9 ms·
The battle for the world’s most powerful cyberweapon
- mikewarot 5y agoHow is it that we can't have an OS that stops such things? I'm of the opinion that the NSA must have a long running covert program to discourage the adoption of secure operating systems. Multilevel Secure Operating Systems have existed since the 1980s, yet most people haven't even heard of them.
- hypertele-Xii 5y agoFor the same reason we can't have pick-proof locks. Total security is physically impossible. You have to defend every access surface with equal flawlessness. Attackers can all coordinate on a single point of failure. By nature of this equation, any time you make a part more secure, attackers will simply focus their efforts on the next weakest link and go at it again. Immunity can't prevent disease from entering your body either; They can only make it harder and actively respond to intrusion.
- Scaevolus 5y agoThere's insufficient motivation for OS creators. It's possible to compile C code with various hardening options and pay a few percent overhead for it, but it remains almost entirely in the realm of academia... Except for the Xbox. Someone hacking an Xbox would lose _Microsoft_ money through piracy, which hurts their bottom line! As a result, the Xbox runs a type 1 hypervisor with various compiler hardening options like Control Flow Integrity enabled, and are generally some of the most locked down consumer devices sold today. What's Apple's motivation beyond bad press? iMessage was parsing media sent to it with a pdf parser. Sure, some activists in repressive regimes will get spied on and executed, but it's just so much effort to invest dev effort on rewrites for security when you could find new ways to send cute animated gifs to each other.
- mkj 5y agoWhich hardening options are Apple ignoring? I would have thought the standard types of ones (debian's default) would also be set on macos/ios, eg https://help.apple.com/xcode/mac/current/#/devf87a2ac8f https://help.apple.com/xcode/mac/current/#/devf87a2ac8f From what I can tell all NSO's rigmarole of making a virtual machine in the PDF parser is to work around the existing mitigations. I guess they could also turn on asan etc in production but that's more than a few percent slowdown.
- WanderPanda 5y agoI don‘t know anything about the benefits of these options but if the tradeoff is only a slowdown of the device this should be an option given to the user. Maybe even payed for („hardened version“ at buy time) or through a subscription.
- jmnicolas 5y agoJust an anecdote but I use GrapheneOS on my phone. It's a security focused OS based on Android AOSP with in particular a secure memory allocation function. The whole OS feels much slower than regular Google Android, Osmand (map app) is barely usable (on a Pixel 4XL which isn't a low end phone by any means). So I don't think we can discount how much slower a device will be with a more secure OS. It might be invisible on desktops, but certainly not on mobile.
- jonway 5y agoIf the secure OS had the same development velocity as the OEM profit OS, the secure OS would be much better optimized than it currently is and likely much much more secure, too. Android and iOS are optimized in general and for example Google or Samsung also optimize and distribute it for specific hardware. GrapheneOS is not well funded and has little influence in hardware development. The development of Graphene from AOSP is pretty much guaranteed to de-optimize it in the short term. While there is little about mobile that would cause a secure OS to be noticably slower, much less mature software with many fewer deployments is expectedly less optimized.
- Veserv 5y agoIt is the official policy of the US government that a Common Criteria EAL2 certification (i.e. "demonstrating resistance to penetration attackers with a basic attack potential" [1]) is adequate for government systems. This would likely correspond to a Class D, the lowest class, under the old Orange Book standard. In contrast, the only protection profile under Common Criteria designed to evaluate a MLS system, SKPP (Separation Kernel Protection Profile) [2], corresponds to a standard beyond EAL6 [3] (i.e. "demonstrating resistance to penetration attackers with a high attack potential"[4]), MLS systems evaluated under the old Orange Book standard correspond to Class B3 or A1. In contrast, until a few years ago, it was official government policy that EAL4 certification (i.e. "demonstrating resistance to penetration attackers with an Enhanced-Basic attack potential"[5]) was adequate for government systems. This likely corresponds to Class C2 under the old Orange Book standard. This standard was chosen in the interest of allowing standard IT commercial vendors, such as Microsoft and Unix vendors, to submit competitive bids because it was deemed economically and technically infeasible for those systems to be retrofitted with adequate security to achieve a higher standard[6]. So, they instead set the standard to a level achievable by standard commercial IT vendors. They have since reduced it to EAL2 because they determined that requiring a EAL4 certification was too onerous, disqualified large vendors such as FireEye, and was unnecessary as the layering of enough EAL2 systems, each like a piece of swiss cheese, would result in systems comparable to EAL4 systems. [1] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 34 [2] https://www.niap-ccevs.org/profile/Info.cfm?PPID=65&id=65 https://www.niap-ccevs.org/profile/Info.cfm?PPID=65&id=65 [3] https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf Page 84 [4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 42 [5] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 38 [6] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 38
- pmontra 5y agoI wonder if governments quietly talk the companies behind the mainstream consumer OSes (Windows, Android, iOS and macOS) and components (I'm thinking about the device drivers) into not to try too hard to make them invulnerable to attacks. They can do all sort of subtle and not too subtle things to companies that cost them more money than they can lose because of zero days and zero clicks. After all nearly everybody has a phone that NSO could spy into and we didn't go back to Nokia 3310.
- herbst 5y agoThey always talk about phone numbers, does that mean without a number I am safe from that attack?
- asdfargargr 5y agoI would bet they have a semi-persistent "non-logged user session cookies" to track you. Just like every other Advertising/publisher does already. basically instead of "Credit card purchase -> phone number -> person ID" they would use "credit card purchase -> semi-persistent hash -> person ID"
- herbst 5y agoBut how would that basically clone my phone's content on their servers? (Which is claimed in the article) it must be some kind of weakness within the system, with some entry point other than some 'cookie'
- peytoncasper 5y agoI had the same question, and this article seems to at least attempt to answer this question referring to an ongoing legal case by several tech companies against NSO. Essentially, they're leveraging exploits in various apps (iMessage, WhatsApp, Gmail, etc) commonly found on phones to infect the end user. So in essence, they're selling limited time exploits to load malware and I guess having to constantly find new exploits to sell. Hell of a business model for sure. https://www.occrp.org/en/the-pegasus-project/how-does-pegasus-work https://www.occrp.org/en/the-pegasus-project/how-does-pegasu...
- herbst 5y agoThat sounds horrible, but thanks for the link! In that case it can't be as perfect as they claim, except they have a huge list of apps to target what very well could be the case. Edit:// Oh > including Gmail, Facebook, WhatsApp, FaceTime, Viber, WeChat, Telegram, Apple’s built-in messaging and email apps, and others.
- neonate 5y agohttps://archive.is/RdEvk https://archive.is/RdEvk
- alfiedotwtf 5y agoJanek's Box?
- ArnoVW 5y agoThat only works on the American cyphers.
- alfiedotwtf 5y agoYou don't know... who to trust
- uptown 5y agoBe a beacon…
- DarkByte8 5y agoWhy is the FBI paying to get Pegasus? Doesn't the US have NSA to do this kind of hacks or find no click zero days in Android/iPhone and share the zero days with the FBI? Or why hasn't someone try to trick NSO to hack a monitored phone and find out the zero day? I am having these questions because every time I hear about NSO there is this question in my head "What is so special about NSO?". I see 2017, 2018, etc. how can someone have zero days for years and no one copy the zero day or fix the zero day? Why I don't hear about NSO competition? Does it have competition?
- trhway 5y agoPaying is the key. NSA doing it for FBI would generate no profit for anyone. Given various loopholes exploiting arrangements between allied security services, I'd not be surprised if NSA were a source of 0days for NSO.
- _kbh_ 5y agoI would 100% be surprised if NSO was being supplied with vulnerabilities from government agencies. If anything it is likely to be the other way around.
- ffhhj 5y ago> NSA were a source of 0days for NSO Not directly, NSA requests tech companies to slow down 0day research so they and others can exploid them.
- inter_netuser 5y agohow are you aware of that?
- 0a3feeb 5y agothe competition for NSO within the US would be traditional defense contractors: raytheon, l3harris, etc. One can make much more money with the DoD than the DoJ.
- JacobiX 5y ago
- eointierney 5y agoThe most powerful cyberweapon is making sure every human understands an inkling of number theory
- wizzwizz4 5y agoSo everyone's invented their own cryptography. Great! I'll just buffer-overflow the TCP stack and let myself in; then I can read all their messages after they've decrypted them. Rock, meet paper.
- eointierney 5y agoSo we have evolved best practice in secure commumication using the most rigorous scientific review methods available to math. We just need to help each other understand how we're modelling this stuff.
- wizzwizz4 5y agoAll cryptography is based on the assumption that the inverse of some operation is hard to compute, because nobody's found an easy way to do it (yet). RSA is based on the assumptions that factoring prime numbers and finding discrete logarithms are both hard. ECC is based on the assumption that the subtraction analogue of that weird additiony thingy is hard. Afaik, neither of these things has been proven.
- dane-pgp 5y ago> Afaik, neither of these things has been proven. It's not even clear (at least to me) what a proof of "difficulty" would look like. You would have to prove that no mathematical process could exist that was capable of (for example) factoring a composite number N in less than M steps (where M is a function of N), and prove that each step has some minimum energy or time requirement, to ground the "difficulty" in terms of things that we can use our current understanding of physics to reason about.
- 5y ago
- 4e530344963049 5y agohttps://trimread.org/articles/29977 https://trimread.org/articles/29977
- octoberfranklin 5y agoAfter reading the title I thought this article was about the Intel Management Engine.
- howtofly 5y agoLOL A full OS including webserver embedded in every PC's firmware.
- wyldfire 5y agoJust imagine if we had a key escrow or other backdoor like FBI asked for. If governments were made up of 99.9% very honest people, hundreds of untrustworthy individuals would still have enormous power ready to be abused.
- dane-pgp 5y agoAnd having that much inscrutable and unaccountable power would very quickly attract hundreds more untrustworthy individuals who would be tempted by the very fact that the power could be abused. Once their capability became self-reinforcing, the number of very honest people in the government would trend towards zero.
- inter_netuser 5y agoWe already have a form of key escrow in the form of public PKI infra/root CAs, etc.
- dane-pgp 5y agoWe also have a certificate transparency system to detect misissuance, and some precedent for economically ruining CAs who break the public's trust. I'm not sure what would happen, though, if someone claimed that a CA had issued a certificate for their domain without permission. Assuming they could detect this and get the certificate revoked quickly, any attack could at least be stopped (after the damage had potentially already been done). You're right, though, that there's little incentive for a government to not use "legal" methods to subvert a CA within its jurisdiction, and accuse the complaining site owner of false-flag attacking their own domain for media attention, or some other excuse. If anything, I'm surprised that a government hasn't tried to poison-the-well of this system by creating a few boy-who-cried-wolf scenarios already.
- inter_netuser 5y agoRemember that rogue driver signed by a “leaked” cert? Things like that are a lot more useful than fooling someone about some silly website. Updates to your OS or secure apps (lmao) funded by the abc soup (Signal and Free Radio Asia, read up) could be signed by the government. For the greater good, citizen.
- deleted 5y ago[deleted]
- ramesh31 5y agoI always find it amusing when a particular software artifact is treated as some kind of powerful weapon in itself, and not just the codification of some really smart people's ideas on the current state of the art in some domain. The number of people on earth that can do this kind of stuff would fit in football stadium. The people are the weapon, not the specific executable.
- matthewdgreen 5y agoI mean that’s kind of the definition of a weapon. The atomic bomb was also just the codification of some ideas into a physical machine.
- ramesh31 5y ago>The atomic bomb was also just the codification of some ideas into a physical machine. No, it wasn't. It was the product of the entire industrial capacity of the United States. The amount of Deuterium required for a fission bomb took years of labor by hundreds of thousands of people to produce. The "ideas" were worthless without the physical infrastructure and industrial capacity to carry out the construction. Software, on the other hand, requires nothing more than really really smart people and a $200 laptop.
- matthewdgreen 5y agoI see. So if we could have developed a nuclear bomb for $200 and destroyed a city using it, it wouldn’t have been a weapon? I don’t understand the reason cost is being brought into the definition.
- _8j50 5y agoThey make it sound like a nuke. A dozen of you devs here can band together and come up with something better in a few months. The post compromise capability is not what makes it powerful but the zerodays used to deliver it. How about we do a YC startup and buy a few RCEs for android and iphone from zerodium and do this? (Just kidding to undermine the "most powerful" exaggeration in the title)
- dudeinjapan 5y agoI thought Pokemon Go was the world's most powerful cyberweapon. It can magically summon hordes of zombies to any location on Earth.
- ganzuul 5y agoI thought this would be about: https://sailfishos.org/ https://sailfishos.org/ MSM editors are a little tech literate these days but they have no authority on the matter. Any other contenders?
- raju 5y agoIf you are interested in a detailed account of the cyberarms race, check out "This Is How They Tell Me the World Ends: The Cyberweapons Arms Race" by New York Times reporter Nicole Perlroth. While the books tends to get a tad repetitive after a while, and definitely skirts many of the technicalities, its definitely provides a lot of insight into the underground zero-day exploits markets and the cyberarms race that we are in right now. https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...
- Sporktacular 5y agoNot often we get to witness such a clear spread of a new technological evil in, what, half a generation? The potential this industry has to inexpensively damage nascent democracies and justice efforts is astounding. They've 'democratised' the coup d'état and the absolute cover-up. Shame on all of them.
- touristtam 5y agoJust a reminder that Capitalism doesn't care for politics only how much profit can be extracted from it.
- Sporktacular 5y agoAnd ethics doesn't care about economic systems. If capitalism is part of the problem here then capitalism needs to be addressed too.
- deleted 5y ago[deleted]
- KKKKkkkk1 5y agoFor some reason, the only previously unpublished piece of info in this long article is in the last paragraph. When they first presented their case against NSO, Facebook’s lawyers thought they had evidence to disprove one of the Israeli company’s longtime claims — that the Israeli government strictly prohibits the firm from hacking any phone numbers in the United States. In court documents, Facebook asserted it had evidence that at least one number with a Washington area code had been attacked. Clearly someone was using NSO spyware to monitor an American phone number. But the tech giant didn’t have the entire picture. What Facebook didn’t appear to know was that the attack on a U.S. phone number, far from being an assault by a foreign power, was part of the NSO demonstrations to the F.B.I. of Phantom — the system NSO designed for American law-enforcement agencies to turn the nation’s smartphones into an “intelligence gold mine.”