4 ms·

> Front Line Defenders investigated 75 iPhones and found that 6 devices were hacked with NSO Group's Pegasus spyware Hacked iPhones?! I bet they were side load

by bogwog 5y ago

> Front Line Defenders investigated 75 iPhones and found that 6 devices were hacked with NSO Group's Pegasus spyware Hacked iPhones?! I bet they were side loading apps! /s (relevant: https://techcrunch.com/2021/11/03/apple-craig-federighi-side-loading-apps-web-summit-keynote/ https://techcrunch.com/2021/11/03/apple-craig-federighi-side...)

zibzab 5y ago
I think "the fappening", xghost and NSO have already clearly demonstrated that mobile security is just PR.
- friehe 5y ago
  According to Wikipedia "the fappening" was a phishing attack. I don't think that is a mobile specific problem.
  - zibzab 5y ago
    That is not correct. It was actually a distributed campaign with multiple hackers with different methods but the main leaks were due to the following problems: 1. Bug in some Apple services allowed unlimited login attempts 2. Bug in Apple backup restoration function allowed bypassing multi-factor authentication (or was it confirmation email?) This is all from memory, I might be wrong about the details. Anyway, that Apple initially blamed this on weak passwords and now phisihing clearly demonstrates what kind of PR circus this field is. Just think about this: when Apple closed these holes (silently), attacks had been going on for 1-2 years. Towards the end there were fairly cheap and reliable hack-my-exs-iphone services on the darknet.
    - stef25 5y ago
      According to the link below it clearly was phishing https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak#Procurement_and_distribution https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak...
      - zibzab 5y ago
        From your own link: " ... such as phishing and brute-force attack guessing ..." Just take a moment to think about the brute force attack and whether that should have worked at this scale in the properly secure environment.
        mercutio2 5y ago
        They caught the people responsible, and convicted them, as the Wikipedia page describes in detail at the end. The actual perpetrators acknowledged they'd sent phishing emails to gain access. Whether or not there was brute force rate limiting available at the time (which seems unclear), that's not related to the specific events you brought up.
- thrashh 5y ago
  Security has always been like this. If you’ve ever tried to hop a fence or bypass a system, you know that it’s heavily stacked against the defense. Defense needs to patch every hole. Offense just needs to find one hole. That doesn’t mean that it isn’t worth trying to defend, it just means that you need to be realistic.
ccouzens 5y ago
I think they're all iPhones because they have a reliable way of detecting it on iPhones (perform a backup and look at the backup on a computer). But at one point side loading was how the Android version was installed https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html?m=1 https://android-developers.googleblog.com/2017/04/an-investi...
- smoldesu 5y ago
  Sounds like they bypassed the need for that altogether. While I get the whole 'sideloading is a security threat' arguement, it really doesn't hold up to scrutiny when you can send malware to any phone via invisible SMS parsing bugs. Apple might have a leg to stand on if their history of threat mitigation wasn't so rocky[0] in the first place. The simple fact of the matter is that they're fighting an infinite war of attrition that's not in their favor. State actors and even private interests are now overwhelmingly capable of buying and implementing zero-day exploits, so a more logical security effort would aim to strengthen the kernel and, you know, actually mitigate these threats. Enforcing type-safety and memory safety at a lower level would be a good start, but Apple knows that isn't very marketable (and they have enough zombie XNU code in MacOS and iOS to constitute an new operating system altogether). By this point, most people call me a security nihilist, paranoid schizophrenic, or an architecture astronaut. Maybe so, but modern threat models are built around pragmatism, not idealism. Apple can wave as many flags as they want, but seldom does that actually effect the overall security of iPhones. NSO will just reach into their catalog of stockpiled vulnerabilities and spin up a new build overnight. If Apple doesn't recognize this before it's too late, I reckon their OSes will become the modern Windows: confusing abstractions of well-understood concepts, with a dead-set focus on how the user perceives the OS, not how it actually functions. [0] https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/ https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-n...
deleted 5y ago
[deleted]

by bogwog 5y ago

zibzab 5y ago

I think "the fappening", xghost and NSO have already clearly demonstrated that mobile security is just PR.

friehe 5y ago
According to Wikipedia "the fappening" was a phishing attack. I don't think that is a mobile specific problem.
- zibzab 5y ago
  That is not correct. It was actually a distributed campaign with multiple hackers with different methods but the main leaks were due to the following problems: 1. Bug in some Apple services allowed unlimited login attempts 2. Bug in Apple backup restoration function allowed bypassing multi-factor authentication (or was it confirmation email?) This is all from memory, I might be wrong about the details. Anyway, that Apple initially blamed this on weak passwords and now phisihing clearly demonstrates what kind of PR circus this field is. Just think about this: when Apple closed these holes (silently), attacks had been going on for 1-2 years. Towards the end there were fairly cheap and reliable hack-my-exs-iphone services on the darknet.
  - stef25 5y ago
    According to the link below it clearly was phishing https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak#Procurement_and_distribution https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak...
    - zibzab 5y ago
      From your own link: " ... such as phishing and brute-force attack guessing ..." Just take a moment to think about the brute force attack and whether that should have worked at this scale in the properly secure environment.
      - mercutio2 5y ago
        They caught the people responsible, and convicted them, as the Wikipedia page describes in detail at the end. The actual perpetrators acknowledged they'd sent phishing emails to gain access. Whether or not there was brute force rate limiting available at the time (which seems unclear), that's not related to the specific events you brought up.
thrashh 5y ago
Security has always been like this. If you’ve ever tried to hop a fence or bypass a system, you know that it’s heavily stacked against the defense. Defense needs to patch every hole. Offense just needs to find one hole. That doesn’t mean that it isn’t worth trying to defend, it just means that you need to be realistic.

ccouzens 5y ago

I think they're all iPhones because they have a reliable way of detecting it on iPhones (perform a backup and look at the backup on a computer). But at one point side loading was how the Android version was installed https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html?m=1 https://android-developers.googleblog.com/2017/04/an-investi...

smoldesu 5y ago
Sounds like they bypassed the need for that altogether. While I get the whole 'sideloading is a security threat' arguement, it really doesn't hold up to scrutiny when you can send malware to any phone via invisible SMS parsing bugs. Apple might have a leg to stand on if their history of threat mitigation wasn't so rocky[0] in the first place. The simple fact of the matter is that they're fighting an infinite war of attrition that's not in their favor. State actors and even private interests are now overwhelmingly capable of buying and implementing zero-day exploits, so a more logical security effort would aim to strengthen the kernel and, you know, actually mitigate these threats. Enforcing type-safety and memory safety at a lower level would be a good start, but Apple knows that isn't very marketable (and they have enough zombie XNU code in MacOS and iOS to constitute an new operating system altogether). By this point, most people call me a security nihilist, paranoid schizophrenic, or an architecture astronaut. Maybe so, but modern threat models are built around pragmatism, not idealism. Apple can wave as many flags as they want, but seldom does that actually effect the overall security of iPhones. NSO will just reach into their catalog of stockpiled vulnerabilities and spin up a new build overnight. If Apple doesn't recognize this before it's too late, I reckon their OSes will become the modern Windows: confusing abstractions of well-understood concepts, with a dead-set focus on how the user perceives the OS, not how it actually functions. [0] https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/ https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-n...

deleted 5y ago

[deleted]