: it prevents “read receipt” links like you might find in emails. It does however allow for the sender to attach a misleading thumbnail, though.
ehsankia 7y ago
I'm curious, does Apple pay the normal bug bounty to Google for finding these exploits?
- rootusrootus 7y ago
  I asked this question the last time this came up and the answer I got was "Project Zero does not accept bounties. They generally ask for the money to be donated."
  - ehsankia 7y ago
    That makes much more sense, it's not like Google needs the money, so going to charity is much better. Now the follow up question is, does Apple do that?
- saagarjha 7y ago
  I don’t think Apple has a bug bounty for these.
- cjbprime 7y ago
  AIUI, Apple doesn't have a bug bounty program. I read that it's planning to start one for invited reporters only. Google's motivation for fixing these bugs is certainly not directly financial.
  - galad87 7y ago
    They have one for iOS.
    - close04 7y ago
      Maybe they have an image incentive to make more noise for iOS bugs than for Google ones but that's about it. Otherwise what they do is actually helping Apple, who patches really quickly.
    - saagarjha 7y ago
      They do, but it covers other kinds of vulnerabilities.
jorangreef 7y ago
> some email providers also filter incoming messages and remove malformed MIME components that are needed to reach a vulnerability. I wrote @ronomon/mime [1] for this purpose, to protect downstream user email clients from MIME bombs [2], invalid charsets which can crash Apple Mail, multiple From headers which can exploit Gmail [3], attachment directory traversals, malicious continuation indices, truncated MIME messages, stack overflows etc. [1] https://github.com/ronomon/mime https://github.com/ronomon/mime [2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email/ https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin... [3] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid...
usmannk 7y ago
How do they actually run the iOS OS code involved in this debugging? Jailbroken iPhones? iOS virtualization ala Corellium (https://corellium.com https://corellium.com)?
- Hitton 7y ago
  Probably so called "Dev-fused iPhones".
  - saagarjha 7y ago
    The code presented in the article seems like it would run on any jailbroken device.
fulafel 7y ago
If this aims to enumerate all the vectors, it seems to be missing the lower level radio & networking attack surface - eg the WLAN one that was a high-profile Project Zero finding some time ago. And common networking things like DHCP client, mDNS, VPN protocols, etc. Probably there are WLAN driver style vulnerabilities in the cellular side too.
- bowmessage 7y ago
  I was thinking phone-over-WiFi would be interesting to explore as well.
canacrypto 7y ago
Fine work here.
godelmachine 7y ago
Is this the first successful remote exploit of the iPhone? If I am not wrong, Android has been exploited multitude of times.
- vageli 7y ago
  > Is this the first successful remote exploit of the iPhone? No? https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-15556/Apple-Iphone-Os.html https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...
mettamage 7y ago
So what's the motivation of Google? Are they are charity now? I phrase it a bit unnuanced, but it does leave me a bit puzzled. I suppose companies can be nice and not nice at the same time, but I'd rather look at the level of incentives first before looking at the level of being nice.
- rkangel 7y ago
  Google has said in the past "we make our money from usage of the internet, and so anything that increases internet usage helps us". That was their stated motivation behind things like Chrome - increase the speed and utility of webapps so that more things could be online. It works in this case because they are improving security and therefore user trust in online services in general.. The cynic in me is sure that that's not the only reason, but it's part of the picture.
  - kps 7y ago
    Project Zero is a Chrome project, so I assume the intent is to find vulnerabilities elsewhere in the system that could end up tied to Chrome.
  - mettamage 7y ago
    Hmm, fair enough. It feels a bit reminiscent of the commoditize your complement type of thing.
beeschlenker 7y ago
Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Kamala Harris $1 billion, to help bring the boys over the border Having trouble getting traction. Getting censored. Billion in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".

425 points by lelf 7y ago

What's really cool is that they released all the code they used to create the attacks. https://github.com/googleprojectzero/iOS-messaging-tools https://github.com/googleprojectzero/iOS-messaging-tools Just went to the talk. TL;DR: iMessage uses old serialization libraries, they are terrible.

jhatax 7y ago
The final few paragraphs touch upon how expansive the attack surface can be due to this serialization code. So, yes the libraries are terrible. Asking the HN audience: Is there a set of design principles that the iMessage team can follow to make these more resilient to such attacks while retaining their usability? As a non-Apple employee whose globally dispersed family relies on iMessage to stay in touch, I have a vested interest in the security of my family’s iPhones. I know it’s rare for Apple employees to comment, but it would be great if someone from Apple can comment on whether these libraries are being re-architected in some way. This will cut through any FUD that arises from this disclosure / discussion.

lawnchair_larry 7y ago

One thing I like about this post is how it enumerates all of the dead ends that involved a lot of investment but produced no fruit. This is what is difficult about exploiting hard targets. What the general public doesn’t see is the massive amounts of “wasted” time involved in bug hunting. Instead, they see the headline about how some wunderkind exploited X in a matter of seconds or minutes, conveniently omitting the part where that person spent the last year staring at code, writing tools, fuzzers, test harnesses, and finding nothing at all - not knowing if they would ever find anything, or if there is even a bug to be found.

jchw 7y ago
There is something to be said though, and that is that there is always something to be found somewhere. Lacking toolchains that can fully eliminate bugs, there will always be bugs. And even if there were legitimately no bugs, that doesn’t mean there won’t be bugs introduced in future releases, or bugs even outside the software itself. The low hanging fruit has definitely been thoroughly picked these days, at least in software like iOS. But yet with pretty much near certainty, exploits find a way. Perhaps even more fascinating, is that closing off one class of exploits always seems be followed by new kinds of exploits, like clockwork. You’d think eventually this would stop happening, but so far it hasn’t. CPU side channel attacks may not be completely new, but they’ve emerged as one of the new big targets as of late. I really know little about security personally and obviously the amount of work that goes into serious security research should never be underestimated but I’m impressed at the inevitability of security bugs. Very few large programs escape a regular cycle of bugs. Maybe OpenBSD is the best example of Pretty Secure software.
- wahern 7y ago
  > The low hanging fruit has definitely been thoroughly picked these days The problem is that vendors aren't in the business of perfecting existing software. They're in the business of pushing out big, bold, feature-rich changes and additions. There's always new low hanging fruit.
  - panic 7y ago
    The vulnerabilities found in the article support your argument: SMS and MMS, which barely ever change or get new features, were much more secure than iMessage, which constantly gets new features and architectural changes.
    - wahern 7y ago
      There was a Microsoft Research paper several years ago which looked at the relationship of exploits to age of code in BSD kernels. The number of exploits in older code diminished over time, but that was often offset by the higher prevalence of exploits in newer code. That much is intuitive, but it's good that there's some well researched empirical evidence showing that that's the case. We can hypothesize that better languages and better mitigations (e.g. ASLR) can improve the situation across the board, and I don't doubt that that's the case, but I haven't yet seen the evidence. (Maybe I missed it?) It's probably too early as it's difficult to make apples-to-apples comparisons across those aspects.
taf2 7y ago
Sounds like fishing
snowwrestler 7y ago
This might also be useful to counter the sometimes line of complaint that Google only runs Project Zero to make their competitors look bad. While they found some exploitable bugs on the iPhone here, they also found (and reported) that quite a few systems did not seem currently exploitable. It seems clear this is not a hit job, at least to me.
- luch 7y ago
  Sorry but it will take more than a blogpost for me to believe it. When P0 recruits two prominent Chrome hackers (Ned Williamson & Samuel Gross) and make them work directly on iOS, it look like a hit team to me.
  - dmortin 7y ago
    Only if the guys working on other systems are less talented. If equally talented guys work on other systems then it's not a hit job, and I'm sure google puts its best guys to find holes in google products.
  - kbenson 7y ago
    If Google's idea of a hit squad is to pay a few hundred thousand dollars worth of salary to have people do your own bug searching for you and give you a few months to fix it before letting anyone know (or until after you've fixed it, if sooner), then sign any company I'm working for up, and I'm sure there are plenty of other companies that would love the attention too. Apple gets attention from them because a lot of people have apple hardware and software. That means problems there have a higher impact than on some less used product. Apple is more than welcome to respond with its own researchers finding Android and other software bugs, and we'd all be better off if they did.
    - close04 7y ago
      I don't think Apple has a problem with this unless it's irresponsible disclosure. They get a service from P0 and they're quite fast at fixing the issue which works to their advantage. When an exploit is published it will always say "Apple already fixed the issue" which works just great for their image with customers.

mrgalaxy 7y ago

> VVM works by fetching voicemail messages from an IMAP server maintained by the device’s carrier. The server URL and credentials for this server are provided to the device by the carrier over SMS. Visual voicemail is just IMAP and SMS? Wow, for some reason I assumed there would be some distinct protocol for that. It's pretty interesting that it's implemented using the existing software the phone already runs on.

josho 7y ago
And frustrating to learn that an open protocol with free implementations is locked behind a carrier that often requires significant fees for this feature.
- jtl999 7y ago
  and AFAIK clients for said implementation of this protocol don't exist for other platforms (Android)
  - fragmede 7y ago
    T-Mobile, at least, has a VVM app for Android.
- todd3834 7y ago
  How much does visual voicemail cost? I've never really noticed any significant fees on my bill related to it.
  - Falling3 7y ago
    $2.99 for me. Not a huge cost, but certainly frustrating considering the non-existent burden to the provider.
    - rizwank 7y ago
      Who charges for VVM?

snazz 7y ago

How many people were working on this project for how long? Also, is APNs something they took a look at? No mention of it in the article, which is surprising. Maybe they figured that it would be impossible to inject something into a push notification.

cjbprime 7y ago
The blog post describes who did the work, right? Looks like one person for half of it, joined by another person for the second half.

saagarjha 7y ago

> We looked at this extension in great detail, looking for a way to spawn a WebKit instance on the receiving device, but did not find any. The WebKit processing always appears to be done by the sender. This is done for privacy reasons, AFAIK: it prevents “read receipt” links like you might find in emails. It does however allow for the sender to attach a misleading thumbnail, though.

ehsankia 7y ago

I'm curious, does Apple pay the normal bug bounty to Google for finding these exploits?

rootusrootus 7y ago
I asked this question the last time this came up and the answer I got was "Project Zero does not accept bounties. They generally ask for the money to be donated."
- ehsankia 7y ago
  That makes much more sense, it's not like Google needs the money, so going to charity is much better. Now the follow up question is, does Apple do that?
saagarjha 7y ago
I don’t think Apple has a bug bounty for these.
cjbprime 7y ago
AIUI, Apple doesn't have a bug bounty program. I read that it's planning to start one for invited reporters only. Google's motivation for fixing these bugs is certainly not directly financial.
- galad87 7y ago
  They have one for iOS.
  - close04 7y ago
    Maybe they have an image incentive to make more noise for iOS bugs than for Google ones but that's about it. Otherwise what they do is actually helping Apple, who patches really quickly.
  - saagarjha 7y ago
    They do, but it covers other kinds of vulnerabilities.

jorangreef 7y ago

> some email providers also filter incoming messages and remove malformed MIME components that are needed to reach a vulnerability. I wrote @ronomon/mime [1] for this purpose, to protect downstream user email clients from MIME bombs [2], invalid charsets which can crash Apple Mail, multiple From headers which can exploit Gmail [3], attachment directory traversals, malicious continuation indices, truncated MIME messages, stack overflows etc. [1] https://github.com/ronomon/mime https://github.com/ronomon/mime [2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email/ https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin... [3] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid...

usmannk 7y ago

How do they actually run the iOS OS code involved in this debugging? Jailbroken iPhones? iOS virtualization ala Corellium (https://corellium.com https://corellium.com)?

Hitton 7y ago
Probably so called "Dev-fused iPhones".
- saagarjha 7y ago
  The code presented in the article seems like it would run on any jailbroken device.

fulafel 7y ago

If this aims to enumerate all the vectors, it seems to be missing the lower level radio & networking attack surface - eg the WLAN one that was a high-profile Project Zero finding some time ago. And common networking things like DHCP client, mDNS, VPN protocols, etc. Probably there are WLAN driver style vulnerabilities in the cellular side too.

bowmessage 7y ago
I was thinking phone-over-WiFi would be interesting to explore as well.

canacrypto 7y ago

Fine work here.

godelmachine 7y ago

Is this the first successful remote exploit of the iPhone? If I am not wrong, Android has been exploited multitude of times.

vageli 7y ago
> Is this the first successful remote exploit of the iPhone? No? https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-15556/Apple-Iphone-Os.html https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...

mettamage 7y ago

So what's the motivation of Google? Are they are charity now? I phrase it a bit unnuanced, but it does leave me a bit puzzled. I suppose companies can be nice and not nice at the same time, but I'd rather look at the level of incentives first before looking at the level of being nice.

rkangel 7y ago
Google has said in the past "we make our money from usage of the internet, and so anything that increases internet usage helps us". That was their stated motivation behind things like Chrome - increase the speed and utility of webapps so that more things could be online. It works in this case because they are improving security and therefore user trust in online services in general.. The cynic in me is sure that that's not the only reason, but it's part of the picture.
- kps 7y ago
  Project Zero is a Chrome project, so I assume the intent is to find vulnerabilities elsewhere in the system that could end up tied to Chrome.
- mettamage 7y ago
  Hmm, fair enough. It feels a bit reminiscent of the commoditize your complement type of thing.

beeschlenker 7y ago

Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Kamala Harris $1 billion, to help bring the boys over the border Having trouble getting traction. Getting censored. Billion in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".