12 ms·
iOS zero-day let SolarWinds hackers compromise fully updated iPhones
- lancemurdock 5y agoI am both terrified and in awe at the technical prowess it takes to discover these vulnerabilities, let alone exploit them. Meanwhile I sit here fumbling with writing custom hooks
- booi 5y agoIf I can write 4 lines of code without an error it’s a good day.
- stevewodil 5y agoThank you for making me feel okay with myself
- BitwiseFool 5y agoHeck, if I can get existing code to build properly on my local machine before I even modify it, it's a good day.
- LouisSayers 5y agoThis made me laugh - I'm setting up some projects on a new machine and going through this process atm. Tried to get one going on Window Subsystem for Linux and had some issues so putting it on my old Mac just to get it to run. I will be happy when it does!
- faeyanpiraat 5y agoUse vagrant
- andrew_ 5y agoI'm a 10x engineer. Guaranteed to be 10x bugs to lines written.
- Groxx 5y agoI think I wrote 3 lines last week. I'm still not confident that it's error-free.
- jodrellblank 5y agoDon't get as far as 6, and they won't find something in them to hang you.
- XMPPwocky 5y agoTo be clear, most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better. It's a distinct skillset. To whatever extent they might build software that's more secure than the average dev's, that really comes down to applying their security skills and toolset to their own software- thinking like an attacker- not any particular skill at software engineering.
- YetAnotherNick 5y ago> most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better. Hard disagree. Maybe you can argue that they might not have skillset/experience of writing good quality code but they need to know the very in depth of each of the component from javascript to kernel. It's not a separate skill. It's the same skill as what senior dev do only the folks who write exploit need to understand allocations in bit level detail in each layer of the machine in which code is executed. eg I would recommend seeing the coding episodes of geohot who was a hacker and look how fast he could write the "ordinary" code like setting up website and other things.
- VMtest 5y agodefine programmer, programmer is not software engineer by default they are exploiting the 'quality' codebase written by your so-called average dev or software engineers and since when software engineering does not take security into account?
- saagarjha 5y agoOf course, this is not always true: a lot of good security researchers are software engineers as much as they are exploit authors. Writing tooling isn't sexy, but sometimes you just have to do it, and if you don't do a good job you aren't going to be able to use it.
- TheSpiceIsLife 5y agoSoftware exploits and tooling don’t need to bug free, they just have to work some of the time on some devices under some circumstances. Luck too. The birthday lottery still plays a roll: being born with the particular set of predispositions, and the right family and environment to encourage strengthening those predispositions.
- arthurcolle 5y agoThere are so many layers of abstractions that interoperate to some degree that these vulnerabilities will only continue to be found/exploited, forever, in the end of time.
- ukeepbelieving 5y agoStatus Quo: yes Nonexistent ideal: No way, Jose. Your infotech is owned because it is fundamentally unsound. There's a huge gap between cutting edge security research at the hardware level and the implementation of consumer hardware/os's Fuchsia is a good start.
- ukeepbelieving 5y agoLots of interesting stuff going on here: https://spectrum.ieee.org/tech-talk/computing/embedded-systems/darpa-hacks-its-secure-hardware-fends-off-most-attacks https://spectrum.ieee.org/tech-talk/computing/embedded-syste... Microsoft IoT for Azure has some interesting hardware developments pertinent to separation of public facing hardware and out of band control mesh
- TechBro8615 5y agoIt’s a dichotomy – they rely on people like us to create the bugs they can exploit :)
- deleted 5y ago[deleted]
- er4hn 5y agoThe big takeaway I have here is that security is a balance between usability and safety. In this case by having malicious links that were obfuscated (behind HTML?) to appear as legitimate LinkedIn links, the target clicking them was compromised. If mail clients were to open a modal for each link and say "Are you sure you want to go to https://LinkMeIn.com/totally-legit?email=victim123@gmail.com https://LinkMeIn.com/totally-legit?email=victim123@gmail.com" would this cut down on these attacks? Taking the idea too far: A system like this would probably link to some sort of cloud database eventually to catch "emerging threats" (novel URLs that look malicious) but then would that in turn threaten end-to-end encryption of email by sending links in emails to a cloud tracker?
- _trampeltier 5y agoHave you seen an link in outlook? This safelink feature? You have almost no idea where you will go.
- dboreham 5y agoFor regular users, the answer to any question "Are you sure..." is always yes.
- ineedasername 5y agoEveryone is always sure. If they aren't the first few times then they quickly get in the habit of just clicking "okay".
- ASalazarMX 5y agoSigh. We had to disable Windows Scripting Engine company-wide because someone complained that his invoice won't download no matter how many times he tried. His invoice in this case was a ransomware payload that the browser was fortunately stopping. Some people care, some care some of the time, and some just don't care.
- tester756 5y agoso, why was it disabled then?
- deleted 5y ago[deleted]
- miles 5y agoUse plaintext email https://useplaintext.email https://useplaintext.email https://news.ycombinator.com/item?id=20513987 https://news.ycombinator.com/item?id=20513987
- eli 5y agoWould that have helped here? Wasn't the problem in clicking the link?
- miles 5y agoAssuming the messages were delivered via email, plain text offers the distinct advantage of non-obfuscated links. More on the same theme: The only safe email is text-only email https://theconversation.com/the-only-safe-email-is-text-only-email-81434 https://theconversation.com/the-only-safe-email-is-text-only... https://news.ycombinator.com/item?id=15224199 https://news.ycombinator.com/item?id=15224199
- hsbauauvhabzb 5y agoWhat if the link contains a spelling mistake your brain is trained to overlook naturallly?
- eli 5y agoOr it’s a legitimate link apparently from someone you trust to a site you haven’t visited before? Or to a site you trust but was compromised? These were very sophisticated attackers.
- sbuk 5y agoDoesn’t help if the mail client detects URLs and presents them as links, like a majority of mail apps do. Seeing the link won’t stop end users from clicking it if it’s blue and underlined, and the slightly cleverer copy and paste. The best bet it to rewrite links and parse the through a proxy that scans them on click. It’s a shame free mail services don’t do this. The only one I think offers this is Outlook.
- milkytron 5y agoCould this be used as an argument for allowing iOS to support other browser engines?
- jmull 5y agoNot a lot. It's almost a wash. Let's say another engine takes half the market. Now you've got twice the attack surface , but the vulnerable population is half as large for each. But some attacks are only worth it if the pool of vulnerable devices is large enough. So the fragmentation helps, bust mostly for lower stakes attacks.
- deregulateMed 5y ago"Security" - Apple Commercials I suppose to give them credit, putting a white word on a black background is enough plausible deniability.
- j16sdiz 5y ago> So the fragmentation helps, bust mostly for lower stakes attacks. fragmentation make keeping all variant up-to-date much harder.
- twobitshifter 5y agoMore browsers = More exploits. An attacker may not know which browser you use, but the linked site could contain multiple exploits to cover more than one browser. Also, this exploit didn't even escape the IOS sandbox. Instead it was exfiltrating active logins to social networking / email sites. The weakness is that attackers were able to violate the same-origin policy and that allowed them to read those cookies from a malicious site. It says that these attackers are mitigated by 'site-isolation' which is in chrome and firefox. Hopefully Safari will add similar capabilities soon.
- TechBro8615 5y agoThe current title might be slightly misleading – the SolarWinds hack did not include an iOS compromise, as I initially thought when reading the headline. To quote the article: > These are two different campaigns, but based on our visibility, we consider the actors behind the WebKit 0-day and the USAID campaign to be the same group of actors Same group, but different campaign.
- deleted 5y ago[deleted]
- 1e-9 5y agoThe Project Zero stats imply three times the rate of detected zero-days versus last year. Apparently, this is largely due to the increasing output of private companies finding and selling exploits. Three of the four exploits discussed in this article were developed by the same private company and sold to two different government-backed actors.
- boomskats 5y agoIs it just me or is this article more interested in asserting that Russian State Hackers are unequivocally responsible for the chain of Solarwinds attacks, rather than discussing the subject of their misleading, arguably clickbait-y title?
- afrcnc 5y agoFrom Google: "The exploit targeted iOS versions 12.4 through 13.7." The title is incorrect. It targeted older phones exclusively.
- joe_the_user 5y agoIs older iOS version iPhone considered "not fully updated"? I'm using an older LTS version of Ubuntu, I get security updates daily and I would myself "fully updated".
- fay59 5y agoSecurity fixes are backported with some frequency, but new mitigations are usually not. If a bug is made inexploitable by a mitigation in the latest OS, older OSes that have the same vulnerable code can probably be exploited, even though they still get security updates.
- clatl 5y agoI think it means it was targeting older model iPhones that are updated to the newest available software from Apple but aren’t supported by the newest versions of iOS. Apple generally releases security updates for these older versions for major vulnerabilities when they know about them, but as stated this was a zero-day so they had not had the opportunity to patch it before the attack.
- zinekeller 5y ago> The title is incorrect. Misleading but not incorrect. Old iOS versions mentioned still gets security updates, so technically correct.
- fouc 5y agoexploit is described in "Forget the Sandbox Escape: Abusing Browsers from Code Execution" https://www.youtube.com/watch?v=a0yPYpmUpIA https://www.youtube.com/watch?v=a0yPYpmUpIA
- BluSyn 5y agoDetails of the specific exploit: > After several validation checks to ensure the device being exploited was a real device, the final payload would be served to exploit CVE- 2021-1879. This exploit would turn off Same-Origin-Policy protections in order to collect authentication cookies from several popular websites, including Google, Microsoft, LinkedIn, Facebook, and Yahoo and send them via WebSocket to an attacker-controlled IP. The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated. There was no sandbox escape or implant delivered via this exploit. The exploit targeted iOS versions 12.4 through 13.7. This type of attack, described by Amy Burnett in Forget the Sandbox Escape: Abusing Browsers from Code Execution, is mitigated in browsers with Site Isolation enabled, such as Chrome or Firefox. For this to be effective you would need to be logged in to your accounts on Safari, rather than just logged in through the respective app (FB for example). So this would have limited effectiveness. Also if you browse with Safari in Private mode it probably wouldn't have worked at all.
- tyingq 5y agoMaybe some of those apps use whatever Apple calls WebViews (SFSafariViewController?) ? As I understand it, the web views share cookie storage with regular safari.
- zacwest 5y agoIt used to but shady developers were able to use it as a side channel communication mechanism, so Apple dropped the shared cookies (and made the view controller not super useful) in iOS 11. Apps can prompt (using Authentication Services) to get temporary access.
- saagarjha 5y agoWell, it's still useful in that it doesn't punt you over to Safari. But if you're looking to have your users already signed in, it is not useful for that, no.
- nuker 5y agoCan we now call it a pandemic? And start doing lockdowns?