22 ms·

I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Or are they incredibly lucky? Both? I’d

I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Or are they incredibly lucky? Both? I’d love to know what a normal day at work is like for their engineers. Clock in, sit down at a…crazy expensive hardware and software testing station? Crack open a brand new iPhone and start probing away while referencing internet sourced chip documentation and software manuals? What does it even look like?

chelmzy 5y ago
They may have purchased it from an exploit broker.
- badRNG 5y ago
  Zerodium will pay up to $2,500,000 for no-click iPhone/Android exploits [1]. I'm sure they'd only pay that much if they were highly confident they have clients who'd pay enough to make the risk and investment worth it. [1] https://zerodium.com/program.html https://zerodium.com/program.html
- jbay808 5y ago
  Someone still had to discover it though!
deleted 5y ago
[deleted]
dogma1138 5y ago
They recruit people who were trained to find exploits, it’s less about having the best programmers and more about having people with a specific set of learned skills and dedicating them to this task. I would be surprised if their core iOS research team is much more than 10 or so people at any given time. They also probably use brokers and buy at least some of the exploits they use from freelancers if they offer ~7 figures for a zero click exploit a lot of freelancers will be working on this too. It’s just like any bug bounty program, internally you run a small and dedicated team and externally you pay enough to entice freelancers to spend their free time on your systems to scale it further.
belter 5y ago
The NSO group are ex-Mossad who decided working for the government does not pay as well as making money out of exploits, probably obtained at the highest levels of top secret work. So far, they have been tolerated by the Israeli government as they all went to the same schools, all did the armed forces service together, and all know each other. This allowed them to get a free pass so far. Privately, many of their ex-colleagues, are very critical of their lack of ethics. All this will change, the day some of the NSO exploits will be used against Israel, the same way some of the NSA leaked tools are now used in the wild.
- badRNG 5y ago
  > All this will change, the day some of the NSO exploits will be used against Israel, the same way some of the NSA leaked tools are now used in the wild. Has the leak of NSA tools changed anything?
  - JumpCrisscross 5y ago
    > Has the leak of NSA tools changed anything? Yes. The bipartisan USA Freedom Act limited several aspects of the NSA's dragnet [1]. Amendments weakening the bill were defeated [2]. Less materially, a documentation requirement for § 702 searches of U.S. persons was added in 2018 [3]. [1] https://www.eff.org/deeplinks/2014/11/usa-freedom-act-week-whats-come-and-what-you-need-know https://www.eff.org/deeplinks/2014/11/usa-freedom-act-week-w... [2] https://www.eff.org/deeplinks/2015/05/usa-freedom-act-passes-what-we-celebrate-what-we-mourn-and-where-we-go-here https://www.eff.org/deeplinks/2015/05/usa-freedom-act-passes... [3] https://www.lawfareblog.com/summary-fisa-amendments-reauthorization-act-2017 https://www.lawfareblog.com/summary-fisa-amendments-reauthor...
    - Amezarak 5y ago
      I’m skeptical the NSA doesn’t just ignore or creatively interpret laws it doesn’t like, given their past history and the consequences for their misbehavior. I mean when the CIA got busted not only spying on Congress a few years ago, but also lying about spying on Congress, they were told “don’t do that again please.”
Thaxll 5y ago
It takes IDA Pro, some low level asm/C++/Python programming skills and a lot of hours. Reverse engineering is not that complicated, however getting some results is difficult and time consuming. In that example it's basically looking at how some libraries are parsing input, that's it. Since everything in those phones are C/C++ nothing is "safe". It's the same skills you need to crack games, cheat in online games etc ...
- kaladin-jasnah 5y ago
  It would be quite difficult if you can't get access to the binaries that you have to put into IDA (or, well, Ghidra, for that matter, but IDA Pro is probably better).
  - saagarjha 5y ago
    The binaries are available in OS restore images that Apple makes publicly available.
helge9210 5y ago
These are ex-military engineers (security researchers). Selection starts from age of 4. By the time they receive special training in technological units of the army they basically have a CS degree (at age of 19-20). > What does it even look like? Boring. Usually a group of introverted young kids that look at their own shoes while talking to you, led by an extroverted young kid, that looks at your shoes while talking to you.
- java-man 5y ago
  You just leaked that the extrovert is a Finn! (the original joke is about a Finnish extrovert).
- yonatank 5y ago
  As someone who has some familiarity with the people and processes, this response seems extremely off to me. > Selection starts from age of 4 Care to share your sources for that? As far as I know most are self taught and get some further training in military. > Boring. It might be boring to some and might be extremely interesting for others. People who like solving puzzles and facing hard challenges usually like it. Of course, if your passion is building you wouldn't like it as you don't "build" something new. > Usually a group of introverted young kids that look at their own shoes while talking to you, led by an extroverted young kid, that looks at your shoes while talking to you. Have you met these people at all? Because it definitely sounds like you haven't and you just describe the typecast some movie would use.
  - helge9210 5y ago
    > Care to share your sources for that? I'm Israeli. My children were attending/graduated/served kindergarten/school/army in Israel and I saw selection process as a parent. My wife was a school teacher in Israel. She described to me some of the evaluation metrics she was supposed to submit every half a year over each and every pupil she had. > Have you met these people at all? I cannot confirm nor deny I met these people.
    - ChrisKnott 5y ago
sophacles 5y ago
There's an entire "gray market" of exploit brokers. NSO group is one of the many players. There's a good chance this is an off-the-shelf exploit. The podcast Darknet Diaries had an episode about the topic recently: https://darknetdiaries.com/episode/98/ https://darknetdiaries.com/episode/98/ (that episode is tied to this book: https://www.amazon.com/gp/product/1635576059/ https://www.amazon.com/gp/product/1635576059/ about the topic) Also, I like that podcast in general - highly recommend it if you're into infosec stuff!
- myself248 5y ago
  That goes very well with this prior episode as background info: https://darknetdiaries.com/episode/28/ https://darknetdiaries.com/episode/28/
- ThisIsTheWay 5y ago
  Episode 100 is specifically about NSO and dives deeper into Pegasus. Highly recommended listening after episodes 98 and 99. https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
  - trollied 5y ago
    Saw the thread title & clicked through to post exactly the same :) It's a great set of episodes. This is without a doubt my favourite podcast. 2nd favourite being Knowledge Fight, which debunks Alex Jones and the nonsense that he spews on a daily basis.
- thinkharderdev 5y ago
  Just read that book after listening to the DND episode with the author and it is really great.
tester756 5y ago
Here's ranking of top people for this kind of job https://ctftime.org/ https://ctftime.org/ Members of those teams are often Security Engineers at e.g Google, Banks, computer emergency response team (CERT) and so on.
- schleck8 5y ago
  They are not as secretive as I expected, even running a twitter account. Kind of uncanny >We have two Canadians, two Estonians, an Israeli and a Korean
  - saagarjha 5y ago
    These are security teams doing capture-the-flag competitions, you can literally walk up to them at in-person events and say hi if you'd like. There's nothing illegal going on here.
tomc1985 5y ago
I think it's more that the possibility space for exploits is so large that a dedicated force of highly creative reverse-engineers is all you need to dig them up. From what I've heard it can be almost trivial to find them if you know what to look for. But it seems that very few people know exactly where to look, and fewer still understand how to interpret the results.
SavantIdiot 5y ago
A lot of times it is just poring over code looking for bugs that have already been found in other locations in the code. For example. this is a use after free bug. You can statically analyze disassembled code to find places where this might be happenning, and then figure out how to exploit that instance of the bug.
rodgerd 5y ago
> Are the programmers at NSO group just the best in the world? Most people who are good at this are working for national security orgs, blue team in the private sector, or cash focused criminals. This is the relatively small group of people who are comfortable selling tools to help dictators hack journalists up with saws.
gerash 5y ago
If you have an organization that can legally hire people, pay them a stable salary and legally sell exploits to all sorts of people around the world you end up with NSO. NSA finds exploits for their own mission and Google Project Zero researches vulnerabilities to [per their claim] ensure internet stays a secure platform but neither of them sell exploits for profit like NSO. So, no, they're not the only "genius"es out there. They just are less ethical about it.
staticassertion 5y ago
Exploit development is a skill like any other. Instead of learning things like software design patterns, distributed systems, software reliability, etc you would have spent time learning about memory layouts, OS designs, mitigation techniques, decompilers, etc.
diskzero 5y ago
They probably hunt exploits like that, but what is quite likely is that they have access to stolen Apple source code and scour it for type overruns like the one in CoreGraphics that is the cause of this exploit. I would estimate that the majority of exploits are the result of source code theft, leaks of potential vulnerabilities from people who have access to the source code and social engineering. There isn't anything particularly special about a "Mossad" trained or "NSA" trained hacker. They are engineers like many of us and prefer the path of least resistance. Trying to brute force buffer overruns without having source code access is tedious. Why go to all the effort to black box exploits when you can take advantage of source code analysis. I mentioned in another post about why people would leak to the press, when you most likely will get caught and fired. Leakers of a different caliber will leak source code to governments and companies like NSO and have much less likelihood of being caught and much higher remuneration.
- saagarjha 5y ago
  > I would estimate that the majority of exploits are the result of source code theft, leaks of potential vulnerabilities from people who have access to the source code and social engineering. No. Some Apple source code has publicly leaked (iBoot) but stealing this kind of stuff is bound to leak. And reversing binaries for vulnerabilities is not that much harder.
- marcan_42 5y ago
  You estimate wrong. I've been in infosec for over a decade. We look at binaries. It's not that hard. In fact, it's often easier, since type conversion errors are often a lot more apparent in a disassembly, where you can see exactly what operations are being performed without having to know exactly what the language rules around signedness and integer promotion are, and without having to follow through complicated type hierarchies. Similarly, a good optimizer will strip away layers of software abstraction and make what's actually happening more evident. There is value in source audits, but you're wrong that exploits come out of stolen source. That's exceedingly rare, and usually quickly publicly leaked when it happens.
  - ShroudedNight 5y ago
russb 5y ago
Ian Beer with Google's Project Zero gives an amazing walk-through of what it took for him to build a similar exploit. https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c...
rasz 5y ago
https://www.youtube.com/watch?v=zyHI2Ht3OAI https://www.youtube.com/watch?v=zyHI2Ht3OAI Jiska usually finds couple remote exploits a year by just looking at new component/subsystem. Its all dumpster fire underneath :(
tveita 5y ago
Look at the exploits Google's Project Zero find for a less clandestine example. No doubt they employ clever people but you don't have to be superhuman to find vulnerabilities in code. Part of it is paying people to sit down and work on it fulltime. An interesting quote: https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c... "This has been the longest solo exploitation project I've ever worked on, taking around half a year. But it's important to emphasize up front that the teams and companies supplying the global trade in cyberweapons like this one aren't typically just individuals working alone. They're well-resourced and focused teams of collaborating experts, each with their own specialization. They aren't starting with absolutely no clue how bluetooth or wifi work. They also potentially have access to information and hardware I simply don't have, like development devices, special cables, leaked source code, symbols files and so on."
- ehsankia 5y ago
  Yep, Apple themselves will find exploits, white hat hackers will find exploits, Project Zero or Microsoft teams will find exploits, and so will NSO or other blackhats. It is a mix of luck, skill and putting in the time. NSO has successfully monetized their exploits, allowing them into then invest the money back into hiring more people, which increases the luck/time put into it.
baybal2 5y ago
> I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Not much different too how software exploitation was done in Win98-ME-xp era was done. A lot of vulnerabilities are very obvious from disassembly, and often can even be found with automated tools. Today, it's easy. Back in early 200x, everybody was not only hiding their sources well, but obfuscating binaries in every way possible. People just forgot the scale of binary only exploitation on its peak.
Ms-J 5y ago
It's not too esoteric, fortunately. The short explanation is they are a part of the Israeli gov, as with all tech companies in that territory, so that gives certain material advantages to their preferred companies, just like how USA does with offense contractors like Northrop. Basically, they are propped up by their gov, and that is the major problem.
viktorcode 5y ago
Most likely they buy exploits on the market, like basically everyone else. No reason to limit yourself only to the first party knowledge.
Puts 5y ago
I could really recommend you the book A Bug Hunter's Diary by Tobias Klein which is a practical walk-trough in finding these kinds of security bugs. https://nostarch.com/bughunter https://nostarch.com/bughunter
1vuio0pswjnm7 5y ago
"Are the programmers at NSO group just the best in the world?" The parent comment seems to imply that someone who can find programmer mistakes is a better programmer than one who actually writes software for the public. If thats true then wouldnt it be reasonable to prefer to use message software written by NSO instead of Apple. Why dont "security researchers" write the software we use instead of "software engineers".^1 Which group would be more likely to have "the best programmers in the world" who would be the least likely to make mistakes. Honest question. Im not trolling. I think about this question all the time. 1. Some of the programs I use and rely on everyday, even more than something like "iMessage", were written by people who claim to work in "security" or "research" (or even teaching math to university students) not "engineering". I have no complaints about these programs. Yet I have plenty of complaints about the software foisted upon us by Big Tech.
- mozey 5y ago
  "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it."
- soVeryTired 5y ago
  It’s just a matter of the two groups having different skills. One group writes for the general case while the other specialises in corner cases. The latter looks really impressive when it’s done well, but it’d be silly to expect someone with deep security knowledge to sit down and build a spreadsheet manager from scratch. The two skill sets are just different. There is no “best”.
- moritonal 5y ago
  Engineers need to write 1k lines of perfect code all the while being chased by their bosses to finish fast. Hacker's need to find just one mistake out of 1k lines of code.
- thinkharderdev 5y ago
  The hard part is not necessarily finding the programming mistake so much as figuring out a way to reliably exploit them. Back in the day before ASLR and other mitigations it was really straightforward, but modern OSs have much more sophisticated countermeasures to prevent buffer overflows and user-after free bugs to enable RCE.
kuroguro 5y ago
> I always wonder what it takes to find this kind of exploit. A lot of knowledge about the target system's internals (comes with experience) and probably a lot of investment in fuzzing infrastructure or A LOT of time reverse engineering and reviewing manually. Finding bugs in closed source software by hand is incredibly slow and painful.
deleted 5y ago
[deleted]
jcstauffer 5y ago
The few most recent episodes of the "Darknet Diaries" podcast, which are relevant, including interviews with CitizenLab, descriptions of how NSO works, Black Cube, and the market for buying exploits from Argentina. https://darknetdiaries.com/ https://darknetdiaries.com/
joedoejr 5y ago
Come on, since jailbreak discovered (checkm8 as king of it) you can run pretty much anything just on iphone itself including automated tests, fuzzing, debug and crash dump analyses. Break is always easier than build. iMessage plagued with such bugs since 2010, the question is how it is not yet rebuild up to decent quality. Retarded security measures like blastdor or aslr is irrelevant as these mostly a security theatre that just require extra step to avoid.

chelmzy 5y ago

They may have purchased it from an exploit broker.

badRNG 5y ago
Zerodium will pay up to $2,500,000 for no-click iPhone/Android exploits [1]. I'm sure they'd only pay that much if they were highly confident they have clients who'd pay enough to make the risk and investment worth it. [1] https://zerodium.com/program.html https://zerodium.com/program.html
jbay808 5y ago
Someone still had to discover it though!

deleted 5y ago

[deleted]

dogma1138 5y ago

They recruit people who were trained to find exploits, it’s less about having the best programmers and more about having people with a specific set of learned skills and dedicating them to this task. I would be surprised if their core iOS research team is much more than 10 or so people at any given time. They also probably use brokers and buy at least some of the exploits they use from freelancers if they offer ~7 figures for a zero click exploit a lot of freelancers will be working on this too. It’s just like any bug bounty program, internally you run a small and dedicated team and externally you pay enough to entice freelancers to spend their free time on your systems to scale it further.

belter 5y ago

The NSO group are ex-Mossad who decided working for the government does not pay as well as making money out of exploits, probably obtained at the highest levels of top secret work. So far, they have been tolerated by the Israeli government as they all went to the same schools, all did the armed forces service together, and all know each other. This allowed them to get a free pass so far. Privately, many of their ex-colleagues, are very critical of their lack of ethics. All this will change, the day some of the NSO exploits will be used against Israel, the same way some of the NSA leaked tools are now used in the wild.

badRNG 5y ago
> All this will change, the day some of the NSO exploits will be used against Israel, the same way some of the NSA leaked tools are now used in the wild. Has the leak of NSA tools changed anything?
- JumpCrisscross 5y ago
  > Has the leak of NSA tools changed anything? Yes. The bipartisan USA Freedom Act limited several aspects of the NSA's dragnet [1]. Amendments weakening the bill were defeated [2]. Less materially, a documentation requirement for § 702 searches of U.S. persons was added in 2018 [3]. [1] https://www.eff.org/deeplinks/2014/11/usa-freedom-act-week-whats-come-and-what-you-need-know https://www.eff.org/deeplinks/2014/11/usa-freedom-act-week-w... [2] https://www.eff.org/deeplinks/2015/05/usa-freedom-act-passes-what-we-celebrate-what-we-mourn-and-where-we-go-here https://www.eff.org/deeplinks/2015/05/usa-freedom-act-passes... [3] https://www.lawfareblog.com/summary-fisa-amendments-reauthorization-act-2017 https://www.lawfareblog.com/summary-fisa-amendments-reauthor...
  - Amezarak 5y ago
    I’m skeptical the NSA doesn’t just ignore or creatively interpret laws it doesn’t like, given their past history and the consequences for their misbehavior. I mean when the CIA got busted not only spying on Congress a few years ago, but also lying about spying on Congress, they were told “don’t do that again please.”

Thaxll 5y ago

It takes IDA Pro, some low level asm/C++/Python programming skills and a lot of hours. Reverse engineering is not that complicated, however getting some results is difficult and time consuming. In that example it's basically looking at how some libraries are parsing input, that's it. Since everything in those phones are C/C++ nothing is "safe". It's the same skills you need to crack games, cheat in online games etc ...

kaladin-jasnah 5y ago
It would be quite difficult if you can't get access to the binaries that you have to put into IDA (or, well, Ghidra, for that matter, but IDA Pro is probably better).
- saagarjha 5y ago
  The binaries are available in OS restore images that Apple makes publicly available.

helge9210 5y ago

These are ex-military engineers (security researchers). Selection starts from age of 4. By the time they receive special training in technological units of the army they basically have a CS degree (at age of 19-20). > What does it even look like? Boring. Usually a group of introverted young kids that look at their own shoes while talking to you, led by an extroverted young kid, that looks at your shoes while talking to you.

java-man 5y ago
You just leaked that the extrovert is a Finn! (the original joke is about a Finnish extrovert).
yonatank 5y ago
As someone who has some familiarity with the people and processes, this response seems extremely off to me. > Selection starts from age of 4 Care to share your sources for that? As far as I know most are self taught and get some further training in military. > Boring. It might be boring to some and might be extremely interesting for others. People who like solving puzzles and facing hard challenges usually like it. Of course, if your passion is building you wouldn't like it as you don't "build" something new. > Usually a group of introverted young kids that look at their own shoes while talking to you, led by an extroverted young kid, that looks at your shoes while talking to you. Have you met these people at all? Because it definitely sounds like you haven't and you just describe the typecast some movie would use.
- helge9210 5y ago
  > Care to share your sources for that? I'm Israeli. My children were attending/graduated/served kindergarten/school/army in Israel and I saw selection process as a parent. My wife was a school teacher in Israel. She described to me some of the evaluation metrics she was supposed to submit every half a year over each and every pupil she had. > Have you met these people at all? I cannot confirm nor deny I met these people.
  - ChrisKnott 5y ago

sophacles 5y ago

There's an entire "gray market" of exploit brokers. NSO group is one of the many players. There's a good chance this is an off-the-shelf exploit. The podcast Darknet Diaries had an episode about the topic recently: https://darknetdiaries.com/episode/98/ https://darknetdiaries.com/episode/98/ (that episode is tied to this book: https://www.amazon.com/gp/product/1635576059/ https://www.amazon.com/gp/product/1635576059/ about the topic) Also, I like that podcast in general - highly recommend it if you're into infosec stuff!

myself248 5y ago
That goes very well with this prior episode as background info: https://darknetdiaries.com/episode/28/ https://darknetdiaries.com/episode/28/
ThisIsTheWay 5y ago
Episode 100 is specifically about NSO and dives deeper into Pegasus. Highly recommended listening after episodes 98 and 99. https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- trollied 5y ago
  Saw the thread title & clicked through to post exactly the same :) It's a great set of episodes. This is without a doubt my favourite podcast. 2nd favourite being Knowledge Fight, which debunks Alex Jones and the nonsense that he spews on a daily basis.
thinkharderdev 5y ago
Just read that book after listening to the DND episode with the author and it is really great.

tester756 5y ago

Here's ranking of top people for this kind of job https://ctftime.org/ https://ctftime.org/ Members of those teams are often Security Engineers at e.g Google, Banks, computer emergency response team (CERT) and so on.

schleck8 5y ago
They are not as secretive as I expected, even running a twitter account. Kind of uncanny >We have two Canadians, two Estonians, an Israeli and a Korean
- saagarjha 5y ago
  These are security teams doing capture-the-flag competitions, you can literally walk up to them at in-person events and say hi if you'd like. There's nothing illegal going on here.

tomc1985 5y ago

I think it's more that the possibility space for exploits is so large that a dedicated force of highly creative reverse-engineers is all you need to dig them up. From what I've heard it can be almost trivial to find them if you know what to look for. But it seems that very few people know exactly where to look, and fewer still understand how to interpret the results.

SavantIdiot 5y ago

A lot of times it is just poring over code looking for bugs that have already been found in other locations in the code. For example. this is a use after free bug. You can statically analyze disassembled code to find places where this might be happenning, and then figure out how to exploit that instance of the bug.

rodgerd 5y ago

> Are the programmers at NSO group just the best in the world? Most people who are good at this are working for national security orgs, blue team in the private sector, or cash focused criminals. This is the relatively small group of people who are comfortable selling tools to help dictators hack journalists up with saws.

gerash 5y ago

If you have an organization that can legally hire people, pay them a stable salary and legally sell exploits to all sorts of people around the world you end up with NSO. NSA finds exploits for their own mission and Google Project Zero researches vulnerabilities to [per their claim] ensure internet stays a secure platform but neither of them sell exploits for profit like NSO. So, no, they're not the only "genius"es out there. They just are less ethical about it.

staticassertion 5y ago

Exploit development is a skill like any other. Instead of learning things like software design patterns, distributed systems, software reliability, etc you would have spent time learning about memory layouts, OS designs, mitigation techniques, decompilers, etc.

diskzero 5y ago

They probably hunt exploits like that, but what is quite likely is that they have access to stolen Apple source code and scour it for type overruns like the one in CoreGraphics that is the cause of this exploit. I would estimate that the majority of exploits are the result of source code theft, leaks of potential vulnerabilities from people who have access to the source code and social engineering. There isn't anything particularly special about a "Mossad" trained or "NSA" trained hacker. They are engineers like many of us and prefer the path of least resistance. Trying to brute force buffer overruns without having source code access is tedious. Why go to all the effort to black box exploits when you can take advantage of source code analysis. I mentioned in another post about why people would leak to the press, when you most likely will get caught and fired. Leakers of a different caliber will leak source code to governments and companies like NSO and have much less likelihood of being caught and much higher remuneration.

saagarjha 5y ago
> I would estimate that the majority of exploits are the result of source code theft, leaks of potential vulnerabilities from people who have access to the source code and social engineering. No. Some Apple source code has publicly leaked (iBoot) but stealing this kind of stuff is bound to leak. And reversing binaries for vulnerabilities is not that much harder.
marcan_42 5y ago
You estimate wrong. I've been in infosec for over a decade. We look at binaries. It's not that hard. In fact, it's often easier, since type conversion errors are often a lot more apparent in a disassembly, where you can see exactly what operations are being performed without having to know exactly what the language rules around signedness and integer promotion are, and without having to follow through complicated type hierarchies. Similarly, a good optimizer will strip away layers of software abstraction and make what's actually happening more evident. There is value in source audits, but you're wrong that exploits come out of stolen source. That's exceedingly rare, and usually quickly publicly leaked when it happens.
- ShroudedNight 5y ago

russb 5y ago

Ian Beer with Google's Project Zero gives an amazing walk-through of what it took for him to build a similar exploit. https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c...

rasz 5y ago

https://www.youtube.com/watch?v=zyHI2Ht3OAI https://www.youtube.com/watch?v=zyHI2Ht3OAI Jiska usually finds couple remote exploits a year by just looking at new component/subsystem. Its all dumpster fire underneath :(

tveita 5y ago

Look at the exploits Google's Project Zero find for a less clandestine example. No doubt they employ clever people but you don't have to be superhuman to find vulnerabilities in code. Part of it is paying people to sit down and work on it fulltime. An interesting quote: https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c... "This has been the longest solo exploitation project I've ever worked on, taking around half a year. But it's important to emphasize up front that the teams and companies supplying the global trade in cyberweapons like this one aren't typically just individuals working alone. They're well-resourced and focused teams of collaborating experts, each with their own specialization. They aren't starting with absolutely no clue how bluetooth or wifi work. They also potentially have access to information and hardware I simply don't have, like development devices, special cables, leaked source code, symbols files and so on."

ehsankia 5y ago
Yep, Apple themselves will find exploits, white hat hackers will find exploits, Project Zero or Microsoft teams will find exploits, and so will NSO or other blackhats. It is a mix of luck, skill and putting in the time. NSO has successfully monetized their exploits, allowing them into then invest the money back into hiring more people, which increases the luck/time put into it.

baybal2 5y ago

> I always wonder what it takes to find this kind of exploit. Are the programmers at NSO group just the best in the world? Not much different too how software exploitation was done in Win98-ME-xp era was done. A lot of vulnerabilities are very obvious from disassembly, and often can even be found with automated tools. Today, it's easy. Back in early 200x, everybody was not only hiding their sources well, but obfuscating binaries in every way possible. People just forgot the scale of binary only exploitation on its peak.

Ms-J 5y ago

It's not too esoteric, fortunately. The short explanation is they are a part of the Israeli gov, as with all tech companies in that territory, so that gives certain material advantages to their preferred companies, just like how USA does with offense contractors like Northrop. Basically, they are propped up by their gov, and that is the major problem.

viktorcode 5y ago

Most likely they buy exploits on the market, like basically everyone else. No reason to limit yourself only to the first party knowledge.

Puts 5y ago

I could really recommend you the book A Bug Hunter's Diary by Tobias Klein which is a practical walk-trough in finding these kinds of security bugs. https://nostarch.com/bughunter https://nostarch.com/bughunter

1vuio0pswjnm7 5y ago

"Are the programmers at NSO group just the best in the world?" The parent comment seems to imply that someone who can find programmer mistakes is a better programmer than one who actually writes software for the public. If thats true then wouldnt it be reasonable to prefer to use message software written by NSO instead of Apple. Why dont "security researchers" write the software we use instead of "software engineers".^1 Which group would be more likely to have "the best programmers in the world" who would be the least likely to make mistakes. Honest question. Im not trolling. I think about this question all the time. 1. Some of the programs I use and rely on everyday, even more than something like "iMessage", were written by people who claim to work in "security" or "research" (or even teaching math to university students) not "engineering". I have no complaints about these programs. Yet I have plenty of complaints about the software foisted upon us by Big Tech.

mozey 5y ago
"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it."
soVeryTired 5y ago
It’s just a matter of the two groups having different skills. One group writes for the general case while the other specialises in corner cases. The latter looks really impressive when it’s done well, but it’d be silly to expect someone with deep security knowledge to sit down and build a spreadsheet manager from scratch. The two skill sets are just different. There is no “best”.
moritonal 5y ago
Engineers need to write 1k lines of perfect code all the while being chased by their bosses to finish fast. Hacker's need to find just one mistake out of 1k lines of code.
thinkharderdev 5y ago
The hard part is not necessarily finding the programming mistake so much as figuring out a way to reliably exploit them. Back in the day before ASLR and other mitigations it was really straightforward, but modern OSs have much more sophisticated countermeasures to prevent buffer overflows and user-after free bugs to enable RCE.

kuroguro 5y ago

> I always wonder what it takes to find this kind of exploit. A lot of knowledge about the target system's internals (comes with experience) and probably a lot of investment in fuzzing infrastructure or A LOT of time reverse engineering and reviewing manually. Finding bugs in closed source software by hand is incredibly slow and painful.

deleted 5y ago

[deleted]

jcstauffer 5y ago

The few most recent episodes of the "Darknet Diaries" podcast, which are relevant, including interviews with CitizenLab, descriptions of how NSO works, Black Cube, and the market for buying exploits from Argentina. https://darknetdiaries.com/ https://darknetdiaries.com/

joedoejr 5y ago

Come on, since jailbreak discovered (checkm8 as king of it) you can run pretty much anything just on iphone itself including automated tests, fuzzing, debug and crash dump analyses. Break is always easier than build. iMessage plagued with such bugs since 2010, the question is how it is not yet rebuild up to decent quality. Retarded security measures like blastdor or aslr is irrelevant as these mostly a security theatre that just require extra step to avoid.