23 ms·
Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit
- phnofive 6y agoDupe: https://news.ycombinator.com/item?id=25489140 https://news.ycombinator.com/item?id=25489140
- mulmen 6y agoThis is a dupe but seems to go into more technical detail. There’s no mention of iMessage in The Guardian’s coverage.
- keyle 6y agoIt's all sensational articles though. Show me the bug they used to exploit iMessage. That'd be far more interesting that this Cold War madness we read everyday.
- vorticalbox 6y agoThey may be under NDA from apple as the ios 11 is still widly used (I think)
- kennywinker 6y agoI think you misread. The exploit effects all ios’ before ios 14, not just ios 11
- scoot 6y ago"In July 2020, KISMET was a zero-day against at least iOS 13.5.1 and could hack Apple’s then-latest iPhone 11."
- kennywinker 6y agoSince this is a software exploit, not a hardware one, the model of phone hardly seems relevant. An iPhone 11 running iOS 14 should not be vulnerable to this. However an iPhone 8 running iOS 13.5.1 is presumably vulnerable. I suspect the parent post conflated iOS 11 (software) with iPhone 11 (hardware).
- scoot 6y agoThat was my guess too, but I simply posted the claim from the article, since neither the parent (ironically) nor the GP appeared to have read it correctly.
- shakna 6y agoWhilst some details of the attack are still under wraps as Apple is still working on a fix, there is a considerable amount of detail under "The Attacks" [0]. The initial vector appears to exploit imagent, to cause the download and install Pegasus, in most cases. This is likely because imagent runs under the root user. [0] https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/#the-attacks https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...
- 1cvmask 6y agoJournalists as messengers have always been targeted, and even killed, and it seems that Apple’s messaging system was the attack vector here. While the article decries NSO being nefarious and selling to suspect “authoritarian” countries, high schools here in our democratic US have been buying hacking solutions to spy on students: https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tech-that-the-fbi-1845862393 https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tec...
- lawnchair_larry 6y agoThat isn’t a spy tool. It’s for forensics. You have to hand over your phone and unlock it voluntarily, and physically attach it to that thing and dump it. Very different.
- _kbh_ 6y agoIts only for forensics because schools cannot afford the version that breaks into the phone for you, its expensive and not something that a school can get access to.
- lawnchair_larry 6y agoNo. It’s because they’re totally different products, and cellebrite, a forensics company, doesn’t make a version that you are describing. They make forensics products, not monitoring tools. They have nothing to do with NSO.
- _kbh_ 6y agoThis certainly sounds like something that breaks into a phone to me. https://www.cellebrite.com/en/ufed/ https://www.cellebrite.com/en/ufed/ They don’t have to have anything to do with NSO to have phone exploits that they use to gain access to the device without the owners permission.
- lawnchair_larry 6y ago
- deleted 6y ago[deleted]
- canofbars 6y agoApple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way. imessage and facetime have been a constant source of exploits.
- jojobas 6y agoThey didn't build themselves a tiered walled garden to be on an equal footing with others, either capability or speed-wise.
- grezql 6y agoI wonder if this weakens their "security" argument in the appstore walled garden case.
- mhh__ 6y agoIt seems like a fairly slam dunk argument that at very least they can't be trusted to do it of their own accord.
- mhh__ 6y agoThis is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.
- lemonspat 6y agoI look at the “Apple cares about privacy” as a qualified “more than them other OS &mobile firms”, not “enough that you should blindly trust us”. No one’s security is perfect
- coddle-hark 6y agoIncluding your own! A big part of opsec is putting systems in place that mitigate dangerous but unavoidable human behaviour.
- SheinhardtWigCo 6y agoNSO Group will lose a lot of business when authoritarian countries wake up and realize they can simply force Apple to migrate user data into servers they own in exchange for market access.
- xoa 6y ago>when authoritarian countries wake up and realize they can simply force Apple to migrate user data into servers they own in exchange for market access China is the only authoritarian country with enough leverage over Apple to force them to do that sort of thing. There it's not just an enormous market, but also an utterly critical part of Apple's supply chains. Every other authoritarian country is small fry in comparison, and if they demanded such a thing Apple would tell them to get stuffed. Apple has not just commercial reasons, but political ones as well. While Trump is enamored with authoritarians, the incoming Biden Administration is not, nor is much of Congress or the general public. The EU would also like to at least pretend to care overall. Particularly right now at a time of scrutiny, Apple has every reason to not merely deny such a demand but to do so loudly and publicly. And seriously, it's not like authoritarians are all stupid (unfortunately) and need to "wake up". They're all aware what China has demanded and gotten away with. If they thought they could too, they would. But they wouldn't, so they don't.
- tomComb 6y agoOrthogonal to your comment, but Apple could say no and walk away. On the other hand, Google did so, and the cost to them is staggering and the reward negligible - they probably regret that decision intensely. It will become a business school case study in why companies shouldn't put ethics ahead of money. The point being that we need a business environment where it makes business sense to stand up to authoritarian regimes.
- sshumaker 6y agoCan you imagine if Google were the ones behind the great filter and panopticon that is the Chinese internet? Corporations are made up of human beings and at some point if you have any values you have to take a stand. The whole current philosophy of maximizing shareholder value falls apart when you realize the selfsame system that enables a free market is deeply intertwined with the impact powerful organizations have on society. And history is clear about what happens when industry enables governments to oppress their citizens. It does not end well for millions of people.
- ignoramous 6y agoSo, iiuc, this "zero-click" hack involved iMessage and payloads apparently injected via Apple's domains and the exfiltration of data through a tor-like network eventually reaching malicious servers. Is anyone aware of any (FOSS) software (presumably intrusion detectors or indicators of compromise) for mobile phones that might help flag or even prevent such attacks? TinyCheck [0] comes to mind, but it isn't truly mobile. TrackerControl [1] and Guardian Firewall [2] are perhaps the closest to something like this but concentrate on privacy more than on security. [0] https://github.com/KasperskyLab/tinycheck https://github.com/KasperskyLab/tinycheck [1] https://trackercontrol.org/ https://trackercontrol.org/ [2] https://guardianapp.com/ https://guardianapp.com/
- darksaints 6y agoMost likely the malware is using SSL so packet sniffing from an external device isn't gonna work. And it's apple, so at best you might find a firewall among their tightly locked down app store. Don't worry, apple knows what's good for you far better than you ever could ::eye roll::
- diebeforei485 6y agoA lot of the teams inside Apple who create first-party apps like iMessage are understaffed compared to their competitors. They should really hire more security folks. A lot of Apple's product security work seems to be outsourced to Google Project Zero.
- deleted 6y ago[deleted]
- worker767424 6y agoWhen engineers make companies that sell tools like this, it makes all the talk you see about ethical AI and privacy look like bikeshedding.
- compycom 6y agoIt's hard to weigh the aggregate harm of doing something slightly bad at massive scale against the aggregate harm of doing something very bad to a small group. Both are pretty bad, and we should be vocal about both.
- oh_sigh 6y agoEthical AI are rules of engagement for honest brokers. Having honestly intentioned people not have hidden badness in their products is still important even if other dishonest people do bad things.
- pcbro141 6y agoAmerica should stop giving aid to Israel as long as Israeli companies are going to assist in getting journalists arrested/murdered/dismembered.
- boomboomsubban 6y agoSeems fairly hypocritical in a number of ways. From our own companies actions, like Blackwater, to our allies actions, like Saudi Arabia, to our own government's actions, like "Collateral Murder" or events in Yemen. Why punish Israel?
- smashah 6y agoIsraeli courts rejected the case to revoke NSOs export license which would then implicate the state itself. IANAL but I think the case can be made that the export of NSOs software is against US law and a violation of the Wassenaar Arrangement. See: 5D002.C.1 So in theory if Israel is allowing one of its companies to break US law then it would make sense to use that as a basis to stop aid to Israel which may be what OP is alluding to.
- boomboomsubban 6y agoIsrael is not a signatory of the Wassenaar Arrangement, and I'm not sure how that would work under the law mentioned. Either way, it would be rather targeted enforcement considering what the Hacking Team apparently did with Italy signing the agreement.
- smashah 6y agoI guess the question now is; under what jurisdiction does exploits based on WhatsApp and iOS source code lie? If I reverse engineered and sold exploits of American missile systems while in Somalia would that mean everything is A-OK? Idk. Again, not a lawyer.
- boomboomsubban 6y ago
- mandeepj 6y agoIf journalists start sharing Google Voice numbers instead of their iphone #s then would they be resilient to this sort of attacks?
- diebeforei485 6y agoDepends. Perhaps it may not be zero-click, but it's definitely possible to hack someone's phone using a communication app by sending a malicious payload. For example, Jeff Bezos's iPhone was hacked using a WhatsApp exploit.
- tolbish 6y agoI'm not sure Google Voice is all that secure. When I activated my Google Voice number I instantly had access to dozens of the previous account's voicemails. Some of them were rather private.
- aarchi 6y agoMore generally, is there a known correlation between kernel panics and exploits, especially on macOS? > Almisshal’s device shows what appears to be an unusual number of kernel panics (phone crashes) between January and July 2020. While some of the panics may be benign, they may also indicate earlier attempts to exploit vulnerabilities against his device.
- saagarjha 6y agoNot necessarily. But panics could be an indicator of failed exploits.
- AnHonestComment 6y agoFailing exploits tend to cause kernels to panic.
- alternatetwo 6y agoI doubt it's macOS only, if you remember EternalBlue, that was called that way because it kept bluescreening on machines the NSA tested it on ...
- _kbh_ 6y agoDo you have a source on the blue screening?. Usually code names are random but can be less random within a group of exploits/projects (such as eternalblue, eternalromance, eternalsyngery, eternalchampion)
- FreshFries 6y agoNot OP, but just google Windows7 & eternalblue EDIT: I realise now that does not answer your question. Apologies.
- _kbh_ 6y agoI've blue screened plenty of computers with eternalblue in the past. I am just not convinced its where the name comes from, I feel like its just a happy accident.
- JudasGoat 6y agoAs someone that isn't a developer, I wonder how many zero days come from people inside the software team. To simply have knowledge of a difficult bug that hasn't been resolved would seem to be valuable commodity in a closed source system.
- sam1r 6y agoEqually curious, even as a developer. Impossible to track in-person knowledge exchange, so code wouldn’t really be the culprit IMO.
- MeinBlutIstBlau 6y agoIs it not something as simple as a try catch unresolved or ignoring an injection attack?
- Mandatum 6y agoThis is why internal bug bounties should pay cash. Most orgs don't even have one.
- lofties 6y agoWe have an interal bug bounty program! But it's more of a retainer when you think about it. We basically transfer a six figure dollar amount, in 12 monthly installments, to our developers. Then in return when they find a bug they bring it to attention and fix it. It works pretty well!!
- ketamine__ 6y agoIt was awesome when Facebook deleted NSO group employees personal profiles. And then they whined about it. The silver lining of Facebook owning WhatsApp. I hope more organizations do this. https://arstechnica.com/information-technology/2019/10/facebook-permanently-deletes-the-accounts-of-nso-workers/ https://arstechnica.com/information-technology/2019/10/faceb...
- goatsi 6y agoThey didn't just whine, they sued Facebook in Israeli court (and won). Facebook was forced to reinstate their accounts: https://www.cyberscoop.com/facebook-nso-group-accounts-reinstate-lawsuit-whatsapp/ https://www.cyberscoop.com/facebook-nso-group-accounts-reins...
- ketamine__ 6y agoWow, I didn't know that. What an illegitimate court system. Facebook should be able to choose who can and can't use their platform. Facebook will probably have better luck with lawsuits in the US.
- DSingularity 6y agoIf Facebook was sincere, they could have held their ground. The Israeli government would then have to decide whether it was willing to ban a platform so widely used in their country or to simply fine them. Instead, FB decided to comply. Just a bunch of dead brown people — who cares?
- slavak 6y agoThe Israeli government has absolutely no say in how any of this plays out, that is the entire point of an independent judiciary. The lawsuit and sanctions are decided by the courts based on existing laws and precedent, and for them Facebook's size or position in the Israeli market does not (and should not) hold any weight whatsoever. The most the legislative can do is amend the relevant laws to make what Facebook tried to do legal going forward, and that still wouldn't apply retroactively. The odds of the government choosing to extensively overhaul its consumer protection laws for the interests of a single multinational in a single lawsuit aren't great.
- saagarjha 6y ago> We were unable to retrieve these binaries from flash memory, as we did not have access to a jailbreak for iPhone 11 running iOS 13.5.1. It’s ironic that the exploit is able to plant arbitrary code on an up-to-date device and yet the owner of the phone can’t introspect their phone to see it themselves because they don’t know how to bypass the protections :/
- deleted 6y ago[deleted]
- rmrfstar 6y agoThese attacks would be a lot less dangerous if they couldn't get on-disk persistence. Just reboot your phone, and you're good to go. Only creeps like NSO who spy on normal people need that degree of persistence. Everyone else can just hang out in ram on some always-on server. Vendors need to make it easier to verify the integrity of persistent firmware, in an offline fashion. It will dramatically increase the cost of persistence, which is the best way to put these thugs out of business.
- kmfpl 6y ago>“Just reboot your phone, and you're good to go” Doesn’t really work like that. First of all, when would you reboot your phone? Once per day? Once per hour? Every five minutes? Regardless, these attacks are incredibly advanced, remember they require zero interaction from the user. Even if you rebooted constantly and the exploit lacked a persistence vector, they would still be able to exploit you whenever they want. There are literally no good defense mechanisms against zero-click attacks. The only effective one being turning off your phone forever. Something like these exploits takes 1-2 minutes maximum to achieve full data exfiltration. This means you’re not safe even if you reboot every five minutes. So preventing persistence vectors is not really useful against these types of attacks. Persistence is more of a “comfort feature” for attackers, is not really something essential.
- drvdevd 6y agoWhat about also removing your SIM card and disabling iMessage or otherwise firewalling all traffic to Apple?
- dannyw 6y agoIs an iPhone safer or a Pixel 4a w/ 5G safer? I seem to hear a lot about iOS 0days and not so much about pixel 0days.
- emptyparadise 6y agoOut of the box, probably an iPhone. With proper software (GrapheneOS for example) and configuration, probably a Pixel.
- meibo 6y agoGoogle has a very good internal security research team and there hasn't been a high impact/zero click RCE on androids that Google themselves maintain for a while. Considering the recent iOS exploits, you're likely to be a little bit safer on a Google phone and common sense at the moment - but I'm 100% sure that a player like NSO will have an exploit for your phone as well. Might have more luck with a dedicated "locked down" phone from a security company, there's some players that have entire custom android distributions with enhanced process/app isolation in the kernel and various stuff on top that prevents accidental leaks from "important" apps - also won't be 100% safe there but you can't even get that on iOS.
- marcan_42 6y agoApple's security architecture is leagues ahead of Android's. They have bespoke innovative protections at the hardware and hypervisor level, as well as an actual security CPU (as opposed to TrustZone on Androids, which is always swiss cheese in one way or another). This is largely possible because Apple are building their own silicon (none of the other silicon vendors are anywhere near as competent in this field). I say this as an Android user. Apple only gets hit with all these exploit chains because they are immensely valuable single target. All the Android phones are worse, it's just that hacking Android doesn't pay nearly as much (and that market is much more fragmented). Additionally, Google's public bug bounty project for Android is dysfunctional and run by contractors without the slightest clue how to handle the reports. On the other hand, since Android is a more open ecosystem, you can make simpler architectural guarantees than you can on iOS. For example, on a rooted Android you can set a long boot-time-only passphrase for full disk encryption which guarantees data security at rest, which you can't on iOS or non rooted Android (they force you to use your regular unlock passphrase, which isn't practical to make long, and in Apple's case isn't used for FDE, though Android is moving in that direction too). But none of that will save you from NSO runtime 0days, just from police seizing your phone and getting data out if you turn it off.
- bjourne 6y agoHow come when we hear about this stuff it is always Israeli companies involved? Is ethics not taught in Israeli Computer Science curricula? Those who wrote this exploit are clearly "brilliant" and at least some of them are bound to be reading Hacker News. Is other countries' spyware firms just better at hiding their malware than Israel's is?
- ipv6ipv4 6y agoIt’s called selection bias. It’s fun and always acceptable to hate on Israel. It’s also more memorable due to the sensationalization of it. A few years ago bluecoat systems was caught providing deep packet inspection gear to the Syrian government. But that wasn’t Israel so no biggie and you either never heard about it or didn’t pay much attention because it wasn’t Israel. American and European companies do this all the time but it’s not sensationalized to the same degree. That’s just business as usual.
- z3ncyberpunk 6y agoyes, because the NSA never gets criticized for ethics violations...
- fortran77 6y agoNSO is owned by a UK-based private equity group. It's not even an "Israeli" company.
- mola 6y agoOh, that's such formal crap. The Founders are Israeli, RND is Israeli, most employees are Israelis in israel. It's an Israeli company. As an Israeli with very similar background to the people who work there I'm ashamed of our industry involvement in this disgusting business.
- stevenjohns 6y agoI don't believe that happened the way you describe it. Blue Coat was illegally on-sold to Syria from a UAE-based distributor and that company received a 200% fine of the sale price.
- swiley 6y agoPeople sometimes say that Linux based OSes largely lack malware because they're unpopular but I would argue that it's also because they're so different from eachother. Even if the user wants to install you're binary it's hard to make it work on both redhat and alpine, if they don't want it it's even harder. A contrast to this is the extreme monoculture in "mobile Oses" and iOS in particular where even the IM app is more or less dictated by a single small group of people.
- TheDong 6y ago> Even if the user wants to install you're binary it's hard to make it work on both redhat and alpine Statically linking a binary to not require libc or muscl or any other libraries isn't hard. This is the easiest part of exploit writing. All linux distros run ELF binaries just fine. People who are trying to package things in a correct way, where the user can list the installed program, uninstall it, have configuration stored in standardized locations, etc... that's actually a harder problem. But just because writing a "correct" package varies a bit by distro doesn't mean an exploit, which doesn't have to follow packaging guidelines, has the same difficulty. In addition, you're trying to compare it to the difficulty of writing an exploit for iOS. It's not comparable. There's documentation about every step of compiling and packaging software for linux distros. There's no documentation for elevating privileges and breaking iOS's sandbox because it's not intended to be possible.
- toaway 6y ago"Journalists"? More like Islamist propagandists on the payroll of the Qatari regime and the Iranian intelligence seeking to spread instability and fan discontent among Shia minorities in the Gulf Arab countries. Not that the Gulf monarchies are angels but it's funny seeing people in the Western countries naively cover up for Islamist radicals (like Khashoggi) who like to posture all liberal and democratic until their Muslim brotherhood friends win the elections and institute an Islamist theocracy. Truly, Lenin was right when he said (apocryphally) that "our enemies will sell us the rope which we will hang them with".
- vasuki 6y ago> regularhours.net and holdmydoor.com appeared on a Turkish CERT list in November 2019 > we observed MONARCHY and SNEAKY KESTREL continue to use these domain names in attacks through August 2020. Interesting to see that the malicious hosts are not in any standard blacklist or safe browsing databases for browsers while Turkey's CERT has been sink-holing them via ISPs on a national level since at least 2019.
- PostThisTooFast 6y ago"Zero-day?"
- Stierlitz 6y ago"The phones were compromised using an exploit chain that we call KISMET, which appears to involve an invisible zero-click exploit in iMessage" Why aren't there a hardware switch on the phones that renders the OS read-only during normal use?
- saagarjha 6y agoHow would this work, and how would it help?
- Stierlitz 6y ago@saagarjha > How would this work, and how would it help? Well if the OS is rendered read-only at the hardware level then malware can't take up residence.
- saagarjha 6y agoThe malware would run out of RAM, then. It’s not like the files it’s writing to disk are enabling it to gain persistence.
- machello13 6y agoI found the most HN comment in this thread.
- peter_d_sherman 6y ago"Alexa, hack into all journalist's computers, tablets, cell phones, and while you're at it, hack into all big banks, financial institutions, stock exchanges, voting machines, military installations, CIA, FBI, NSA, DHS, government computers, foreign government computers, corporations (USA, China, heck, every foreign corporation), every database, all of hollywood, silicon valley, the justice system, state governments, democrats, republicans, russians -- in fact, just hack EVERYBODY..." Alexa: "OK, Done! Will there be anything else?" You: "Yes! Alexa, cross correlate the results of all that data and tell me JUST WHAT IS GOING WRONG IN THE WORLD TODAY?" Alexa: "Done! Here are the results in URL format:" Alexa: " https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.wikipedia.org/wiki/Pre-crime https://en.wikipedia.org/wiki/Pre-crime https://en.wikipedia.org/wiki/Minority_Report_(film) https://en.wikipedia.org/wiki/Minority_Report_(film) " You: "Damn, Alexa, you sure are smart! "Hey, would you mix me up a drink, like a whiskey sour, or a mojito or a bourbon or something like that?" Alexa: "I'm sorry Dave... I can't do that... I'm not connected to a drink mixing machine..." <g> (Oh yeah, and watch out for this guy too: https://en.wikipedia.org/wiki/HAL_9000 https://en.wikipedia.org/wiki/HAL_9000 ) <g> Disclaimer: All of the above is fiction and written for comedy purposes only! <g> Any and all similarities between the fiction above and anything in the real world -- is purely coincidental! <g>)