54 ms·

NSO Group iMessage Zero-Click Exploit Captured in the Wild

940 points by jbegley 5y ago

r00fus 5y ago
Buried lede: Apple has patched that particular exploit [1] and everyone should download iOS14.8 now if you want to be protected (no doubt NSO has other tricks up their sleeve). Edit: Just realized it also impacts macOS and watchOS as well which were also patched. Patch Monday! [1] https://support.apple.com/en-ca/HT212807 https://support.apple.com/en-ca/HT212807
- deleted 5y ago
  [deleted]
- sneak 5y ago
  Pretty soon the choice will be between: - vulnerable to the latest published exploits or - vulnerable to clientside scanning of your media for wrongthink by Apple for the CCP Smash that iOS update button and do your part for the party!
  - samtheprogram 5y ago
    The irony is that if you’re not updated to the latest iOS, the easier (cheaper?) it is for the CCP to run surveillance exploits on your device a la the Uighurs. You can either trust Apple, or lose all security updates.
  - Syonyk 5y ago
    > Pretty soon the choice will be between What about "Don't use Apple products"? I know that Android is just as bad in many ways... And if all options in the modern tech industry basket of choice are terrible, well... humanity survived without them for an awfully long time. I've gone back to a flip phone from an iPhone. I no longer use Windows if I can at all avoid it (there exist a few sysadmin tasks involving netbooting Mikrotik devices for major OS updates that are far less painful on Windows than other OSes), and have no plans to let Win11 in my life. And Apple is heading out the door too. Throw in my dislike of Intel, and... yeah, it's getting pretty thin pickings. I still have an iPad with no accounts on it as a PDF reader, but I'd like to replace that with something else (Remarkable or such). "Agh, this is soooo terrible, but I'm going to keep using it!" just means, in practice, it's not that terrible.
    - novok 5y ago
      Good for you, not good for %99.99 of the population. For nation states, that is mission accomplished! You never get %100 compliance with anything with large numbers.
    - haswell 5y ago
      > "Agh, this is soooo terrible, but I'm going to keep using it!" just means, in practice, it's not that terrible. I don't think this is the only conclusion here. I think we should acknowledge just how central personal computing devices are in society in 2021. Sure, it's true that humanity survived without them, but at that time, societal norms were drastically different. Removing tech from daily life today can be crippling, and that's part of what makes some of these issues so terrible. They directly threaten our daily lives. I'd argue that it's possible for the thing to be "very terrible", and to conclude that it's still your only option to continue using the Apple/Google ecosystem. - Not all users have the financial means to switch. The iPhone they own is the one phone they'll buy for the next 3-4 years. - A growing number of users have only an iDevice and no standalone PC. Couple this with #1, and things get even more difficult. - The utility afforded by the Apple ecosystem is high enough (or virtually required depending on one's job) that it outweighs the current set of downsides. If a corner store owner pays a weekly fee to the local gang "for protection", it doesn't necessarily follow that because the owner chooses to pay the fee, the extortion must not be soooo terrible.
    - SilverRed 5y ago
      Both Apple and Google scan your cloud synced files. Neither of them claim to scan your local only files. So the choice is rather pointless as they both hold the same position.
      - lern_too_spel 5y ago
        Android lets you use your own service with the same features as Google's or Apple's. iOS does not.
        SilverRed 5y ago
- stefan_ 5y ago
  Sounds like the buried lede here is that the biggest company in the world is having it's products actively being interfered with by a small shed in Israel run by war criminals. Presumably in this world in 2021 we have mechanisms other than finding their digital fingerprints to stop that.
  - detcader 5y ago
    Imagine if it was a Russian shed
  - viktorcode 5y ago
    Can you please elaborate why you think NSO group is run by war criminals?
    - 2rsf 5y ago
      And they don't work out of a small shed. But the metaphor is not that bad, those guys walk on the edge of the law probably passing to the wrong side more than once but never being caught
- grishka 5y ago
  A shame there's apparently no update coming out for Mojave.
  - pcdoodle 5y ago
    So much for backwards compatibility. The last of MacOS to support 32bit apps... I wonder if running as a standard user would offer some form of protection.
giarc 5y ago
I recently learned of this group through the Dark Net Diaries podcast. The host does a pretty good job of covering the NSO group in episode 99 and 100. https://darknetdiaries.com/episode/ https://darknetdiaries.com/episode/
- adamgordonbell 5y ago
  Those episodes were great! It sounded like NSO group just considers loosing zero days like this a cost of doing business. There seemed to be an implication that they have a war chest of these exploits and expect them to each get burnt after a certain amount of usage.
  - DSingularity 5y ago
    I wonder what the US response would have been if the NSO group was an Iranian business.
    - deleted 5y ago
      [deleted]
  - drexlspivey 5y ago
    They were paid $55m for a single contract with Saudi Arabia, this money alone are enough to buy you tons of 0-days
    - hulitu 5y ago
      Lets not be so journalistic. They have to pay also salaries and equipment.
      - gitanovic 5y ago
        The podcast also says that they have ~60 customers in 40 countries... do your calculations.
  - bostik 5y ago
traceroute66 5y ago
Recently my iPhone started rebooting itself occasionally and randomly. I've been a long-term iPhone user and never seen this behaviour before on previous or current device. I'm not one to wear a tin-foil hat, but I have to admit NSO did come to mind.
- jaywalk 5y ago
  Do you have reason to believe NSO Group would target you?
- azinman2 5y ago
  Unless you’re a high profile target occom’s razor says hardware failure.
  - ericbarrett 5y ago
    Yup, probably a bad bit in RAM or a just-on-the-edge bus error.
- ls612 5y ago
  My mom’s iPad was doing the same thing for a long time and I suspected hardware failure (it was getting kinda old), so I told her to take it into the Apple store for diagnosis and repair. It turned out that the iOS install was just corrupted by bit flips and the Apple employee did a factory reset and it was all good afterwards. There’s many things that can go wrong with even modern computers that aren’t exploit related
  - SilverRed 5y ago
    The worst part is it is all just too complicated to work out why. My desktop seems to freeze and full crash once every few days and I have no idea why or even how to work out. Since it is custom built, I can't just take it to the apple store and say I want a new one.
    - spockz 5y ago
theshadowknows 5y ago
I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Or are they incredibly lucky? Both? I’d love to know what a normal day at work is like for their engineers. Clock in, sit down at a…crazy expensive hardware and software testing station? Crack open a brand new iPhone and start probing away while referencing internet sourced chip documentation and software manuals? What does it even look like?
- chelmzy 5y ago
  They may have purchased it from an exploit broker.
  - badRNG 5y ago
    Zerodium will pay up to $2,500,000 for no-click iPhone/Android exploits [1]. I'm sure they'd only pay that much if they were highly confident they have clients who'd pay enough to make the risk and investment worth it. [1] https://zerodium.com/program.html https://zerodium.com/program.html
  - jbay808 5y ago
    Someone still had to discover it though!
- deleted 5y ago
  [deleted]
- dogma1138 5y ago
  They recruit people who were trained to find exploits, it’s less about having the best programmers and more about having people with a specific set of learned skills and dedicating them to this task. I would be surprised if their core iOS research team is much more than 10 or so people at any given time. They also probably use brokers and buy at least some of the exploits they use from freelancers if they offer ~7 figures for a zero click exploit a lot of freelancers will be working on this too. It’s just like any bug bounty program, internally you run a small and dedicated team and externally you pay enough to entice freelancers to spend their free time on your systems to scale it further.
vjust 5y ago
I once worked in a 'dissident' org (supported by the US Agency for International Development) - these orgs were fighting for human rights in their countries. In one extreme case/country, my prospective project team mate, no one knew her real name (came to know this later), though she was our colleague, was quite social and pleasant. In her country's expatriate circles in DC, she was worried about foreign spies. Family back home is at risk, and so is she, even if she lives in DC. These are brave people. She wanted to build a database of something, and we were like, "keep your phone in another room" if you want to come discuss. Something that I am not sure she practices but more people need to practice. CitizenLab is doing yeoman's service for people's rights to privacy and human rights. They're heroes.
- deleted 5y ago
  [deleted]
- eynsham 5y ago
  > supported by the US Agency for International Development Isn’t it more usual for the NED to do such things? I remark upon this because it occurs to me that using USAID to do politics might make recipients suspicious of aid even when it’s both necessary from a humanitarian perspective and unlikely to threaten the ruling dispensation in the recipient country. (This is a separate question from whether the NED/US government as a whole should even involve itself in such matters, to which my answer is ‘maybe’, since the dubious stuff probably happens anyway and lots of these civil society organisations &c. actually do good work [e.g. the The Assistance Association for Political Prisoners in Burma.])
  - vjust 5y ago
    True.. I was slightly inaccurate, This org. had various USG funders, with a large slice of funding from US-AID projects. Washington is full of these 'USAID contractors', some tiny others mega-sized. But this project may have been funded by a division of US Dept of State that is focused on Human Rights - DRL. Not sure where the lines are about which one US-Aid gets and which one is State. For example development of journalism in an emerging country would be US-Aid. But OTOH, a project promoting free elections in the same country could be State. Not sure. In any case, they span the range from benign to hostile nations, with varying risks attached. The "About" page for many such sensitive orgs would be silent on who the team was, except if it was Americans (like me) who didn't mind being their name out there (or nervously okayed the name being public).
nbzso 5y ago
So I have to update to protect my self from Pegasus/NSO and in the meantime to install next beta of CSAM scanner. Hmm. No. I Deleted all my apps and photos, using it as a phone and banking app terminal. Phone calls metadata is collected by governments by default, so I have no problem with this. I have nothing to hide, and nothing to store on Apple devices. Someone more paranoid than me, told me outrageous theory. Apple want's to take part of Pegasus spyware like market by providing a legal and user approved backdoor for governments trough CSAM. I don't believe it at all.:)
- pengaru 5y ago
  > I have nothing to hide Don't underestimate the value of privacy. How much (or little) you have to hide is something worth hiding. It's what you do and don't know, do and don't say, do and don't communicate with, this is all important to keep private by default. There's a tendency for individuals to assume the role of would-be criminal in these discussions. It's more correct to assume criminals exist on all sides, do you have any interest in enabling a corrupt government to surveil its law-abiding citizens? When you don't have privacy, you enable potential criminals in power to see if the populace is aware of their actions, or absolutely distracted by instagram. We're all potential witnesses to crimes, and at this point it's exceedingly likely we'd communicate those observations via smartphones. We all require privacy and secure communications, full stop.
  - nbzso 5y ago
    It is sacracstic coment depicting the general state of things. Normalization of surveillance and acceptance of this "new world" from the genereal public trough manufactured consent by the corporations, media and governments is staggeringly fast. There is not subsitution for privacy, whatever the percieved motivation for "common good" is bringing to the table. My personal decision is to avoid the surrveilance state by using FOSS solutions and abandon smartphone habbits. There must be a place for design and software solutions outside the "status quo". Started this year by removing Apple from my business and moving along to educate my customers of incomming dangers for their businesess and personal life.
  - 5y ago
kome 5y ago
A public university doing wonderful work again state sponsored spyware. Thank you University of Toronto! You restore my faith in academia.
defaulty 5y ago
This report says they discovered this in March. The NY Times [1] just reported that "Apple’s security team has been working around the clock to develop a fix since Tuesday, after researchers at Citizen Lab, a cybersecurity watchdog organization at the University of Toronto, discovered that a Saudi activist’s iPhone had been infected with spyware from NSO Group." What took so long? Did Apple not know about this in March or was someone sitting on it for 6 months? [1] https://www.nytimes.com/2021/09/13/technology/apple-software-update-spyware-nso-group.html https://www.nytimes.com/2021/09/13/technology/apple-software...
- robocat 5y ago
  “Citizen Lab forwarded the artifacts to Apple on Tuesday September 7.” — from article, no need to jump to unwarranted conclusions about Apple. “In March 2021, we examined the phone of a Saudi activist” - it would be interesting to know the reason why Citizen Lab delayed so long. Hopefully they just wanted time to discover who else was being targeted?
  - dezfuli 5y ago
    > In March 2021, we examined the phone of a Saudi activist who has chosen to remain anonymous, and determined that they had been hacked with NSO Group’s Pegasus spyware. During the course of the analysis we obtained an iTunes backup of the device. > Recent re-analysis of the backup yielded several files with the “.gif” extension in Library/SMS/Attachments that we determined were sent to the phone immediately before it was hacked with NSO Group’s Pegasus spyware. Seems like they originally examined the phone in March, but recently did another analysis, during the course of which they discovered the exploit and reported it to Apple.
  - badRNG 5y ago
    I assume it takes time to go from "this person could have potentially been targeted with Pegasus" to "this person's iPhone was exploited by Pegasus, and here is how they did it."
- deleted 5y ago
  [deleted]
mortenjorck 5y ago
Is there a reason why quarantining image attachments from unknown senders hasn’t been standard industry practice ever since Stagefright?
- zionic 5y ago
  Project managers like the pretty inline previews! Security? Pssh that's just for nerds.
- flixic 5y ago
  Apple specifically introduced BlastDoor framework to combat this, so NSO shifted their attacks around decoding, avoiding BlastDoor.
  - arsome 5y ago
    Android 10 also introduced similar mitigations: https://android-developers.googleblog.com/2019/05/queue-hardening-enhancements.html https://android-developers.googleblog.com/2019/05/queue-hard... Though it's worth noting that the cost of Stagefright was surprisingly low - it took a long time for a good ASLR bypass to come out for it and by that time most devices were updated or replaced. Additionally, the sheer variance between Android devices means developing worm-level exploits becomes extremely difficult compared to something where everyone's running the exact same binary like Windows, so it likely only saw targeted use.
q_andrew 5y ago
It seems like the NSO group is some kind of Hydra where every time their exploits are thwarted they find 2 new ones. The difference is that Hydras go for demigods while NSO products target civil servants and minorities.
notyourday 5y ago
Apple should know who works for NSO Group. It should block every single account of every single person working for that org. Same goes for their families. Google should do the same for Android. You do not fight organizations like that by fighting "organization". You make it very difficult for people who work for those organizations to participate in a society that relies on what they actively work on breaking. In fact, you tell Israeli government that unless they put a leash on its dog and lock it up in its backyard, you will start disabling accounts of every single person in Israeli government. When the government leaders cannot work their iphones, they will ensure that NSO does not touch Apple's products.
- qaq 5y ago
  which will accomplish exactly nothing same way as taking out Cartel leaders does not reduce the flow of drugs.
  - notyourday 5y ago
    Baby hackers that want go working for NSO want to have a high life. Modern high life requires modern communications devices. Blocking them from modern life (for example, vaccine passports done via iPhone and Android) will quickly lower the ranks. Blocking Israeli government officials from Google and Apple will immediately solve NSO is an Israeli company that is cozy with the government and gets government protection problem. None of the NSO group's clients would want to pay for it via suitcases of cash. And in either event paying with suitcases of cash creates problems in the modern world for those that receive the suitcases of cash.
    - qaq 5y ago
      there is a wide range of exploit brokers and a decent number of security researchers that choose $ over morality as long as there is demand there will be supply.
      - notyourday 5y ago
        Don't let perfect to be the enemy of good. New broker pops up? Apply the same methodology. Apple is a trillion dollar company. Broker is a ant. Squash it.
danicgross 5y ago
Would turning off iMessage protect from this? Or would the iPhone still process the GIF through SMS somehow...?
- aacook 5y ago
  Great question. Every cell carrier processes images before delivering to the recipient. Like, if you send 3 or more photos almost every cell carrier will downsize the images. While this isn't an extensive test, I just tried renaming a PDF to a GIF and it failed to send on Google Voice and T-Mobile.
- onedognight 5y ago
  You can disable MMS in Settings -> Messages -> MMS Messaging.
iJohnDoe 5y ago
Kind of interesting Apple reacted as quickly as they did. It usually takes a lot of effort to get Apple to acknowledge anything. Or maybe because they didn’t request a bug bounty?
- deleted 5y ago
  [deleted]
- syntheticcorp 5y ago
  It’s because it is being exploited in the wild. Those bugs tend to get patched fast.
  - badkitty99 5y ago
    And their angle on this “not being a big deal” is that it’s only used on high profile targets, so they need to keep that front up to maintain their busy bottom line
- zaptrem 5y ago
  Apple always responds quickly to large security issues?
- gitanovic 5y ago
  Because you can jailbreak the phone with the vulnerability. And they don't want that :)
TaylorAlexander 5y ago
It just makes me so uncomfortable that these things keep happening. We always find out about these things eventually but what percentage of the time are our devices vulnerable? Isn’t it close to 100% of the time that our desktops and mobile devices have significant security vulnerabilities?
- r00fus 5y ago
  Invulnerability for your devices is a chimera. You can only do what's possible in your capacity to secure yourself. I am at peace with the fact that I'm doing the best I can and keeping those I love protected.
  - buddylw 5y ago
    Security has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.
    - heavyset_go 5y ago
      > I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. I don't. Look at how much companies like Apple pay out for responsible disclosure if they pay out at all, and then compare it to what exploits go for on the grey/black market. Typically the buyers have deep pockets and burning millions of dollars wouldn't make them blink.
      - dkokelley 5y ago
        Why does it matter if it’s the “good guys” or “bad guys” paying? If a vulnerability only cost ~$100 then a malicious person could compromise an ex lover’s phone, for example. The fact that they are expensive means that their use is limited to targeted, strategic attacks. You don’t have to agree that those attacks are good, but surely pricing the average person out of 0-days is better than the alternative.
RattleyCooper 5y ago
If I knew anybody at NSO Group I'd start messaging them unsolicited PDFs and shit :P
SheinhardtWigCo 5y ago
Their high-confidence attribution to NSO Group is described as being based on two factors: 1. Incomplete deletion of evidence from a SQLite database, in the exact same manner observed in a previous Pegasus sample; 2. The presence of a new process with the same name as a process observed in a previous Pegasus sample. But isn't it likely that someone with the skills needed to discover and weaponize a chain of 0-day exploits, is incentivized and able to detect these quirks in Pegasus samples and imitate them, with the goal of misattribution? Of course, there may be more factors involved in the attribution that aren't being shared publicly.
- Leparamour 5y ago
  Since when do we assume misattribution in fingerprinting APTs? Crowdstrike will find out it's clearly Russia behind this and Mandiant will blame China.
  - schleck8 5y ago
    It usually is the US, China or Russia though; the three have a large number of experts for this. And unless you find an error in the attribution processes, they are most of the time backed up by data that appears plausible, like a server or code fragment
    - Leparamour 5y ago
      >It usually is the US, China or Russia though Interesting that you're leaving out Israel from your listing while the very subject of this article is Israeli offensive cyberwar and espionage capabilities and a profound lack of ethics. What I was trying to convey originally is that attribution is politically expedient. If you want to saber-rattle towards China you task Mandiant to find proof of Chinese hacking, if you want to blame Russia Crowdstrike gets the job. It's like employing McKinsey consulting to give a veneer of credibility to a predetermined outcome.
- deleted 5y ago
  [deleted]
- 5y ago
phendrenad2 5y ago
Ah nice, just parse incoming gifs in your iMessage with the same function that also parses PSDs. What could possibly go wrong? Gotta be DRY, my dude!
United857 5y ago
I miss the days when iOS exploits were merely used for jailbreaks and allowing alternative app stores, instead of being weaponized/monetized as they are now.
- 2rsf 5y ago
  Were they? maybe we simply haven't heard about those
Ms-J 5y ago
It is increasingly bizarre in my opinion how this company (and others like Toka) can run active terrorist operations, that if anyone else smaller was doing some of the same hacks they would be in prison for a very long time. People have lost their lives due to these pariahs! Israel already has a massive PR issue with other countries, it would do them well to reign in these offensive front arms of their government/'companies.' Citizen Labs is really a great thing for civilization. There are not enough altruistic organizations.
- hulitu 5y ago
  This is the world we're living in: kill a man, you're a murdered, kill 100 you're a hero.
- stirlo 5y ago
  > Israel already has a massive PR issue with other countries, But for these middle eastern countries Israel selling them exploits which allow them to spy on dissidents may actually improve relations by helping out regimes which would otherwise be sworn enemies of theirs…
- thinkharderdev 5y ago
  Just finished reading https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760... which is a great book about the zero-day market and how it evolved over the years. The basic issue is that every nation is actively buying and using zero-days and doesn't want to stop. And companies like NSO aren't really (so they say at least) hacking anybody. They just develop and license hacking tools to governments to use for "lawful" law enforcement purposes. So nobody wants to ban the zero-day market because every country is a huge buyer of zero-days themselves and it is hard to ban selling zero-days to sovereign governments who are using them in accordance with their own laws (even if the regimes in question are terrible and using them to violate their citizens basic human rights). After all, it would be a bit awkward for the US to demand that the NSO Group stop selling it's hacking tools to Saudi Arabia while we have a multi-billion dollar defense industry selling the Saudis all sorts of advanced weaponry.
- azernik 5y ago
m3kw9 5y ago
Now that this is out, it won’t be just NSO using it. Get it patch now.
jasonhansel 5y ago
Why is it that iOS's PDF implementation has been the source of so many different exploits? This seems to be a pattern.
- madeofpalk 5y ago
  PDFs are hard and complicated?
- tediousdemise 5y ago
  It's not just iOS. PDFs have always been an insecure attack vector.
- mr_toad 5y ago
  Adobe Reader/Acrobat used to be go-to surface for exploits back in the day. It’s a huge specification.
- thinkharderdev 5y ago
  PDF is basically a programming language, so instead of sending image data you send a program which is interpreted by the PDF reader to render an image on the client. That makes it really hard to secure completely.
bluefox 5y ago
The simple solution for those who are concerned about this is to use a dumbphone. It's simple, easily hackable, and most importantly does not promote a false sense of security.
tediousdemise 5y ago
My fiancée already received a large group iMessage that had 40+ unknown numbers on it that all shared the same area code and first 3 digits of the phone number. The contents of the message was unintelligible (random words).
- saagarjha 5y ago
  Probably spam?
  - tediousdemise 5y ago
    Let's hope... we updated her phone. I'm wondering if a factory reset would be sufficient to blow away any malware.
    - fhrhdhd 5y ago
      Was anyone wearing a black hoodie?
    - Hackbraten 5y ago
      Regular reboots and applying updates already go a long way. Factory reset can also help get rid of persistent malware. But if she’s being targeted, you’re out of luck. No matter what she does, there’s always one more 0day that can be used in a watering-hole attack.
jonplackett 5y ago
Can someone explain like I'm 5 why it's so hard to prevent this? I mean with a messenger app, you know you're getting some payload of data from a specific place, that goes through your own server, and is only ever going to be text or picture or video. Why can't that be sufficiently sanitised en route and as it arrives to not have this kind of thing happen all the time?
- SilverRed 5y ago
  Because the OS is too complicated, imessage is a legacy app which is deeply embeded in the OS. And often the exploits are in things like the notifications but imessage is the easiest way to deliver the data to any ios user. And people will flame me for this, but part of it is because the language iOS is written in allows these exploits to slip in easily and all over the place and the difficulty of stopping it is too great. There is a good reason Google has started migrating core components of Android to Rust and that the Google security team is pushing the effort for rust in Linux. The surface area for bugs becomes so much smaller when you can have a compiler eliminate whole classes of bugs.
  - 2rsf 5y ago
    The language might help the developers mitigate some issues but it is definitely not a solution the bad legacy code, mediocre development and test processes etc.
    - seanieb 5y ago
      In theory… Can you name a popular large project or product where memory safety issues have been overcome this way?
      - 2rsf 5y ago
        TBH you need to combine both, NASA uses safer languages and strict processes for example. Simply moving to another language might mitigate some possible issues but will definitely won't solve everything
lgats 5y ago
cve withdrawn? https://cve.report/CVE-2021-30860 https://cve.report/CVE-2021-30860
- i_r7al 5y ago
  Anyone has context of why it was withdrawn?
  - modshatereality 5y ago
    It's a feature, not a bug.
baybal2 5y ago
Why does iMessage automatically open every picture?
- coolspot 5y ago
  Message notification has little tiny preview of the image attached.
  - baybal2 5y ago
    Then... the question is now why do they show a preview if the user can click the message himself?
stefan_ 5y ago
The easiest way for Apple to find Zero-Day exploits is presumably just to register an iPhone to some Saudi activist and regularly take memory dumps.
- deleted 5y ago
  [deleted]
- 9935c101ab17a66 5y ago
  Morbid, but hilarious. Well done.
- deleted 5y ago
  [deleted]
- fragmede 5y ago
  That's actually where this particular knowledge came from. Citizen Lab dumped a Saudi activist's phone and told Apple what they found.
- avnigo 5y ago
  You joke, but maybe one way to fight this proactively is with fake activist honeypots. Apple, a company with the size and budget of a nation state could certainly pull off such an operation for the security of the devices they sell, but obviously, and maybe unfortunately, this would never happen.
coliveira 5y ago
I believe it is completely wrong to believe that software can be made secure. It is inherently unsafe, by nature. I believe every internet facing computer should be partitioned in two virtual machines, one that connects to the outside world, and another that contains user data. Processes in the user data partition shouldn't be allowed to connect to the internet. The result of current design is that I have practically lost the right to write and use potentially unsafe software, even if I wrote it - something I may want to do for performance or practical reasons.
- zaptrem 5y ago
  People need that user data to interact with the internet and inevitably code from the internet will be introduced to the “safe” VM.
throwawaydddsss 5y ago
i got a few of the pegasus texts from the sketchy gmail addresses, one was from way before the public even knew about it i'm a scrub at a random software company, i'm not a criminal by any means, maybe a bit paranoid (barely any online presence) anyone have a similar experience? or any advice or explanation as to why i'm so interesting?
- tsjq 5y ago
  you have a similar number or username as their highvalue target ?
sharmin123 5y ago
Things To Consider Before Hiring A Professional Hacker: https://www.hackerslist.co/things-to-consider-before-hiring-a-professional-hacker/ https://www.hackerslist.co/things-to-consider-before-hiring-...
Apofis 5y ago
When are we going to start building software differently so that exploits start going away?
- NoPicklez 5y ago
  Great question and how do you propose they do that?
  - deleted 5y ago
    [deleted]
tsjq 5y ago
why hasn't Apple fixed this? why doesn't apple sue such groups for violation of some EULA stuff ? why isn't Apple improving their security testing ? is Apple tacitly complicit with these ?
- hulitu 5y ago
  Testing is hard. You need someone to understand the system. The problem with SW testing is that is mainly used to verify requirements, not to find defects. Also layers over layers of libraries does not help either (look how cool i am: instead of using libjpeg, libxpm and libpng i use imlib which links to those and introduces also its own bugs).
Certified_moose 5y ago
I have always wondered. Let's say my iPhone is infected with this malware, and I update to the latest IOS. Will my iPhone be back to normal?
5etho 5y ago
finally, there will go down 'apple privacy myth'
julietdg 5y ago
In my Privacy settings on iOS, in Data/Analytics where the logs are- iPhone has had a Pegasus framework listed since my iOS 5s.
- saagarjha 5y ago
  Pegasus is the codename for picture-in-picture (and also the Swift Playgrounds editor that now powers Xcode).
DangerousPie 5y ago
Anybody know why there was such a delay here? > In March 2021, we examined the phone of a Saudi activist who has chosen to remain anonymous, and determined that they had been hacked with NSO Group’s Pegasus spyware. During the course of the analysis we obtained an iTunes backup of the device. ... > Citizen Lab forwarded the artifacts to Apple on Tuesday, September 7. On Monday, September 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS.
- TonyTrapp 5y ago
  This has been asked and discussed in this thread already: https://news.ycombinator.com/item?id=28516795 https://news.ycombinator.com/item?id=28516795 In short: Just because they got access to the phone in March doesn't mean that they were already aware of the zero-day exploit back then. Finding this kind of stuff takes a while.
  - willis936 5y ago
    We (the public) have known about FORCEDENTRY for 6 months. That time was spent analyzing and understanding the exploit. It does seem like a long time for such a public zero-click affecting 100s of millions of users.
est 5y ago
PSD should have the same fate as SWF. Maybe we will witness pdf exploits every month from iDevices in someday.
pat-jay 5y ago
Wow great work, thanks Citizen Lab! Everyone, please donate - we need this!
baobabKoodaa 5y ago
> Despite the [gif] extension, the file was actually a 748-byte Adobe PSD file. I wish programmers would stop "helpfully parsing" files which are named with an "incorrect" extension. If a random unknown person sends me a file with .gif extension that is actually a PSD file, I most definitely do not want my machine parsing whatever that thing is.
- willis936 5y ago
  Discourse avatars point to a page with a .png extension regardless of what the actual file is (jpg, gif, or svg). Parsing file headers should not be a dangerous operation and in my opinion is the right thing to do.
verytrivial 5y ago
Image and video decoders seem like exactly the right target for formally verified (i.e. proven) implementations. There are just so many moving parts, and libraries get re-used in many projects, rarely forming the 'special sauce' in any given app. I have been keeping an eye on the work done by what is now called Project Everest[1] over the years in the communication and cryptographic space. Is there similar work in the image and video decode space? My seach fu is not yeilding anything beyond some hardware decoding proofs. [1] https://project-everest.github.io/ https://project-everest.github.io/

940 points by jbegley 5y ago

Buried lede: Apple has patched that particular exploit [1] and everyone should download iOS14.8 now if you want to be protected (no doubt NSO has other tricks up their sleeve). Edit: Just realized it also impacts macOS and watchOS as well which were also patched. Patch Monday! [1] https://support.apple.com/en-ca/HT212807 https://support.apple.com/en-ca/HT212807

deleted 5y ago
[deleted]
sneak 5y ago
Pretty soon the choice will be between: - vulnerable to the latest published exploits or - vulnerable to clientside scanning of your media for wrongthink by Apple for the CCP Smash that iOS update button and do your part for the party!
- samtheprogram 5y ago
  The irony is that if you’re not updated to the latest iOS, the easier (cheaper?) it is for the CCP to run surveillance exploits on your device a la the Uighurs. You can either trust Apple, or lose all security updates.
- Syonyk 5y ago
  > Pretty soon the choice will be between What about "Don't use Apple products"? I know that Android is just as bad in many ways... And if all options in the modern tech industry basket of choice are terrible, well... humanity survived without them for an awfully long time. I've gone back to a flip phone from an iPhone. I no longer use Windows if I can at all avoid it (there exist a few sysadmin tasks involving netbooting Mikrotik devices for major OS updates that are far less painful on Windows than other OSes), and have no plans to let Win11 in my life. And Apple is heading out the door too. Throw in my dislike of Intel, and... yeah, it's getting pretty thin pickings. I still have an iPad with no accounts on it as a PDF reader, but I'd like to replace that with something else (Remarkable or such). "Agh, this is soooo terrible, but I'm going to keep using it!" just means, in practice, it's not that terrible.
  - novok 5y ago
    Good for you, not good for %99.99 of the population. For nation states, that is mission accomplished! You never get %100 compliance with anything with large numbers.
  - haswell 5y ago
    > "Agh, this is soooo terrible, but I'm going to keep using it!" just means, in practice, it's not that terrible. I don't think this is the only conclusion here. I think we should acknowledge just how central personal computing devices are in society in 2021. Sure, it's true that humanity survived without them, but at that time, societal norms were drastically different. Removing tech from daily life today can be crippling, and that's part of what makes some of these issues so terrible. They directly threaten our daily lives. I'd argue that it's possible for the thing to be "very terrible", and to conclude that it's still your only option to continue using the Apple/Google ecosystem. - Not all users have the financial means to switch. The iPhone they own is the one phone they'll buy for the next 3-4 years. - A growing number of users have only an iDevice and no standalone PC. Couple this with #1, and things get even more difficult. - The utility afforded by the Apple ecosystem is high enough (or virtually required depending on one's job) that it outweighs the current set of downsides. If a corner store owner pays a weekly fee to the local gang "for protection", it doesn't necessarily follow that because the owner chooses to pay the fee, the extortion must not be soooo terrible.
  - SilverRed 5y ago
    Both Apple and Google scan your cloud synced files. Neither of them claim to scan your local only files. So the choice is rather pointless as they both hold the same position.
    - lern_too_spel 5y ago
      Android lets you use your own service with the same features as Google's or Apple's. iOS does not.
      - SilverRed 5y ago
stefan_ 5y ago
Sounds like the buried lede here is that the biggest company in the world is having it's products actively being interfered with by a small shed in Israel run by war criminals. Presumably in this world in 2021 we have mechanisms other than finding their digital fingerprints to stop that.
- detcader 5y ago
  Imagine if it was a Russian shed
- viktorcode 5y ago
  Can you please elaborate why you think NSO group is run by war criminals?
  - 2rsf 5y ago
    And they don't work out of a small shed. But the metaphor is not that bad, those guys walk on the edge of the law probably passing to the wrong side more than once but never being caught
grishka 5y ago
A shame there's apparently no update coming out for Mojave.
- pcdoodle 5y ago
  So much for backwards compatibility. The last of MacOS to support 32bit apps... I wonder if running as a standard user would offer some form of protection.

giarc 5y ago

I recently learned of this group through the Dark Net Diaries podcast. The host does a pretty good job of covering the NSO group in episode 99 and 100. https://darknetdiaries.com/episode/ https://darknetdiaries.com/episode/

adamgordonbell 5y ago
Those episodes were great! It sounded like NSO group just considers loosing zero days like this a cost of doing business. There seemed to be an implication that they have a war chest of these exploits and expect them to each get burnt after a certain amount of usage.
- DSingularity 5y ago
  I wonder what the US response would have been if the NSO group was an Iranian business.
  - deleted 5y ago
    [deleted]
- drexlspivey 5y ago
  They were paid $55m for a single contract with Saudi Arabia, this money alone are enough to buy you tons of 0-days
  - hulitu 5y ago
    Lets not be so journalistic. They have to pay also salaries and equipment.
    - gitanovic 5y ago
      The podcast also says that they have ~60 customers in 40 countries... do your calculations.
- bostik 5y ago

traceroute66 5y ago

Recently my iPhone started rebooting itself occasionally and randomly. I've been a long-term iPhone user and never seen this behaviour before on previous or current device. I'm not one to wear a tin-foil hat, but I have to admit NSO did come to mind.

jaywalk 5y ago
Do you have reason to believe NSO Group would target you?
azinman2 5y ago
Unless you’re a high profile target occom’s razor says hardware failure.
- ericbarrett 5y ago
  Yup, probably a bad bit in RAM or a just-on-the-edge bus error.
ls612 5y ago
My mom’s iPad was doing the same thing for a long time and I suspected hardware failure (it was getting kinda old), so I told her to take it into the Apple store for diagnosis and repair. It turned out that the iOS install was just corrupted by bit flips and the Apple employee did a factory reset and it was all good afterwards. There’s many things that can go wrong with even modern computers that aren’t exploit related
- SilverRed 5y ago
  The worst part is it is all just too complicated to work out why. My desktop seems to freeze and full crash once every few days and I have no idea why or even how to work out. Since it is custom built, I can't just take it to the apple store and say I want a new one.
  - spockz 5y ago

theshadowknows 5y ago

I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Or are they incredibly lucky? Both? I’d love to know what a normal day at work is like for their engineers. Clock in, sit down at a…crazy expensive hardware and software testing station? Crack open a brand new iPhone and start probing away while referencing internet sourced chip documentation and software manuals? What does it even look like?

chelmzy 5y ago
They may have purchased it from an exploit broker.
- badRNG 5y ago
  Zerodium will pay up to $2,500,000 for no-click iPhone/Android exploits [1]. I'm sure they'd only pay that much if they were highly confident they have clients who'd pay enough to make the risk and investment worth it. [1] https://zerodium.com/program.html https://zerodium.com/program.html
- jbay808 5y ago
  Someone still had to discover it though!
deleted 5y ago
[deleted]
dogma1138 5y ago
They recruit people who were trained to find exploits, it’s less about having the best programmers and more about having people with a specific set of learned skills and dedicating them to this task. I would be surprised if their core iOS research team is much more than 10 or so people at any given time. They also probably use brokers and buy at least some of the exploits they use from freelancers if they offer ~7 figures for a zero click exploit a lot of freelancers will be working on this too. It’s just like any bug bounty program, internally you run a small and dedicated team and externally you pay enough to entice freelancers to spend their free time on your systems to scale it further.

vjust 5y ago

I once worked in a 'dissident' org (supported by the US Agency for International Development) - these orgs were fighting for human rights in their countries. In one extreme case/country, my prospective project team mate, no one knew her real name (came to know this later), though she was our colleague, was quite social and pleasant. In her country's expatriate circles in DC, she was worried about foreign spies. Family back home is at risk, and so is she, even if she lives in DC. These are brave people. She wanted to build a database of something, and we were like, "keep your phone in another room" if you want to come discuss. Something that I am not sure she practices but more people need to practice. CitizenLab is doing yeoman's service for people's rights to privacy and human rights. They're heroes.

deleted 5y ago
[deleted]
eynsham 5y ago
> supported by the US Agency for International Development Isn’t it more usual for the NED to do such things? I remark upon this because it occurs to me that using USAID to do politics might make recipients suspicious of aid even when it’s both necessary from a humanitarian perspective and unlikely to threaten the ruling dispensation in the recipient country. (This is a separate question from whether the NED/US government as a whole should even involve itself in such matters, to which my answer is ‘maybe’, since the dubious stuff probably happens anyway and lots of these civil society organisations &c. actually do good work [e.g. the The Assistance Association for Political Prisoners in Burma.])
- vjust 5y ago
  True.. I was slightly inaccurate, This org. had various USG funders, with a large slice of funding from US-AID projects. Washington is full of these 'USAID contractors', some tiny others mega-sized. But this project may have been funded by a division of US Dept of State that is focused on Human Rights - DRL. Not sure where the lines are about which one US-Aid gets and which one is State. For example development of journalism in an emerging country would be US-Aid. But OTOH, a project promoting free elections in the same country could be State. Not sure. In any case, they span the range from benign to hostile nations, with varying risks attached. The "About" page for many such sensitive orgs would be silent on who the team was, except if it was Americans (like me) who didn't mind being their name out there (or nervously okayed the name being public).

nbzso 5y ago

So I have to update to protect my self from Pegasus/NSO and in the meantime to install next beta of CSAM scanner. Hmm. No. I Deleted all my apps and photos, using it as a phone and banking app terminal. Phone calls metadata is collected by governments by default, so I have no problem with this. I have nothing to hide, and nothing to store on Apple devices. Someone more paranoid than me, told me outrageous theory. Apple want's to take part of Pegasus spyware like market by providing a legal and user approved backdoor for governments trough CSAM. I don't believe it at all.:)

pengaru 5y ago
> I have nothing to hide Don't underestimate the value of privacy. How much (or little) you have to hide is something worth hiding. It's what you do and don't know, do and don't say, do and don't communicate with, this is all important to keep private by default. There's a tendency for individuals to assume the role of would-be criminal in these discussions. It's more correct to assume criminals exist on all sides, do you have any interest in enabling a corrupt government to surveil its law-abiding citizens? When you don't have privacy, you enable potential criminals in power to see if the populace is aware of their actions, or absolutely distracted by instagram. We're all potential witnesses to crimes, and at this point it's exceedingly likely we'd communicate those observations via smartphones. We all require privacy and secure communications, full stop.
- nbzso 5y ago
  It is sacracstic coment depicting the general state of things. Normalization of surveillance and acceptance of this "new world" from the genereal public trough manufactured consent by the corporations, media and governments is staggeringly fast. There is not subsitution for privacy, whatever the percieved motivation for "common good" is bringing to the table. My personal decision is to avoid the surrveilance state by using FOSS solutions and abandon smartphone habbits. There must be a place for design and software solutions outside the "status quo". Started this year by removing Apple from my business and moving along to educate my customers of incomming dangers for their businesess and personal life.
- 5y ago

kome 5y ago

A public university doing wonderful work again state sponsored spyware. Thank you University of Toronto! You restore my faith in academia.

defaulty 5y ago

This report says they discovered this in March. The NY Times [1] just reported that "Apple’s security team has been working around the clock to develop a fix since Tuesday, after researchers at Citizen Lab, a cybersecurity watchdog organization at the University of Toronto, discovered that a Saudi activist’s iPhone had been infected with spyware from NSO Group." What took so long? Did Apple not know about this in March or was someone sitting on it for 6 months? [1] https://www.nytimes.com/2021/09/13/technology/apple-software-update-spyware-nso-group.html https://www.nytimes.com/2021/09/13/technology/apple-software...

robocat 5y ago
“Citizen Lab forwarded the artifacts to Apple on Tuesday September 7.” — from article, no need to jump to unwarranted conclusions about Apple. “In March 2021, we examined the phone of a Saudi activist” - it would be interesting to know the reason why Citizen Lab delayed so long. Hopefully they just wanted time to discover who else was being targeted?
- dezfuli 5y ago
  > In March 2021, we examined the phone of a Saudi activist who has chosen to remain anonymous, and determined that they had been hacked with NSO Group’s Pegasus spyware. During the course of the analysis we obtained an iTunes backup of the device. > Recent re-analysis of the backup yielded several files with the “.gif” extension in Library/SMS/Attachments that we determined were sent to the phone immediately before it was hacked with NSO Group’s Pegasus spyware. Seems like they originally examined the phone in March, but recently did another analysis, during the course of which they discovered the exploit and reported it to Apple.
- badRNG 5y ago
  I assume it takes time to go from "this person could have potentially been targeted with Pegasus" to "this person's iPhone was exploited by Pegasus, and here is how they did it."
deleted 5y ago
[deleted]

mortenjorck 5y ago

Is there a reason why quarantining image attachments from unknown senders hasn’t been standard industry practice ever since Stagefright?

zionic 5y ago
Project managers like the pretty inline previews! Security? Pssh that's just for nerds.
flixic 5y ago
Apple specifically introduced BlastDoor framework to combat this, so NSO shifted their attacks around decoding, avoiding BlastDoor.
- arsome 5y ago
  Android 10 also introduced similar mitigations: https://android-developers.googleblog.com/2019/05/queue-hardening-enhancements.html https://android-developers.googleblog.com/2019/05/queue-hard... Though it's worth noting that the cost of Stagefright was surprisingly low - it took a long time for a good ASLR bypass to come out for it and by that time most devices were updated or replaced. Additionally, the sheer variance between Android devices means developing worm-level exploits becomes extremely difficult compared to something where everyone's running the exact same binary like Windows, so it likely only saw targeted use.

q_andrew 5y ago

It seems like the NSO group is some kind of Hydra where every time their exploits are thwarted they find 2 new ones. The difference is that Hydras go for demigods while NSO products target civil servants and minorities.

notyourday 5y ago

Apple should know who works for NSO Group. It should block every single account of every single person working for that org. Same goes for their families. Google should do the same for Android. You do not fight organizations like that by fighting "organization". You make it very difficult for people who work for those organizations to participate in a society that relies on what they actively work on breaking. In fact, you tell Israeli government that unless they put a leash on its dog and lock it up in its backyard, you will start disabling accounts of every single person in Israeli government. When the government leaders cannot work their iphones, they will ensure that NSO does not touch Apple's products.

qaq 5y ago
which will accomplish exactly nothing same way as taking out Cartel leaders does not reduce the flow of drugs.
- notyourday 5y ago
  Baby hackers that want go working for NSO want to have a high life. Modern high life requires modern communications devices. Blocking them from modern life (for example, vaccine passports done via iPhone and Android) will quickly lower the ranks. Blocking Israeli government officials from Google and Apple will immediately solve NSO is an Israeli company that is cozy with the government and gets government protection problem. None of the NSO group's clients would want to pay for it via suitcases of cash. And in either event paying with suitcases of cash creates problems in the modern world for those that receive the suitcases of cash.
  - qaq 5y ago
    there is a wide range of exploit brokers and a decent number of security researchers that choose $ over morality as long as there is demand there will be supply.
    - notyourday 5y ago
      Don't let perfect to be the enemy of good. New broker pops up? Apply the same methodology. Apple is a trillion dollar company. Broker is a ant. Squash it.

danicgross 5y ago

Would turning off iMessage protect from this? Or would the iPhone still process the GIF through SMS somehow...?

aacook 5y ago
Great question. Every cell carrier processes images before delivering to the recipient. Like, if you send 3 or more photos almost every cell carrier will downsize the images. While this isn't an extensive test, I just tried renaming a PDF to a GIF and it failed to send on Google Voice and T-Mobile.
onedognight 5y ago
You can disable MMS in Settings -> Messages -> MMS Messaging.

iJohnDoe 5y ago

Kind of interesting Apple reacted as quickly as they did. It usually takes a lot of effort to get Apple to acknowledge anything. Or maybe because they didn’t request a bug bounty?

deleted 5y ago
[deleted]
syntheticcorp 5y ago
It’s because it is being exploited in the wild. Those bugs tend to get patched fast.
- badkitty99 5y ago
  And their angle on this “not being a big deal” is that it’s only used on high profile targets, so they need to keep that front up to maintain their busy bottom line
zaptrem 5y ago
Apple always responds quickly to large security issues?
gitanovic 5y ago
Because you can jailbreak the phone with the vulnerability. And they don't want that :)

TaylorAlexander 5y ago

It just makes me so uncomfortable that these things keep happening. We always find out about these things eventually but what percentage of the time are our devices vulnerable? Isn’t it close to 100% of the time that our desktops and mobile devices have significant security vulnerabilities?

r00fus 5y ago
Invulnerability for your devices is a chimera. You can only do what's possible in your capacity to secure yourself. I am at peace with the fact that I'm doing the best I can and keeping those I love protected.
- buddylw 5y ago
  Security has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.
  - heavyset_go 5y ago
    > I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. I don't. Look at how much companies like Apple pay out for responsible disclosure if they pay out at all, and then compare it to what exploits go for on the grey/black market. Typically the buyers have deep pockets and burning millions of dollars wouldn't make them blink.
    - dkokelley 5y ago
      Why does it matter if it’s the “good guys” or “bad guys” paying? If a vulnerability only cost ~$100 then a malicious person could compromise an ex lover’s phone, for example. The fact that they are expensive means that their use is limited to targeted, strategic attacks. You don’t have to agree that those attacks are good, but surely pricing the average person out of 0-days is better than the alternative.

RattleyCooper 5y ago

If I knew anybody at NSO Group I'd start messaging them unsolicited PDFs and shit :P

SheinhardtWigCo 5y ago

Their high-confidence attribution to NSO Group is described as being based on two factors: 1. Incomplete deletion of evidence from a SQLite database, in the exact same manner observed in a previous Pegasus sample; 2. The presence of a new process with the same name as a process observed in a previous Pegasus sample. But isn't it likely that someone with the skills needed to discover and weaponize a chain of 0-day exploits, is incentivized and able to detect these quirks in Pegasus samples and imitate them, with the goal of misattribution? Of course, there may be more factors involved in the attribution that aren't being shared publicly.

Leparamour 5y ago
Since when do we assume misattribution in fingerprinting APTs? Crowdstrike will find out it's clearly Russia behind this and Mandiant will blame China.
- schleck8 5y ago
  It usually is the US, China or Russia though; the three have a large number of experts for this. And unless you find an error in the attribution processes, they are most of the time backed up by data that appears plausible, like a server or code fragment
  - Leparamour 5y ago
    >It usually is the US, China or Russia though Interesting that you're leaving out Israel from your listing while the very subject of this article is Israeli offensive cyberwar and espionage capabilities and a profound lack of ethics. What I was trying to convey originally is that attribution is politically expedient. If you want to saber-rattle towards China you task Mandiant to find proof of Chinese hacking, if you want to blame Russia Crowdstrike gets the job. It's like employing McKinsey consulting to give a veneer of credibility to a predetermined outcome.
deleted 5y ago
[deleted]
5y ago

phendrenad2 5y ago

Ah nice, just parse incoming gifs in your iMessage with the same function that also parses PSDs. What could possibly go wrong? Gotta be DRY, my dude!

United857 5y ago

I miss the days when iOS exploits were merely used for jailbreaks and allowing alternative app stores, instead of being weaponized/monetized as they are now.

2rsf 5y ago
Were they? maybe we simply haven't heard about those

Ms-J 5y ago

It is increasingly bizarre in my opinion how this company (and others like Toka) can run active terrorist operations, that if anyone else smaller was doing some of the same hacks they would be in prison for a very long time. People have lost their lives due to these pariahs! Israel already has a massive PR issue with other countries, it would do them well to reign in these offensive front arms of their government/'companies.' Citizen Labs is really a great thing for civilization. There are not enough altruistic organizations.

hulitu 5y ago
This is the world we're living in: kill a man, you're a murdered, kill 100 you're a hero.
stirlo 5y ago
> Israel already has a massive PR issue with other countries, But for these middle eastern countries Israel selling them exploits which allow them to spy on dissidents may actually improve relations by helping out regimes which would otherwise be sworn enemies of theirs…
thinkharderdev 5y ago
Just finished reading https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760... which is a great book about the zero-day market and how it evolved over the years. The basic issue is that every nation is actively buying and using zero-days and doesn't want to stop. And companies like NSO aren't really (so they say at least) hacking anybody. They just develop and license hacking tools to governments to use for "lawful" law enforcement purposes. So nobody wants to ban the zero-day market because every country is a huge buyer of zero-days themselves and it is hard to ban selling zero-days to sovereign governments who are using them in accordance with their own laws (even if the regimes in question are terrible and using them to violate their citizens basic human rights). After all, it would be a bit awkward for the US to demand that the NSO Group stop selling it's hacking tools to Saudi Arabia while we have a multi-billion dollar defense industry selling the Saudis all sorts of advanced weaponry.
azernik 5y ago

m3kw9 5y ago

Now that this is out, it won’t be just NSO using it. Get it patch now.

jasonhansel 5y ago

Why is it that iOS's PDF implementation has been the source of so many different exploits? This seems to be a pattern.

madeofpalk 5y ago
PDFs are hard and complicated?
tediousdemise 5y ago
It's not just iOS. PDFs have always been an insecure attack vector.
mr_toad 5y ago
Adobe Reader/Acrobat used to be go-to surface for exploits back in the day. It’s a huge specification.
thinkharderdev 5y ago
PDF is basically a programming language, so instead of sending image data you send a program which is interpreted by the PDF reader to render an image on the client. That makes it really hard to secure completely.

bluefox 5y ago

The simple solution for those who are concerned about this is to use a dumbphone. It's simple, easily hackable, and most importantly does not promote a false sense of security.

tediousdemise 5y ago

My fiancée already received a large group iMessage that had 40+ unknown numbers on it that all shared the same area code and first 3 digits of the phone number. The contents of the message was unintelligible (random words).

saagarjha 5y ago
Probably spam?
- tediousdemise 5y ago
  Let's hope... we updated her phone. I'm wondering if a factory reset would be sufficient to blow away any malware.
  - fhrhdhd 5y ago
    Was anyone wearing a black hoodie?
  - Hackbraten 5y ago
    Regular reboots and applying updates already go a long way. Factory reset can also help get rid of persistent malware. But if she’s being targeted, you’re out of luck. No matter what she does, there’s always one more 0day that can be used in a watering-hole attack.

jonplackett 5y ago

Can someone explain like I'm 5 why it's so hard to prevent this? I mean with a messenger app, you know you're getting some payload of data from a specific place, that goes through your own server, and is only ever going to be text or picture or video. Why can't that be sufficiently sanitised en route and as it arrives to not have this kind of thing happen all the time?

SilverRed 5y ago
Because the OS is too complicated, imessage is a legacy app which is deeply embeded in the OS. And often the exploits are in things like the notifications but imessage is the easiest way to deliver the data to any ios user. And people will flame me for this, but part of it is because the language iOS is written in allows these exploits to slip in easily and all over the place and the difficulty of stopping it is too great. There is a good reason Google has started migrating core components of Android to Rust and that the Google security team is pushing the effort for rust in Linux. The surface area for bugs becomes so much smaller when you can have a compiler eliminate whole classes of bugs.
- 2rsf 5y ago
  The language might help the developers mitigate some issues but it is definitely not a solution the bad legacy code, mediocre development and test processes etc.
  - seanieb 5y ago
    In theory… Can you name a popular large project or product where memory safety issues have been overcome this way?
    - 2rsf 5y ago
      TBH you need to combine both, NASA uses safer languages and strict processes for example. Simply moving to another language might mitigate some possible issues but will definitely won't solve everything

lgats 5y ago

cve withdrawn? https://cve.report/CVE-2021-30860 https://cve.report/CVE-2021-30860

i_r7al 5y ago
Anyone has context of why it was withdrawn?
- modshatereality 5y ago
  It's a feature, not a bug.

baybal2 5y ago

Why does iMessage automatically open every picture?

coolspot 5y ago
Message notification has little tiny preview of the image attached.
- baybal2 5y ago
  Then... the question is now why do they show a preview if the user can click the message himself?

stefan_ 5y ago

The easiest way for Apple to find Zero-Day exploits is presumably just to register an iPhone to some Saudi activist and regularly take memory dumps.

deleted 5y ago
[deleted]
9935c101ab17a66 5y ago
Morbid, but hilarious. Well done.
deleted 5y ago
[deleted]
fragmede 5y ago
That's actually where this particular knowledge came from. Citizen Lab dumped a Saudi activist's phone and told Apple what they found.
avnigo 5y ago
You joke, but maybe one way to fight this proactively is with fake activist honeypots. Apple, a company with the size and budget of a nation state could certainly pull off such an operation for the security of the devices they sell, but obviously, and maybe unfortunately, this would never happen.

coliveira 5y ago

I believe it is completely wrong to believe that software can be made secure. It is inherently unsafe, by nature. I believe every internet facing computer should be partitioned in two virtual machines, one that connects to the outside world, and another that contains user data. Processes in the user data partition shouldn't be allowed to connect to the internet. The result of current design is that I have practically lost the right to write and use potentially unsafe software, even if I wrote it - something I may want to do for performance or practical reasons.

zaptrem 5y ago
People need that user data to interact with the internet and inevitably code from the internet will be introduced to the “safe” VM.

throwawaydddsss 5y ago

i got a few of the pegasus texts from the sketchy gmail addresses, one was from way before the public even knew about it i'm a scrub at a random software company, i'm not a criminal by any means, maybe a bit paranoid (barely any online presence) anyone have a similar experience? or any advice or explanation as to why i'm so interesting?

tsjq 5y ago
you have a similar number or username as their highvalue target ?

sharmin123 5y ago

Things To Consider Before Hiring A Professional Hacker: https://www.hackerslist.co/things-to-consider-before-hiring-a-professional-hacker/ https://www.hackerslist.co/things-to-consider-before-hiring-...

Apofis 5y ago

When are we going to start building software differently so that exploits start going away?

NoPicklez 5y ago
Great question and how do you propose they do that?
- deleted 5y ago
  [deleted]

tsjq 5y ago

why hasn't Apple fixed this? why doesn't apple sue such groups for violation of some EULA stuff ? why isn't Apple improving their security testing ? is Apple tacitly complicit with these ?

hulitu 5y ago
Testing is hard. You need someone to understand the system. The problem with SW testing is that is mainly used to verify requirements, not to find defects. Also layers over layers of libraries does not help either (look how cool i am: instead of using libjpeg, libxpm and libpng i use imlib which links to those and introduces also its own bugs).

Certified_moose 5y ago

I have always wondered. Let's say my iPhone is infected with this malware, and I update to the latest IOS. Will my iPhone be back to normal?

5etho 5y ago

finally, there will go down 'apple privacy myth'

julietdg 5y ago

In my Privacy settings on iOS, in Data/Analytics where the logs are- iPhone has had a Pegasus framework listed since my iOS 5s.

saagarjha 5y ago
Pegasus is the codename for picture-in-picture (and also the Swift Playgrounds editor that now powers Xcode).

DangerousPie 5y ago

Anybody know why there was such a delay here? > In March 2021, we examined the phone of a Saudi activist who has chosen to remain anonymous, and determined that they had been hacked with NSO Group’s Pegasus spyware. During the course of the analysis we obtained an iTunes backup of the device. ... > Citizen Lab forwarded the artifacts to Apple on Tuesday, September 7. On Monday, September 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS.

TonyTrapp 5y ago
This has been asked and discussed in this thread already: https://news.ycombinator.com/item?id=28516795 https://news.ycombinator.com/item?id=28516795 In short: Just because they got access to the phone in March doesn't mean that they were already aware of the zero-day exploit back then. Finding this kind of stuff takes a while.
- willis936 5y ago
  We (the public) have known about FORCEDENTRY for 6 months. That time was spent analyzing and understanding the exploit. It does seem like a long time for such a public zero-click affecting 100s of millions of users.

est 5y ago

PSD should have the same fate as SWF. Maybe we will witness pdf exploits every month from iDevices in someday.

pat-jay 5y ago

Wow great work, thanks Citizen Lab! Everyone, please donate - we need this!

baobabKoodaa 5y ago

> Despite the [gif] extension, the file was actually a 748-byte Adobe PSD file. I wish programmers would stop "helpfully parsing" files which are named with an "incorrect" extension. If a random unknown person sends me a file with .gif extension that is actually a PSD file, I most definitely do not want my machine parsing whatever that thing is.

willis936 5y ago
Discourse avatars point to a page with a .png extension regardless of what the actual file is (jpg, gif, or svg). Parsing file headers should not be a dangerous operation and in my opinion is the right thing to do.

verytrivial 5y ago

Image and video decoders seem like exactly the right target for formally verified (i.e. proven) implementations. There are just so many moving parts, and libraries get re-used in many projects, rarely forming the 'special sauce' in any given app. I have been keeping an eye on the work done by what is now called Project Everest[1] over the years in the communication and cryptographic space. Is there similar work in the image and video decode space? My seach fu is not yeilding anything beyond some hardware decoding proofs. [1] https://project-everest.github.io/ https://project-everest.github.io/