26 ms·
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
- deleted 5y ago[deleted]
- saulrh 5y agoNow they just have to publish the VM so I can do next year's Advent of Code in it.
- olliej 5y agoOk, they apparently made a VM using just the JBIG2 logical operators, that’s both hilarious and amazing. Still hate NSO though.
- mmastrac 5y agoNot just a VM - effectively a computer. Holy crap that's amazing (ly evil).
- olliej 5y agoRight? I was using VM as a short hand - it is after all a virtual just more virtual than usual :)
- netizen-936824 5y agoI think VM is the correct term here. They are technically emulating hardware
- olliej 5y agoYeah, but I also understand that in general parlance VM means a higher level virtualization. Eventually though you get into one of those annoying simulation vs emulation style arguments so I’m happy to accept either definition of VM, just as long as both sides agree on what it is that they’re discussing :)
- jerf 5y agoIt's less virtual than usual; it has full access to and control over the embedding process. This is an RM, a Real Machine running in the original access space.
- est 5y agoNot just an effective computer, but a computer that scans iOS memory and RCE exactly as planned, without crashing or failing.
- usmannk 5y agoThis is mind boggling. NSO used a compression format's instructions to create logic gates and then from there "a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations", all within a single pass of decompression. Combine this with a buffer overflow and you've got your sploit.
- airstrike 5y agoThat reads like some handwavy explanation of a hack in a movie scene... "Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."
- athenot 5y agoThen you can "Enhance". https://www.youtube.com/watch?v=Vxq9yj2pVWk https://www.youtube.com/watch?v=Vxq9yj2pVWk Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.
- vmception 5y agoEnhancing works with trained AI these days Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure
- john37386 5y agoAm I reading this right? Google engineers are fixing apple software?
- olliej 5y agoYou aren’t reading it right :) Although there’s clearly bugs in the open source JBIG2 impl so someone probably made fixes there as well?
- SamuelAdams 5y agoProject Zero is a team of security analysts employed by Google tasked with finding zero-day vulnerabilities. https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 Don’t think of these folks as “google” employees. Think of them as “really good hackers with corporate sponsorship”. They look for flaws in everything - windows, apple, Linux, and google software. You should read some earlier blog posts, they’re really high quality.
- ushakov 5y agohow does Google benefit from this?
- RandallBrown 5y agoGoogle makes money when people use the Internet. By making it safer to use the Internet, more people will use it and Google will make more money.
- derwiki 5y agoWe’re talking about them right now
- ushakov 5y agothey’re still evil though?
- rwaksmunski 5y ago
- ivraatiems 5y agoIt's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.
- xxpor 5y agoKind of ironic to use P = NP as an example of something to work on considering the biggest implications of proving P = NP :)
- detritus 5y agoForgive my ignorance, but what would they be - the complete implosion of all forms of known security, or something else? This is a bit beyond my ken :)
- snarf21 5y agoAmong other things, mostly encryption. Most of our current methods depends on P != NP. So no need for 0 days if you can just read at encrypted data as if it wasn't.
- Dylan16807 5y ago> Most of our current methods depends on P != NP. Not really. They depend on guessing being slow. P, just P, can do slow. P can be bigger than the universe even with low values of n.
- kingaillas 5y agoWell for one, the safety of encryption rests on certain problems being intractable. (In a theoretical sense; there are always implementation bugs that destroy security). If P=NP, then those previously thought to be intractable problems, are actually tractable. And the foundation of a lot of security-related engineering collapses.
- EvanAnderson 5y agoI see "...a small computer architecture..." in the article and my instinct is to ask "Yeah-- but can it run DOOM?"
- coolspot 5y agoAnd since you already have graphical output, because it is a GIF displayed in iMessage, and you have access to gestures, since you exploited OS and can get access to any input, you should be able to have fully playable DooM in iMessage! You can even share that game with friends (who run unpatched iOS)!
- attack-surface 5y agoNoticed a flaw in my phone and other people's phones where the default browser was not honored (on Android) and SMS links open in `Samsung Internet` which barely gets updates and is a serious vector for attack. On top of this, why should a link containing a malicious payload be able to speak to other parts of the system? Doesn't Android do a basic security measure called sandboxing and `principle of least privilege'[0]? I am highly suspicious of every URL in my SMS messages app now thanks to these NSO revelations. I'm not especially interesting, so I doubt I had NSO-grade malware on my phone, but we need to protect the masses, not just those with a high profile threat model (Journalists, Dissidents, Activists, etc). [0] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
- blinkingled 5y agoIt's all configurable on a per URL level on Android, it's just hidden deep into settings - it's not so much that it wasn't honored, it's likely someone some time set Samsung Internet top open SMS links - you can go in the app settings/permissions/app defaults to try and reset it or set it to another app.
- NikolaeVarius 5y agoWhy did you create a brand new account for the sole reason of posting a somewhat low information post.
- attack-surface 5y agoGo easy on me, I'm new here. I plan to comment a lot more as time goes by. My comment is purely anecdotal. I'm not saying `everyone now has malware`, just stating that classes of attacks can be killed by doing basic security like principle of least privilege & sandboxing (Android and Apple probably already do it, but then how are these attacks possible?)
- bialpio 5y agoI think the part of the article that touches on this is: "(...) iMessage calls the following method in the IMTranscoderAgent process (outside the "BlastDoor" sandbox), (...)" Looks like they have been decoding GIFs outside of the sandbox, which has been addressed later: "Apple inform us that they have restricted the available ImageIO formats reachable from IMTranscoderAgent starting in iOS 14.8.1 (26 October 2021), and completely removed the GIF code path from IMTranscoderAgent starting in iOS 15.0 (20 September 2021), with GIF decoding taking place entirely within BlastDoor."
- rwaksmunski 5y agoAnd NSO is the value option. Now imagine what nation states with an actual budget have at their disposal.
- Aperocky 5y agoThe problem with nation states is that they don't pay people. I don't think nation state can ever come up with something like this - it takes passion, genius and those qualities demand higher premiums than governments are ever willing to hand out.
- addingnumbers 5y agoTheir entire business model is predicated on nation-states paying NSO more than NSO pays their employees.
- cronix 5y agoIt came out in the recent trial that the FBI couldn't open Kyle Rittenhouse's iPhone, which was the latest generation at that time last year.
- dogma1138 5y agoThe FBI couldn’t mainly because they haven’t caught up to this level as it’s not their primary objective they are first and foremost and investigative outfit. The NSA not to mention the entirety of the US defense industry could’ve easily found a way to break the encryption on a single device especially since they only had to break a relatively simple password / passcode it’s just a question of how much would it cost and how long would it take.
- adabaed 5y agoAmazing.
- ttul 5y agoTL;DR - the ending of the post is all you need: “JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.”
- EvanAnderson 5y agoThis one will be another talking point right beside the "arbitrary code execution in SNES games via controller inputs" as a rebuke to arguments about even small systems (like an image decompressor) being "made secure". I also keep thinking "The Cylons would totally write an exploit like this."
- throw0101a 5y ago> I also keep thinking "The Cylons would totally write an exploit like this." Reminder that the Cylon attack was an insider job in the rebooted series (from a model Number Six).
- NikolaeVarius 5y agoDo we know for a fact the NSO group are in fact NOT Cylons?
- johndoughy 5y agoThey must have spent tons of engineering effort to create this virtual computer to act as their foundation for further exploits. They don't deserve any sympathy of course, but it must really suck that their foundation disappears immediately with the fixed vulnerability.
- Thorncorona 5y agoSince NSO is able to do these 0 click exploits on iphones does this mean they have have hacked apple engs as well and have copies of iOS lying around?
- moyix 5y agoNo, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.
- deleted 5y ago[deleted]
- distantsounds 5y agogo ahead, fuzz your own iOS exploit. you make it sound like someone just cranks one out before lunch.
- bawolff 5y agoEntirely do-able by a team of experts with multimillion dollar budgets over the course of probably many months, doesn't sound at all similar to average hn commenter being able to do it before lunch.
- toxik 5y agoI mean, you’re not going to fuzz your way to bit twiddling together a small virtual computer inside of a compression stream.
- moyix 5y agoOf course – but you can definitely fuzz your way to the initial vulnerability. The VM stuff is done once you have that vulnerability and are writing the actual exploit, which is a manual process.
- TechBro8615 5y ago
- agustif 5y agoThanks god you can remove Messages.app nowadays
- jethro_tell 5y agocan you substitute a messaging app of your choice like on android?
- scintill76 5y agoHow? I just tried, and I could only remove it from the home screen.
- agustif 5y agoYou're right, only hides it from home screen. Good thing is UE recently passed some legislation regarding this, so it might be there in the future at least for European users! yay?
- walrus01 5y ago> iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and skeptical that Signal supports embedding animated images. I can name exploits of this type on desktop PC operating systems going back probably 22-23 years... I do realize that lack of rich media inline in messages is a non starter for most non-technical consumer end users.
- mlindner 5y agoSignal lets you embed animated images but they still won't let you send native resolution images from your phone to someone else. Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage.
- baybal2 5y ago> Signal drastically recompresses any image sent. The only end to end encrypted software I know of that allows that is iMessage. I believe they wont use Signal's own client to send their exploit. Client side TX restrictions make no sense.
- nightpool 5y agoHow could Signal recompress images while retaining end-to-end encryption? Wouldn't any "recompression" happen entirely on the client-side, and therefore be fair game for hackers to bypass with their own payloads?
- anchpop 5y agothey definitely don’t do this, but in principle they could use homomorphic encryption to do the compression server-side with zero knowledge
- julietdg 5y agoThere has been something called a Pegasus framework on my iphones since the 5s and now in my xr. I have seen other people question the same thing on apple dev site but just as i never got a response from apple about what it actually is, neither have they. There is also a Pegasus Arm64 too.
- saagarjha 5y agoPerhaps you should’ve read my reply from when you asked this several months ago: https://news.ycombinator.com/item?id=28521664 https://news.ycombinator.com/item?id=28521664
- malshe 5y agoFrom the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR (https://www.johnscottrailton.com https://www.johnscottrailton.com) and make him say controversial things, which could be later used to malign Citizen Lab. Darknet Diaries covered this incident recently: https://darknetdiaries.com/episode/99/ https://darknetdiaries.com/episode/99/
- S_A_P 5y agohttps://9to5mac.com/2021/12/15/pegasus-spyware-maker-nso-running-out-of-cash/ https://9to5mac.com/2021/12/15/pegasus-spyware-maker-nso-run... hopefully this company is on the way out...
- rhizome 5y agoI'd assume they're using the Erik Prince/Constellis business model, taking some time off and getting the band back together under a different name to do the same work.
- deleted 5y ago[deleted]
- trashcat 5y ago
- nlh 5y agoAs other have commented, this is absolutely mind-bogglingly hard core. Kudos to the NSO group engineers who designed and built this (regardless of your allegiances and whether you like or dislike that they do this and whether it's objectively good or evil or somewhere in between, you have to admit that it's deeply technically impressive). Does anyone have a sense of who they sold this to and who used this particular 0-click exploit?
- saiya-jin 5y agoSorry but can't agree here - this stuff is proper evil for most of world population, which includes also most of HN readers (no its not just SV and 5 other guys). Its more often than not used to oppress common citizens, freedom thinkers and truth sayers. They are actively making this world a much worse place long term, and why - pure greed for money and power. They don't even try to act like there is some moral / law filter when choosing their customers. NSO as company is a highly amoral business too, kind of goes hand in hand.
- jstanley 5y agoI don't think any of what you said refutes the point that this is deeply technically impressive.
- saiya-jin 5y agoIt does to me, but then I have my own moral values. How nazis organized jewish extermination of millions in concentration camps might be also amazing from bureaucratic & organizational point of view, yet I completely fail to marvel at such an achievement in efficiency.
- tata71 5y agoSome subset of their expansive customer list. This isn't a one-time thing. They're a funnel.
- xiphias2 5y agoMy country’s dictator (Viktor Orban) uses it to spy against the opposition and the president to make sure that he keeps control of Hungary. I would give more kudos to NSO if they helped us get rid of corruption in my country.
- vmception 5y ago> further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states I mean the whole “nation state” or “nation state backed” hackers thing was always a liiiiitle (very) ambiguous right? Does the evidence really even move the goal post or mitigate the convenient scapegoating? Politicians and CEOs and certified IT professionals are all incentivized to say “it was a nation state there’s nothing we could have done!” and rely on their sycophants to never question it, instead of “we’re incompetent and powerless towards random teenagers who rented a rootkit before renting a compromised windows machine that happened to be located in russia”
- pen2l 5y agoI think it is worthwhile to distinguish the two, and I think generally speaking it's the use of bespoke 0days that separates nation state attackers from all others. One can't really arrange the funding of computer scientists/mathematicians working full-time on the thankless job of finding vulnerabilities without nation-state kind of money, as opposed to employing known vulnerabilities which carry lesser chance of success and greater chance of blowback in their execution. Aftercall NSO is itself an IDF unit 8200 outfit.
- vmception 5y agoSo nations states as clients isnt the same as being state sponsored or backed, a nation state as a former employer isnt the same either But ultimately I’m not sure the distinction matters if the main result is that hackers get away unscathed and the victims just deflect attention to the wrong targets
- someotherperson 5y agoBlaming entire nations gives domestic justification for retaliation. No point giving up a card when it's handed to you. It is in a government's best interest to exploit every opportunity handed to them -- it's less effort than fabricating a reason when you need it later.
- sangnoir 5y ago
- newbamboo 5y agoAmazing apple let this slip past. Seems pretty obvious why this is bad design, easy to exploit, etc. so maybe it was intentional and already being used by us when the NSO group caught wind through “back channels” and hopped on the gravy train.
- hraedon 5y ago"iMessage's .gif handling was a bit sloppy" is a believable problem; the idea that it was done deliberately to facilitate access to what amounts to a VM running in an old image compression format is a big stretch. This isn't like goto fail, and even that one could be explained by developer oversight.
- olliej 5y agoI always felt that goto fail seemed very much like an incorrect merge resolution
- olliej 5y agoI mean the actual exploit is in decades old xpdf code, so that seems unlikely? The gif thing is simply the way that they get to the xpdf JBIG2 decoder.
- ya3r 5y ago> Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states. > Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. They create an emulated computer by decompressing an old image format inside a PDF file which has a .gif extension! That is top notch!
- iamricks 5y agoReading breakdowns like this gives me imposter syndrome
- mark_mart 5y agoThese people probably smartest developers in the world. I wouldn't compare myself with them.
- AlexanderTheGr8 5y agoYou think? These devs are some of the devs in Israel. The best get too popular to work in secret labs like NSO. I find it hard to believe that the best devs are secret ones in Israel. But obviously, I could be wrong.
- bt1a 5y agoI'd imagine there is a fair share of amazing developers that have no interest in flaunting or broadcasting their talent, for at some level it just isn't necessary to advance their career.
- danrocks 5y agoIt does not give me imposter syndrome. It just tells me I know absolutely nothing despite having a so-called advanced degree from "a top school". God damn it.
- ridaj 5y ago... or why your next design review should probably ask "is this input format a Turing-complete language?" This shows how un-theoretical that question is.
- fooyc 5y ago"Is this a memory safe language" should be a critical question for any external facing application, too
- w0mbat 5y agoOne the one hand you've got people writing insanely complex hacks like this. On the other hand there's the guy who was doing whatever he wanted for years just by crafting dodgy plist files. https://blog.siguza.net/psychicpaper/ https://blog.siguza.net/psychicpaper/
- djmips 5y agoHowever that plist hack wasn't anywhere near useful to someone like NSO. Different ballgame.
- marcan_42 5y agoSame class of bug that completely broke Android app signing. In that case it was about ZIP file parsing differences (apps checked at install time by one parser, executed using another parser). And also the same bug class that allowed us to bypass Nintendo's mitigation for the Twilight Hack (Wii Zelda savegame exploit), twice. In that case it was about how they handled the savefile archives slightly differently from existing save data and the game itself. Having multiple parsers for security-sensitive data that isn't just outright signed at an external layer is always a recipe for disaster.
- shmatt 5y agoNSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased. Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres really no way to stop a 0day from leaking from a researcher like that This exploit has been closed, but we haven't heard anything about Pegasus not working anymore, so i'm just assuming they moved on to the next exploit. Previously there was a big Whatsapp exploit FB closed that had them hurting. I'm sure they always have multiple backups for when this happens There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. NSO is just "in your face" which makes people angry NSO was caught, and thats why Google is crediting them. But this same exploit could have been heavily used by 8200/NSA/who knows who else
- wolf550e 5y agoThe researcher that leaves the military takes with them general skills in reverse engineering and exploit development, but they cannot use specific 0days they know about from their military service. The specifics of everything done in the military is classified. People told me they couldn't mention in job interviews some of the skills they have because it's a secret. Like, if someone developed this Turing complete architecture on top of jbig2 decompression while they were in the military, it would be considered a secret that cannot be revealed.
- Closi 5y ago> They cannot use specific 0days they know about from their military service Of course they can, it is just illegal and might be classed as treason or similar. Remember we are talking about getting exploits for nation states here rather than just some regular company - hiring spies is part of standard operations for the intelligence community and would be a valid zero-day acquisition strategy (depending on the protection offered for NSO by Israel).
- Jerrrry 5y ago
- yborg 5y agoJust imagine what they could do with a PSD file.
- peanut_worm 5y agoThis sounds like fiction, I can’t even believe something like that is possible
- sneak 5y ago> Recently, however, it has been documented that NSO is offering their clients zero-click exploitation technology, where even very technically savvy targets who might not click a phishing link are completely unaware they are being targeted. In the zero-click scenario no user interaction is required. Meaning, the attacker doesn't need to send phishing messages; the exploit just works silently in the background. Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense. Having iMessage disabled and no SIM card in the phone (use an external wifi vpn router with a sim) is a mitigation, and is one that I use.
- wolverine876 5y agoThey are discussing a descriptive class of attacks and saying there is no defense against them. Clearly there are defenses; it's a bit sensationalistic.
- mherdeg 5y agoLooking forward to seeing the PDF that implements FizzBuzz in the NSO JBIG2 instruction set.
- dreamcompiler 5y agoThis is quite clever, but fundamentally it's only possible because of a buffer overflow. If the JBIG decoder had been written in Rust (just to cite one example of a language safer than C), this would have been impossible. Use dumb languages, pwn valuable prizes.
- mtoner23 5y agolmfao of course theres a "use rust" comment on hacker news
- enlyth 5y agoRust, our saviour, the lord, Jesus and God itself, as is proven in every HN comment thread Edit: instant flagged for commenting anything non-positive about the Rust evangelism cult
- pornel 5y agoThis case is easy. No need to rewrite: deleted code is even safer than Rust. Apart from Rust, Wuffs is also a good candidate for codecs: https://github.com/google/wuffs/blob/main/doc/wuffs-the-language.md https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang... Too bad that Swift isn't that good for low-level codecs, so a Swift rewrite of Messages couldn't remove C dependencies.
- azakai 5y agoIf the code can't be deleted then an alternative to rewriting is to sandbox it like Firefox recently started to do with wasm. That would have kept any exploit in the sandbox - let them have fun in there with that 70,000 step program where it can't touch anything... Sandboxing using wasm has around 10% overhead, so a full rewrite might end up running faster. But recompiling the code takes less time and effort and will not introduce new bugs, so it's a useful option too.
- pjmlp 5y agoThe sandbox mentioned on the article as the mitigation done by Apple, makes use of Swift. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- sydthrowaway 5y agoNSO Group must employ some savants
- meibo 5y agoAnd still, in 2021, after so many exploits, realizing the futility of trying to fix these bugs and adding their "blast door" process, some Apple dev calls image parsing code where it doesn't belong. The people that are supposed to maintain the element of the OS that has been abused most by nation states do not know the internal APIs they are working with, even just to display looping GIFs. This negligence is killing journalists and activists.
- terhechte 5y agoHow do we know this code was written in 2021? GIF support was added to iMessage (I think) in 2016 or 2016; I couldn't find an exact date.
- meibo 5y agoThat's a fair point, but doesn't change the fact that it remained there after the code review that was surely(?) made after implementing blast door. Especially for image parsing APIs, considering they've always been the brittle part in the iMessage pipeline. Not sure how Apple dev machines look like, but usually I can find stuff like this with a well written grep or a shell script and my API definition, if I'm not sure that I caught everything while refactoring. The codebase might be massive but the team should be sizeable enough to handle it.
- musicale 5y agoIt really does seem like a failure of blast door. Parsing any untrusted data should always be sandboxed.
- baybal2 5y agoThe image library also runs sandboxed, and they found a way to "escape it with ease." Sandboxes don't reduce the need in having programmers with straight hands. They just trade less safe APIs, for ones deemed more so. You will have as much holes in the sandbox, as much APIs you add to it.
- native_samples 5y ago
- intrasight 5y agoI know that I'm generalizing and also being somewhat sarcastic, but can't we blame the majority of exploits on the von Neumann architecture?
- nexuist 5y agoWe can blame the majority of software on the von Neumann architecture
- intrasight 5y agoIndeed
- chenning 5y agoWell this was like learning aliens exist.
- codedokode 5y agoI think that allowing overflows to go unnoticed is a mistake. Overflow on addition should cause an exception by default. It should be easy to implement in hardware and as it is UB in C, correctly written programs wouldn't break. For example, imagine if you are counting money and because of the overlow millions turn into several cents. Another evil thing is indirect jumps. They should be implemented using an index into a jump table.
- orlp 5y agoInteger overflow is not UB in C, only signed integer overflow. Unsigned integer overflow is defined to be modulo 2^w. And there are plans in C2x or C23 IIRC to make signed integer overflow well-defined in terms of two's complement too.
- olliej 5y agointeger overflow is UB because on some architectures it was trapping. In practice for the last 30+ years the default behaviour has been non-trapping. So much so that making it trapping would break vast amounts of software that depend on it, so you can't change the general case behaviour in C, C++, etc, or "safe" languages like Java, C#, etc. Newer languages do recognize this and make trapping the default behaviour, but "rewrite everything at once" is simply not a tractable problem.
- lmm 5y ago> In practice for the last 30+ years the default behaviour has been non-trapping. So much so that making it trapping would break vast amounts of software that depend on it, so you can't change the general case behaviour in C, C++, etc You can change it in C and C++, since the current behaviour is undefined i.e. give control of your computer to hackers. GCC and Clang should make -ftrapv the default. They won't, because whichever one does it first will then perform worse on benchmarks than the other, and that's the only thing the devs care about. But they should.
- olliej 5y agoNo, you can't. Because too much code is completely broken if you do. The only things that make use of overflow being UB are optimizing compilers, and they have reliably broken code for because of this for 20 years. This means most developers have realized that pretending non-twos-complement architectures still exist is nonsense, and both C and C++ have significant pressure to actually define overflow as being 2c.
- m00dy 5y agoC++ and C are the greatest threats against humanity.
- 1f60c 5y agoI'm not sure which is more impressive: the ability to create such a complicated exploit or the ability to clearly describe how it works.
- javajosh 5y agoI have this "what happens next?!" feeling about this post. So exciting. It's also exciting to know that you can send a pdf as any filename through iMessage and it will display! :)
- Eliezer 5y agoThis is the most incredible exploit I've ever heard of that didn't directly corrupt hardware.
- petters 5y agoSince the buffer overflow was in xpdf, perhaps image previews in Ubuntu are affected as well?
- musicale 5y agoI'm surprised this works if image rendering is sandboxed and prevented from doing anything except for writing to a frame buffer.
- mensetmanusman 5y agoIf this is the level of sophistication just going after an iPhone by a private company, it’s laughable to think our critical infrastructure isn’t able to be completely turned off on demand. An invisible nuke that destroys access to clean water overnight across the nation, that’s the future!
- thweroi23423 5y agoIt increasingly appears that half the "security bugs" wouldn't even arise if we'd stuck to modern languages like Lisp in the 90s. Progress, contrary to Western dogma is not always for the better.
- djmips 5y agoI seriously doubt you can prove that.
- deleted 5y ago[deleted]
- fortran77 5y agoApple's buggy PDF decoder, and use of the poorly vetted xpdf open source product made its users susceptible and vulnerable.
- soheil 5y ago> My other compression format is turing-complete!
- soheil 5y agoCould it be that authors of this post are trying to portray NSO as more powerful than they actually are? Could there be elements in googleprojectzero that work for NSO? It is a well known method to make a spy operation more elaborate to worry adversaries.
- arduinomancer 5y agoJust to understand, what is the blast radius of this exploit? Do they just have access to the whole process memory of the iMessage process? Or does it go beyond that?
- TheDong 5y agoA project zero post from early 2020 talks about the iMessage architecture and impact of iMessage exploits: https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html https://googleprojectzero.blogspot.com/2020/01/remote-iphone... The BlastDoor sandbox was added since then (which project zero also has a post on), but this exploit happened outside the blastdoor sandbox, so that doesn't change anything. If previous iMessage exploits are anything to go on, it's likely this gives unsandboxed root access to all memory on the device.
- _vvhw 5y ago"And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure and complex formats, remotely exposing probably hundreds of thousands of lines of code." 90% of zero-days could be stopped at the front door by file format checkers doing static analysis on popular file formats (like ZIP, MS-CFB, Office, image, PDF) exchanged via message/email to reduce semantic gaps in the file format and weird-machine ambiguities that will inevitably be abused by attackers. The problem is simple. Most codecs (and even vulnerable anti-virus software) were written in a time when Postel's law was the norm. It's much easier to write a file format checker as defense-in-depth for the vulnerable codec than to rewrite the codec, especially since a codec's interface typically can't expose policy decisions like a checker's interface can. As a community, we could solve this problem tomorrow. However, the file format checkers to defend don't exist, because the major email/message providers don't want to invest in them, because nobody would see this work. Even if we build them, they don't want to invest in tuning the false positive rate, because people want lax security not strict security on all message/email attachments they open.
- jeffbee 5y agoThe "major email" people are pretty much the only people funding practical technology of the kind you just whined about. https://github.com/google/wuffs https://github.com/google/wuffs
- follower 5y agoNote the disclaimer on that page: > This is not an official Google product, it is just code that happens to be owned by Google. Which generally means that the original author worked at Google when they wrote this code & "chose" to let Google own the copyright of this project rather than fill out more paperwork. It doesn't imply the project was funded by Google--just that the author was a Google employee at some point.
- n-e-w 5y agoYou have to hand it to NSO on this one. They might be evil but they sure aren't stupid. They (loosely) created a virtual machine out of a (very) abstract vuln in the JBIG2 library to create their own logical Turing machine / computer that they then built their own simple architecture for...and then could allow for the computation of any arbitrary function within arbitrary memory. Brilliant; bravo. I salute the ingenuity of this one.
- baybal2 5y agoWhy in the world they put a GIF player into an SMS app?
- thdespou 5y agoIn the last sentence: >The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying. I bet even the Project Zero authors were profoundly amazed how NSO hackers managed to do that. Maybe they can hire them when NSO goes bust.
- sebow 5y agoYeah, maybe next time don't "cancel" wikileaks just because they leaked something from your political side(referencing the DNC & Democratic leaks here). The vault7 was mind-blowing and somehow reinforced what was de facto knew but until then no solid proof was there[merely that quite everything is compromised directly, and when that's not the case, your output is mined],available to the large public.Again, if the Media was more keen on that issue (Privacy, 3-letter agencies being abusive,etc) then people would remember the issues that exist in most computing systems today. For people who at least skimmed through those vulnerabilities,tools, and leaked documents, it's not surprising at all that these kind of exploits are still out there.It's actually disappointing and frankly pathetic that people don't pay attention to some things because they disagree with the source of information(By the way WL revealed things from the entire spectrum: right/left, Russia/western countries/Asia/etc).These 'NSO leaks' are not eye-opening exploits/techniques, but don't let me spark the bubble of "modern infosec journalism".
- specialist 5y agoI'm surprised that iMessage doesn't restrict content to a subset of predefined, preapproved, battle hardened types and variants. Any other content has to be converted before transport. Otherwise that content is just treated as payload (attachment). Why use a library to support every format ever made? To inline image previews? Just show a thumbnail. Why do anything with PDF? Just show a thumbnail. I'm pretty sure iMessage already down samples the puppy pictures I send to my mom, and doing some kind of conversion to tunnel across MMS for non iMessage recipients (eg Android phones).
- herodotus 5y ago> Most of the CoreGraphics PDF decoder appears to be Apple proprietary code, but the JBIG2 implementation is from Xpdf, the source code for which is freely available. When I worked at Apple, we encountered a Jailbreak exploit that relied on some poor code in one of the open-source type fonts. It appeared that someone committed a mod to the project that neglected to do an array bounds check, waited ONE YEAR!!! and then exploited the vulnerability to create a PDF document that would jailbreak a phone if the PDF was viewed. I guess it is possible that something similar was done here.
- markus_zhang 5y agoPeople hired by NSO must be super smart. Does this open new attack vectors? How does anyone be so good with this kind of things?
- jl6 5y agoSo did xpdf get a new release to fix the overflow?