4 ms·

I don't understand why they can't compare android vs iOS. Can't people use Signal instead of iMessage? If they are criticizing iMessage then shouldn't the defau

by _8j50 5y ago

I don't understand why they can't compare android vs iOS. Can't people use Signal instead of iMessage? If they are criticizing iMessage then shouldn't the default messenger on android be used as a fair comparison? My 0.2$ on this topic: prevention is nice but not good enough against a persistent or unknown threat. Mobile devices lack EDR coverage, even enterprises install an MDR and forget about it. I want every child process, network connection and interprocess call that falls out of baseline logged. Compromises happen, discovering them months later is the big issue at hand. If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this.

neximo64 5y ago
How can you be so sure NSO don't have an in into Signal? After all, it still takes an OS to run Signal.
- sorry_outta_gas 5y ago
  Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots
  - _8j50 5y ago
    Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?
- artinmg 5y ago
  Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.
  - Sharlin 5y ago
    Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.
- _8j50 5y ago
  I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.
  - Tagbert 5y ago
    Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
    - alphabettsy 5y ago
      Could it also be that most of their potential targets use iPhones?
- fsflover 5y ago
  > After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.
369548684892826 5y ago
> 0.2$ Do you mean 0.02 or is inflation really running that high?
- giantrobot 5y ago
  Maybe they work for Verizon[0]? [0] https://m.youtube.com/watch?v=MShv_74FNWU https://m.youtube.com/watch?v=MShv_74FNWU
lnxg33k1 5y ago
I would quote myself from another thread where I said that Apple is only about design, but since we're talking security, I see always apple as exploiting having a very low market share for desktop and nil market share as server, but in terms of practical security I see posts like this: https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25/apple-10-years-behind-microsoft-when-it-comes-to-security/ https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25... But I also like to share these kind of posts when I want to make example about like the absolute lack of knowledge in terms of security of apple, like having the guts to release to public a system where password files / shadow and sudoers are world writable just shows that they really have no idea what they're doing And I wouldn't consider myself a fanboy or like justify this kind of posts like mine as "HN is notoriously against apple" I would more likely say that HN audience is a bit into tech, and if you are into tech and understand how systems work then you can't just ignore these kind of things when you see them so you forcefully end up just trying to dodge a system like apple
octoberfranklin 5y ago
Because "we're a tiny bit better than the other half of the duopoly" is avoiding the issue.
TheDong 5y ago
Even if you install Signal, you'll still have iMessage installed and processing messages sent to your apple ID. iMessage on iOS is part of the OS, and does some message handling in kernelspace. Yes, it has blastdoor, but even since blastdoor sandboxing has been introduced, there have been multiple iMessage CVEs which lead to a full device compromise. See this project zero post for more about iMessage [0]. What I'm trying to say here, is that on an iPhone, no matter what messenger you use, some iMessage exploits can pwn that messenger anyway since iMessage cannot be disabled, and has privileged OS level access. On the other hand, android does have "google messenger" or whatever the OEM installed, and it may not be uninstallable, but it's sandboxed away from the OS in the same way every other app is. There have been exploits based on kernel-space processing of media attachments on android too, but those actually did depend on the app being used, so if you switched SMS apps to one which rejected such an attachment, or otherwise processed it differently, you actually could be secure. Said another way, on android you actually can turn off the default messenger and use signal for SMS. On iOS, that's not so realistic. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- YeBanKo 5y ago
  iMessage can be disabled, but not uninstalled.
saagarjha 5y ago
> I want every child process, network connection and interprocess call that falls out of baseline logged. This would be a nice thing to have, yeah > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this. lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance.
- _8j50 5y ago
  > lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI perhaps? They all allow you to specify detection rules like with ids and fw but the out of the box stuff is good enough to catch APTs but obviously not perfect. Althougj out of those I can only recommend crowdstrike falcon, defender ATP is also decent. Red teamers have bypasses for some, it's a cat and mouse game but can you find one instance where an actual threat actor intentionally evaded an EDR?
ignoramous 5y ago
> I don't understand why they can't compare android vs iOS. Matthew Green et al already did: https://securephones.io https://securephones.io > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. I am actively building one such open source app (for Android). We are half-way there. One my friends was editor-in-chief at a big media company and his frustrations made it clear to me that they were sitting ducks. Though, securing folks in high risk profession is not easy, at all. But one ought to start somewhere. And it is clear, the eventual solution needs to be external to the phones themselves.
- faeyanpiraat 5y ago
  Why not make a phone which is secure by default?
  - ignoramous 5y ago
    Easier said than done because of the attack surface, but I do think the industry will respond given Androids are the most widely-deployed, always-connected, computers in use out there. I don't think just securing the hardware is enough (though, even that isn't fully done), the software itself remains hard to tame. Add to the fact that folks (including attackers) can "install" arbitrary things on their Androids, the problem gets only worse. Then, there's the social and legislative aspects as well. For example, no one can raid your home without a search warrant, that's illegal. Similar thing needs to exist in the digital space. This at least thwarts illegal spyware, if not the law enforcement themselves from snooping about people's digital lives.
    - faeyanpiraat 5y ago
      Okay so the real issue here is that people want convenience, which requires "N" number of features, which results in an attack surface of "too large to make it secure".

by _8j50 5y ago

neximo64 5y ago

How can you be so sure NSO don't have an in into Signal? After all, it still takes an OS to run Signal.

sorry_outta_gas 5y ago
Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots
- _8j50 5y ago
  Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?
artinmg 5y ago
Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.
- Sharlin 5y ago
  Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.
_8j50 5y ago
I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.
- Tagbert 5y ago
  Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
  - alphabettsy 5y ago
    Could it also be that most of their potential targets use iPhones?
fsflover 5y ago
> After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.

369548684892826 5y ago

> 0.2$ Do you mean 0.02 or is inflation really running that high?

giantrobot 5y ago
Maybe they work for Verizon[0]? [0] https://m.youtube.com/watch?v=MShv_74FNWU https://m.youtube.com/watch?v=MShv_74FNWU

lnxg33k1 5y ago

I would quote myself from another thread where I said that Apple is only about design, but since we're talking security, I see always apple as exploiting having a very low market share for desktop and nil market share as server, but in terms of practical security I see posts like this: https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25/apple-10-years-behind-microsoft-when-it-comes-to-security/ https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25... But I also like to share these kind of posts when I want to make example about like the absolute lack of knowledge in terms of security of apple, like having the guts to release to public a system where password files / shadow and sudoers are world writable just shows that they really have no idea what they're doing And I wouldn't consider myself a fanboy or like justify this kind of posts like mine as "HN is notoriously against apple" I would more likely say that HN audience is a bit into tech, and if you are into tech and understand how systems work then you can't just ignore these kind of things when you see them so you forcefully end up just trying to dodge a system like apple

octoberfranklin 5y ago

Because "we're a tiny bit better than the other half of the duopoly" is avoiding the issue.

TheDong 5y ago

Even if you install Signal, you'll still have iMessage installed and processing messages sent to your apple ID. iMessage on iOS is part of the OS, and does some message handling in kernelspace. Yes, it has blastdoor, but even since blastdoor sandboxing has been introduced, there have been multiple iMessage CVEs which lead to a full device compromise. See this project zero post for more about iMessage [0]. What I'm trying to say here, is that on an iPhone, no matter what messenger you use, some iMessage exploits can pwn that messenger anyway since iMessage cannot be disabled, and has privileged OS level access. On the other hand, android does have "google messenger" or whatever the OEM installed, and it may not be uninstallable, but it's sandboxed away from the OS in the same way every other app is. There have been exploits based on kernel-space processing of media attachments on android too, but those actually did depend on the app being used, so if you switched SMS apps to one which rejected such an attachment, or otherwise processed it differently, you actually could be secure. Said another way, on android you actually can turn off the default messenger and use signal for SMS. On iOS, that's not so realistic. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

YeBanKo 5y ago
iMessage can be disabled, but not uninstalled.

saagarjha 5y ago

> I want every child process, network connection and interprocess call that falls out of baseline logged. This would be a nice thing to have, yeah > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this. lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance.

_8j50 5y ago
> lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI perhaps? They all allow you to specify detection rules like with ids and fw but the out of the box stuff is good enough to catch APTs but obviously not perfect. Althougj out of those I can only recommend crowdstrike falcon, defender ATP is also decent. Red teamers have bypasses for some, it's a cat and mouse game but can you find one instance where an actual threat actor intentionally evaded an EDR?

ignoramous 5y ago

> I don't understand why they can't compare android vs iOS. Matthew Green et al already did: https://securephones.io https://securephones.io > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. I am actively building one such open source app (for Android). We are half-way there. One my friends was editor-in-chief at a big media company and his frustrations made it clear to me that they were sitting ducks. Though, securing folks in high risk profession is not easy, at all. But one ought to start somewhere. And it is clear, the eventual solution needs to be external to the phones themselves.

faeyanpiraat 5y ago
Why not make a phone which is secure by default?
- ignoramous 5y ago
  Easier said than done because of the attack surface, but I do think the industry will respond given Androids are the most widely-deployed, always-connected, computers in use out there. I don't think just securing the hardware is enough (though, even that isn't fully done), the software itself remains hard to tame. Add to the fact that folks (including attackers) can "install" arbitrary things on their Androids, the problem gets only worse. Then, there's the social and legislative aspects as well. For example, no one can raid your home without a search warrant, that's illegal. Similar thing needs to exist in the digital space. This at least thwarts illegal spyware, if not the law enforcement themselves from snooping about people's digital lives.
  - faeyanpiraat 5y ago
    Okay so the real issue here is that people want convenience, which requires "N" number of features, which results in an attack surface of "too large to make it secure".