9 ms·
Remote iPhone exploitation part 2: a remote ASLR bypass
- blakesterz 7y agoIt's always interesting to read about these things. It's amazing to me how hard it is to find a bug like this. Also interesting, zerodium would pay up to $2million for something like this, and even more now on Android.
- arkadiyt 7y agoIt'd be capped at $1.5 million [1] since he didn't get persistence, but still very impressive. [1]: https://zerodium.com/program.html https://zerodium.com/program.html
- OrgNet 7y ago> [1]: https://zerodium.com/program.html https://zerodium.com/program.html warning, scrolljacking... Firefox should really fix that bug, like they did with the "new" popups.
- alpb 7y agoWhat's the business model of zerodium? Do they sell them on black market somehow? Why is it able to pay $2M if they weren't going to be able to extort more bounty from Apple (which at that point the security researcher herself can go to Apple, as well?)
- jtokoph 7y agoThis is the first I’ve heard of them but they seem to be based in DC and have government clients. I’m guessing they are funded by the US government to acquire vulnerabilities to use against targets as well as defend from being sold to other countries first.
- alpb 7y agoThat sounds grossly unethical. While the US somehow defends itself from being sold to other countries first (which it still might be), it probably also acquires them to attack/spy on its own citizens as there's been precedents about this, and no indication of policy change to stop it.
- bigiain 7y ago> it probably also acquires them to attack/spy on its own citizens Or possibly, "to spy on foreign nationals and to share with FVEY partners - who'll do the spying on US citizens, because doing it themselves would be illegal"... :sigh:
- lern_too_spel 7y agoAsking other countries spy on US citizens is also illegal. You are spreading a rumor that has no basis in fact.
- jnwatson 7y agoWhat do you think the CIA and CyberCom do for a living? Buying vulns/exploits is just a little government outsourcing.
- StuffedParrot 7y agoEthically, comparing to the CIA is about lowest bar possible.
- deleted 7y ago
- Animats 7y agoThis is why I consider address space randomization to be a cosmetic fix that doesn't solve the real problem - a memory safety violation - but gives an excuse for not fixing the real problem. It just increases the cost of the attack development beyond script-kiddie level. Most of today's attackers seem to be competent and well-funded, either by nation-states, organized crime, or the advertising industry.
- saagarjha 7y agoASLR isn’t a complete exploit mitigation technique, it just hinders attacker by usually requiring them to pair it with another exploit. On many platforms the limited number of random bits makes it clear that it’s not a perfect protection against all attacks.
- deleted 7y ago[deleted]
- advisedwang 7y agoThat's like saying you don't like crash barriers on the side of a highway because it doesn't address the real problem of cars crashing. Yes, ASLR doesn't address the root bugs. Yes, ASLR can be bypassed. But it still lowers the overall risk and so is worth having around.
- Animats 7y agoNo, it's not. Crash barriers are a defense against random events. Attackers are non-random and purposeful. Several defensive layers, all with holes, only protect against inept attackers.
- satya71 7y agoI suspect the number of inept attackers is rather high.
- BoorishBears 7y agoYou're making their point. You're saying it protects against "inept" attackers, that lowers risk. No need to nitpick a simple analogy.
- saagarjha 7y agoPart 1: https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html https://googleprojectzero.blogspot.com/2020/01/remote-iphone...
- greenie_beans 7y agoso...as a dumb consumer, how do i protect myself from this?
- noident 7y agoAlways promptly install security updates. Other than that, there is no protection from this specific class of vulnerabilities. There are other good security practices a slightly savvier user can follow, like running a soft firewall and installing fewer apps, but they wouldn't mitigate this vulnerability.
- dylan604 7y agoThis sounds nice in practice, but real world says that there is a greater than zero chance that the quickly released patch can have a negative affect on your device up to bricking the device. As a long time Apple user, I never install version X.0. I wait until at least X.0.1.
- why-oh-why 7y agoI think you’re mistaking the stability of Apple’s x.0 releases as “negative effects” of security patches. x.0 releases do a lot more than patching. Security updates are much smaller and more frequent than even x.x.1 updates
- dylan604 7y agoThere are is such thing as a "security patch" for iOS. If they release an update, they are releasing features as well. How quickly we forget the debacle that is iOS13. This was not a smooth deployment[0]: 13.0.0 9/19/19 13.1 9/24/19 13.1.1 9/27/19 13.1.2 9/30/19 13.1.3 10/15/19 I wait a couple of days to make sure updates are not bricking devices. Waiting just a week saw 3 updates and a 4th within 10 days. Some of those updates saw serious crippling of capabilities of the device after the update. [0] https://en.wikipedia.org/wiki/IOS_version_history#iOS_13 https://en.wikipedia.org/wiki/IOS_version_history#iOS_13
- musicale 7y agoGoogle is so good at finding fatal iPhone security bugs, maybe Apple should pay them. ;-)
- rootusrootus 7y agoThey seem to already be incentivized sufficiently, though.
- Scarbutt 7y agoObviously a business decision, it is in Google's to interest to protect their services and official apps in all the platforms they support.
- egdod 7y ago... and publicize vulnerabilities in their main competitor.
- person_of_color 7y agoApple doesn't spam the internet with ads.
- DuskStar 7y agoApple doesn't need to have the same business model to be a competitor in the mobile OS space.
- tylerl 7y agoRight, because they should instead publicize all their discoveries except for the Apple ones. Because obviously.
- egdod 7y agoThat’s not what I said. There’s an incentive for them to find Apple vulnerabilities.
- blinkingled 7y agoCCC video that explains this pretty well - https://media.ccc.de/v/36c3-10497-messenger_hacking_remotely_compromising_an_iphone_through_imessage https://media.ccc.de/v/36c3-10497-messenger_hacking_remotely...
- londons_explore 7y agoThis exploit, like many before it, make use of NSKeyedUnarchiver. It's a class which allows arbitrary types to be serialized on the wire. I think it's time that Apple had a new policy that no NSKeyedUnarchiver will ever go from one iPhone to another. They could do that by having a random 64 bit number in the header, and if the header doesn't match the local device, refuse to unarchive. Then all software that breaks, find new ways to encode the specific data they need to send over the wire. Specifically, require they send a specific serialized class structure (ie. something with a schema), rather than something general purpose.
- deleted 7y ago[deleted]
- izacus 7y agoUsing NSKeyedUnarchiver (and other language serializers) on the wire is also a great way to make sure your product is going to be extremely hard to port to other platforms. Even the plist version is not easy to handle outside Apple world. I've consulted many companies which found out that they need to expand beyond Apple horizons, just to find out that their whole infrastructure is based on Apple's binary formats which aren't well documented and are not easily (and reliably) readable on other platforms. Pragmatic move in these cases is to use formats that aren't platform dependent - things like JSONs, Cap'n Proto, msgpack and others.
- saagarjha 7y ago> your product is going to be extremely hard to port to other platforms I'm sure this isn't a particularly troubling issue for Apple.
- londons_explore 7y agoIm sure they'd like the ability to port a service like iMessage to Android, just to give them options incase a big competitor starts eating their user base with cross platform support.
- Uptrenda 7y agoMan, security research is seriously elite. It's like a mixture of arcane magic, invention, and treasure hunting. I wonder how much time it takes to find vulns like this.
- roddux 7y agoMonths of dedicated research, utilising a wealth of knowledge that comes from spending a not-insignificant portion of your career researching such bugs.
- ngcc_hk 7y agoMay be they should have a class to detail how to debug iOS or macos processes.