16 ms·
iOS 14.6 device hacked with a zero-click iMessage exploit to install Pegasus
- rubatuga 5y agoanybody notice a lot of crashes in their iOS device lately?
- inter_netuser 5y agoHow often does yours crash?
- rubatuga 5y agoThere was a period from about 3 weeks to one week ago where I had crashes almost every day from Safari, Snapchat, and a few other apps. Maybe 1-3 times a day?
- toxik 5y agoDefinitely not normal, something eating lots of memory? Bug in some iCloud sync bs? If you’re really keen on finding out what’s going on, you can look at the system logs through xcode.
- konart 5y agoNope. Not a singe one since I've got my 11.
- doggodaddo78 5y agoNope. Haven't had a crash in months. iPhone SE 2020.
- Google234 5y agoCould be that your battery has deteriorated too muchz
- eknkc 5y agoNot really. Used to have more occasional crashes but my iPhone 12 crashed only once since I got it at launch.
- 131hn 5y agoIphone 7& 8, barelly usable since 2 months (ios 14.xx)
- javier2 5y agoApps crash so often, I barely even register it, but the OS itself has only had a single reboot crash since I got my iphone 12 right after launch.
- ec109685 5y agoOn the server, we have firecracker and gvisor to provide and extra layer of defense by not allowing userspace to directly access the kernel. Will that be the future on client devices as well given kernels are just too complex to secure perfectly?
- arkadiyt 5y agoAs the tweet author notes, starting with iOS 14 Apple has moved iMessage parsing into a sandboxed "blastdoor" process - I'm surprised it was ineffective in stopping this exploit chain.
- tester756 5y agoWhy there's so much parsing related exploits?
- amelius 5y agoMy guess: because most parsing uses the stack a lot, and the parsed language often allows arbitrary length inputs, both of which are connected to overflow problems, which in turn can often be exploited.
- pojhvc 5y agoIt's more often use-after-free or heap buffer overrun bugs, these days.
- wyager 5y agoBecause people implement parsers in languages that don’t allow direct expression of grammars (e.g. C). To safely implement parsers you must choose either algebraic datatypes or continuation passing, and a lot of programmers choose neither. CPS is annoying in most languages. ADTs are the obvious choice but somehow in 2021 most people are using languages that don’t have them. If you write a parser in Haskell, for example, you’d have to mess up pretty badly and write totally non-idiomatic code to write a parser that crashes at all, let alone crashes in a way that compromises memory safety.
- Exuma 5y agoThis seems bad
- LoveLeadAcid 5y agoSeems safe to assume that everybody's been infected by this point, eh?
- viraptor 5y agoNo. More infections = more noise. If you want to target specific people for a long time, you want to make as little noise as possible. This includes unexpected traffic, file artefacts, background energy use, etc. Although now that the cat is out of the bag, I'm sure some groups are working to reproduce it for mass-infection. Especially since this looks wormable.
- LoveLeadAcid 5y agoI disagree, the NSA has shown us all that sucking in all data and worrying about sorting it later is the way to go. EDIT: yikes, I’ve upset the Unit 8200 agents.
- viraptor 5y agoThis is a different context, different targeted group, different use case, than what we've seen with global NSA monitoring. You're comparing apples to oranges.
- meowface 5y agoPassively collecting data on the wire is different from actively exploiting a device to execute malware. Any entity trying to work with intelligence agencies is definitely going to be careful and somewhat sparing with their use of an "S-tier" zero-day like this. (Unless they have reason to believe it's already likely been burned, in which case they might decide to hastily machine gun it while it's still viable.)
- alfalfasprout 5y agoWith extremely valuable zero-days like this targeting is the way to go b/c you don't want the zero-day discovered by putting it out extensively in the wild. Obviously it's always a question of time anyways.
- eyeball 5y agohow would one tell if they'd been hit with this?
- deleted 5y ago[deleted]
- xyst 5y agoAmnesty International released their forensic tool on GH - https://github.com/mvt-project/mvt https://github.com/mvt-project/mvt. Basically it will analyze your iPhone/Android backups and look for the known IoCs as described in the research paper. https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...
- Arrath 5y agoTIL my corporate webfilter blocks Amnesty's website under "Advocacy Orgs". I guess human rights don't line up with corporate values.
- arkadiyt 5y agoI wrote up some instructions here: https://arkadiyt.com/2021/07/25/scanning-your-iphone-for-nso-group-pegasus-malware/ https://arkadiyt.com/2021/07/25/scanning-your-iphone-for-nso...
- DanAtC 5y agoHow long until the articles telling users to disable iMessage?
- timmytokyo 5y agoI would hope Apple could do something quick and easy in response to this. From the original thread: BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"
- techrat 5y agoReally goes to show Apple's approach to security, "feebly containerize something after it's already been severely exploited."
- fmajid 5y agoImageIO is a fairly widely framework, so the number of vectors is very wide.
- deregulateMed 5y agoRun commercials that end with a black background with a single word Security.
- saagarjha 5y agoIt doesn't actually show a whole lot, because that's not really a very good characterization of how BlastDoor works.
- brigade 5y agoThat would mean, at the very least, that every image and video sent via SMS would require user interaction to even see a preview. Including active conversations with your contacts, given that SMS spoofing is a thing.
- JEFFERSONRUSH1 5y agoDo you need expert help in gaining access/passwords to Facebook, gmail, Instagram, yahoo-mail, snap-chat, twitter, Hotmail, various blogs, icloud, apple accounts or you want to trade on bitcoin etc. Password retrieval,clear debts,change of school grades, professional hacking into institutional servers, clearing of criminal records, smartphone,tablet portable device hacks, ip tracking and general tracking operations..........contact: hack.truth77@gmail.com
- Dah00n 5y ago>"as @AmnestyTech observed and we @citizenlab can confirm, NSO Group's Pegasus spyware delivered via 0-click exploits is no longer "persistent" in the strict sense of the word (i.e., doesn't come back when you reboot). Persistence is achieved via firing the 0-click again. Because the 0-clicks they're using appear to be quite reliable, the lack of traditional "persistence" is a feature, not a drawback of the spyware. It makes the spyware more nimble, and prevents recovery of the "good stuff" (i.e., the spyware and exploits) from forensic analysis." Oh that's bad.
- arkadiyt 5y agoOn the plus side, having persistence means attackers retain access through iOS updates. Their "persist-less" exploits will eventually be patched by Apple, at which point anyone who applies the update has a clean device.
- sjtgraham 5y agoAll exploits stop working once they're patched.
- colejohnson66 5y agoIt’s a reference to bootrom-level exploits. The bootrom is burned into the silicon and can’t be updated. If one finds an exploit in there, Apple can’t patch it without new chips.
- saurik 5y agoBut those still might or might not be persistent. If you need to once again obtain physical access to use your exploit every time the user reboots, it isn't persistent even if the involved exploits are are unpatchable.
- WatchDog 5y agoIf they have a shell on the device, they can choose to persist it whenever they like. Should an ios update be released that patches their exploit, chances are, they can persist the exploit before the device installs the newest version.
- collaborative 5y agoI've been hearing of Pegasus for a good 3 years now. Is it so hard to patch devices to close whatever means it uses to hack them? Or is there also a Pegasus V2, V3, etc that plays catchup with OS's security patches?
- meibo 5y agoIt's the name of a iOS malware/RAT by NSO, an Israeli company that likes to sell their software to governments offering varying degrees of personal freedom around the world. It's been around with zero-click exploits for years, and apparently even now, after their big iMessage "security" rewrite with iOS 14. Very likely that they have other entrypoints as well though.
- drexlspivey 5y agoPegasus was also used by Saudi Arabia to hack Jeff Bezos’ phone and it was MBS (the crown prince) himself that sent the iMessage to him.
- mandeepj 5y agoIt was a WhatsApp missed call
- thehours 5y agoWhatsApp video [1] [1] https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-saudi-arabia https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-sa...
- Firebrand 5y agoDid that actually happen? I thought the Saudi Arabia hack was a convenient tale conjured up by Bezos’ team to cover up that his girlfriend was the one sending his pictures and messages to her brother, who in turn tried selling it to the National Enquirer.
- jazzyjackson 5y ago
- zarzavat 5y agoHow are image parsing exploits still a thing in 2021? Can Apple not use Rust? I struggle to understand why Apple is still relying on C/C++ in such a well known security hotspot.
- fmajid 5y agoOr fuzzing? Why is it that Google's Project Zero has to point out their mistakes for them? Apple's complacency on security is infuriating.
- deregulateMed 5y agoApple doesn't admit wrong doing. Take their multi year long denial of butterfly keyboard issues. The key to user satisfaction isn't security, it's consistent marketing reminders of "security". Apple users here are often forced into the ecosystem due to iOS or safari dev, but the majority of Apple users care more about the name of the iPhone than performance. This is the nature of Veblen goods.
- judge2020 5y ago> Apple doesn't admit wrong doing. On the business end, sure. But https://support.apple.com/en-us/HT201222#:~:text=the%20previous%20version.-,Apple%20security%20updates,-Name%20and%20information https://support.apple.com/en-us/HT201222#:~:text=the%20previ...
- robin_reala 5y agoThat’s a bit of a weird framing. Project Zero point out mistakes in Google’s products too. It’s just that they’re visible. The assumption has to be that Apple quietly fixes minimum a hundred times more security bugs in their products, than the ones the occasional Project Zero blog post highlights.
- fmajid 5y agoGiven their lackadaisical approach to bug reports filed by external researchers, and their grudging payments on their own bug bounty program, I think you are giving them far more credit than they deserve.
- xvector 5y agoBurn everything down and start with memory safe languages, or have computer security remain a joke.
- bottled_poe 5y agoGood luck with that absolutionist agenda.
- ianlevesque 5y agoIt's true though
- gjsman-1000 5y agoNot entirely. Remember some things, like kernels, require unsafe() calls which tell Rust to turn off the memory safety to function properly. There will be significantly less bugs, but there absolutely will be bugs with memory safety remaining.
- ianlevesque 5y agoSure, but we've been trying to "just fix the bugs in the C codebase" for ~30 years now and it just keeps getting worse.
- tonyedgecombe 5y ago>and it just keeps getting worse. Is there any evidence for that because my perception is it has become much harder to exploit systems.
- xvector 5y agoWhat we are seeing is a problem with the very fundamentals of software written in non-memory-safe languages. Everything we do is a bandaid. Any sufficiently funded group will find the zero days they need to exploit the users they want. It's not even a question of if they will find it, or when they will find it. They will find it and they will use it for unethical means. This whole situation is hopeless until we go back to the basics and build systems from the ground-up with security in mind rather than trying to slap band-aids on architectures that were developed when computer security didn't even exist as a serious concept.
- anthk 5y agoStop using propietary software. Choose simple/libre protocols such as Jabber, IRC, or Matrix. Avoid using videoconferences except for journalism. Better if you use a custom build ROM for Android from the sources and then flash your phone. Even better: get a little netbook, the most compatible with OpenBSD. Encrypt your whole SSD with bioctl and use pledge(4) and unveil(4)ed browsers. Use text browsers as much as you can, with a good hosts file. If you need JS, choose some browser such as vimb where you can set 3rd party cookies and JS ondemand with a switch. Use Links+ (links -g for graphics) with Tor (the proxy settings has a Tor checkbox, set 127.0.0.1:9050 for Socks4a proxies AND MARK that checkbox). Go to the Links+ settings and save them from the menu. In order to do the same for i2pd, run Links+ with different setting on the command line to override the saved Tor settings. Basically you need to set all proxied conns through 127.0.0.1:4444. If you trust your partner, use Email+GPG over I2PD (i2pd is the daemon). Alpine/Mutt + GPG is difficult, but Claws-Mail has some PGP settings and it's lightweight enough. OFC if you learnt to use s-nail+fdm+smtpd over I2PD (doable), then that's ok.
- deleted 5y ago[deleted]
- ASpaceCowboi 5y agoDang, I just updated mine to 14.6. Is there anything i can do to be more cautious/prevent spywares from my iphone?
- varenc 5y agoNSO's zero-click exploits work for previous versions of iOS as well. It's still good you upgraded since the latest update includes many fixes for other known security vulnerabilities: https://support.apple.com/en-us/HT212528 https://support.apple.com/en-us/HT212528
- deleted 5y ago[deleted]
- WatchDog 5y agoWhat options, if any, are there to reduce the remote attack surface on an ios device?
- TroisM 5y agodisable networking or enable a firewall, if Apple lets you
- gsibble 5y agoThis severely damages my confidence in ios being a secure operating system. Looking into Linux phones.
- gjsman-1000 5y agoIf they could do this on iOS, your Linux phone doesn't stand a chance. They'll find bugs in it.
- jazzyjackson 5y agoIt probably cost millions of dollars to put together a team to develop and deploy this - it was only worth the investment because it could be reliably used against anyone with an iphone.
- gjsman-1000 5y agoSo it's Security through Obscurity. One of the most mocked security methods online. Gotcha.
- jazzyjackson 5y agoOne of many tools, my man. Personally my security mantra is “don’t become an enemy of the state”
- xvector 5y agoThere's no such thing as a "secure operating system," at least not one with any adoption whatsoever.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- EMM_386 5y ago"fmld" Please tell me this daemon isn't named after what I think it's named after.
- saagarjha 5y agoIt's meant to look like a system daemon, probably fmfd.
- lilcorey10 5y agoIs there any mention on how to check your own devices for this exploit?
- xyst 5y agoAmnesty International released their forensic tool on GH - https://github.com/mvt-project/mvt https://github.com/mvt-project/mvt. Basically it will analyze your iPhone/Android backups and look for the known IoCs as described in the research paper. https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...
- PradeetPatel 5y agoI might come off as quite naive here, but is there an equivalent of mercantile laws regarding exporting goods & services to regimes with diverse and relaxed human right records when it comes to cyber? For example, it has been established that it's illegal to export munition or strategic resources to designated Hate/Terrorist groups.
- theshrike79 5y agoTrying to control Israel or any Israeli company is a political mine field no one wants to step on if they want to continue to have a career in politics.
- jeswin 5y agoIt's crazy how much of Apple's security efforts have gone into preventing users from installing apps on their own devices than actually keeping them safe.
- jazzyjackson 5y agoTin-foil-hat-time: This is Apple's backdoor, just in the "wrong hands" (It's just as likely they have nothing to do with it, I'm just getting out in front of the eventual iMessage leak that Tim Apple gave the plan a thumbs up emoji)
- veeti 5y ago> Oh, and also you can just run "strings" on the DataUsage.sqlite file and find the deleted entries... Maybe they should have enabled secure deletion: https://www.sqlite.org/pragma.html#pragma_secure_delete https://www.sqlite.org/pragma.html#pragma_secure_delete
- leroy_masochist 5y agoDoes anyone know if there is a publicly available list of the 50k numbers that were exploited by this software?