14 ms·

A Saudi woman's iPhone revealed hacking around the world

400 points by arunc 5y ago

patja 5y ago
"The image files tricked the iPhone into giving access to its entire memory, bypassing security and allowing the installation of spyware that would steal a user's messages." Seems like there is a lot behind this summary of the hack. How does an image file trick the iPhone into all that?
- Steko 5y ago
  Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625 https://news.ycombinator.com/item?id=29568625
  - TheBozzCL 5y ago
    Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.
    - shp0ngle 5y ago
      There are two different types of attacks. One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures. Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.
      - vatys 5y ago
        How does one know which category they are in?
        iqanq 5y ago
        If you are a feminist activist in saudi arabia, I guess you know the deal
        Cyph0n 5y ago
        If you are asking, you are probably in the first category, along with myself and the vast majority of people.
        shp0ngle 5y ago
        You never really know. But nobody is going to burn zero days on mass surveillance. It’s just for specifically targeted people.
        Spooky23 5y ago
        Are you or someone you associate with interesting? Negotiate big contracts? Work in aerospace or defense? Have access to inside information about a public company? Have access or are a high level political official?
        itsokimbatman 5y ago
        Think about who would want to spy on you, what they'd want to know, and how much they'd be willing to spend to know it. If the most they could get out of you was a few thousand bucks from your bank account and maybe your email password, you're probably in the first category. On the other hand, if you have access to highly confidential information (think classified government info or you're literally working on the next iPhone) or are the type of person who makes enemies of spoiled rich oligarchs in despotic nations then you're probably in the second.
        aborsy 5y ago
        Who will target you if you are working on next iPhone?
        markdown 5y ago
        China. Xiaomi, Huawei, Oppo, Honor... there are quite a few Chinese phone brands that would benefit from knowing what Apple are working on.
      - IncRnd 5y ago
        That's terrible advice that is among some of the worst advice that could be given. There are many other types of attacks that are not viral, are not ransomware and do not originate from state actors.
      - heavyset_go 5y ago
        > Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware. If this was the case, exploits would never be published or abused, and jailbreaks wouldn't exist because this logic says that those who find exploits will either disclose them "responsibly" or sell them to a nation-state. If the idea of non-state hackers doesn't bother you, recognize that organized crime is a billion dollar industry and fraud rings would love root access on tons of normal people's devices, including your own.
    - schoen 5y ago
      In the late 1990s there were a ton of hoaxes about image files supposedly being viruses. Most famously: https://en.wikipedia.org/wiki/Goodtimes_virus https://en.wikipedia.org/wiki/Goodtimes_virus I remember telling lots of people at the time that this was impossible, because images weren't executable code, and viruses spread through running programs, not through viewing images. Unfortunately, this elegant, straightforward distinction didn't hold up over time. :-( https://en.wikipedia.org/wiki/Weird_machine https://en.wikipedia.org/wiki/Weird_machine
      - 5co 5y ago
      - nomel 5y ago
        > Unfortunately, this elegant, straightforward distinction didn't hold up over time. :-( I think it was more that it was never true, rather than not holding up in time. ;) The earliest I can find is a vulnerability in Netscape 3.0 (1996), not found until four years later: https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerability https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerabil...
        thrashh 5y ago
        You just need a buffer overflow in a file format parser. Thus the distinction has never existed. There has never been such thing as a “safe” format.
      - anshumankmr 5y ago
        >because images weren't executable code I believe that is what the creators of this virus must be relying on. All I hope is that creating this image virus doesn't become common knowledge (cause that we will fundamentally reshape how we interact on social media).
        krisoft 5y ago
        > All I hope is that creating this image virus doesn't become common knowledge All I hope is that devs start replacing parsers with ones written in a safe language.
    - morcheeba 5y ago
      One of the earlier iPhone jailbreaks was a tiff image... complicated decompression/rendering algorithms leave room for implementation errors, which can be taken advantage of. https://en.wikipedia.org/wiki/JailbreakMe#JailbreakMe_1.0_(iOS_1.1.1) https://en.wikipedia.org/wiki/JailbreakMe#JailbreakMe_1.0_(i...
      - ElFitz 5y ago
        At some point it was also used as a way to get a custom firmware onto a PSP. Then modders somehow managed to update the batteries' firmware (cf "Pandora battery") and use that. Sony couldn’t patch it, and it was basically game over for them until they released a new generation of hardware, with motherboards immune to the trick. Fun times.
    - Terry_Roll 5y ago
      The problem with cpu's is they dont know what instructions are supposed to run in order. Pipeline cache goes a little way towards getting the instructions in order, but ultimately a cpu does not know what instructions it has to run in order for a group of instructions to not be malicious. Think of a cpu like an old human telephone exchange where the operator is plugging in different cables to different sockets and hopefully you get the idea. I'm amazed at the tech giants with all their funding and they still cant build secure operating systems or have the resources to reduce attack vectors within their own OS'es.
      - pvg 5y ago
        We've gone from 'every OS and device is easily exploitable' to mass market devices/OS pairings where drive-by exploits cost a million dollars.
      - saagarjha 5y ago
        You should look up Rice's theorem, because what you are suggesting is intractable and has nothing to do with the design of CPUs.
        Terry_Roll 5y ago
        I wouldnt consider Rice's theorem to be relevant for what I was thinking. Sure all programs have common repeatable elements, like open a file, read/write, close file, so you wouldnt have an instruction or few out of the blue suddenly being run, in effect out of context, but thats whats happening here, the normal instructions that would be required to do a task, suddenly start using instructions that are not required in most cases before resorting back to the rest of the instructions for the original task. Its abit like saying, would you expect some instructions for virtualisation to run if you load a jpg to display on screen? I wouldnt expect instructions for virtualisation functionality to be running in this example. Or would I expect some instructions for encryption to run if I were to load a sound file to play over speakers? No I wouldnt expect that to happen, but thats the sort of thing thats happening here, some instructions not normally associated with a task are occurring, so how do you detect and alert and maybe halt those instructions? There isnt anything in the CPU AFAIK that would pick this up, it would need the OS to act as a co-party to perhaps halt this, and I dont know if the OS or even AV software goes to this extent? At best, you'd have something like a dmesg feed or the Intel Processor Trace (https://news.ycombinator.com/item?id=30110088 https://news.ycombinator.com/item?id=30110088) to get the output of instructions being called (possibly independent of the OS), but like I say I dont know of any OS or AV product that goes to this level of monitoring. Thats where I am coming from.
    - retrac 5y ago
      https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter about this sort of thing since. Both at a high level architecturally (don't process image files in the kernel) and at a lower level (use a language that takes measures to constrain its buffers). But the basic scenario hasn't been entirely eliminated. There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process.
      - bombcar 5y ago
        Which is why the only safe way to operate is assume anything that is susceptible to outside data is already compromised - and so run them in sandboxes.
        junon 5y ago
        You should read the writeup. This was run in a sandbox. Sandboxes are not silver bullets and too can have bugs.
        thaumasiotes 5y ago
        That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.
        Scoundreller 5y ago
        This is why I run a 1-task only Windows VM inside a Linux VM on a Mac. Ain’t nobody ripping through x3 0-days for my chats.
        saagarjha 5y ago
        If you're a targeted journalist, they'll go through more than three to get you. Full chains are fairly long these days.
    - walrus01 5y ago
      There's been buffer overflows/RCE exploits in all sorts of software that can parse images since, well, forever. I remember more than 20 years ago seeing a notice about the embedded Internet Explorer rendering engine in Microsoft Outlook Express having an RCE zero day which could be exploited by simply loading an image in the body of an email. Rich multimedia parsing display systems in messaging apps are a very tempting attack surface for entities such as NSO.
      - baybal2 5y ago
        Why a messenger app needs a picture viewer?
        saagarjha 5y ago
        Because people send each other pictures?
        alasdair_ 5y ago
        > Why a messenger app needs a picture viewer? A picture is worth a thousand words.
    - arunc 5y ago
      "Cook's egg" is a recommended reading. Summary here (spoilers ahead): https://icdt.osu.edu/cuckoos-egg https://icdt.osu.edu/cuckoos-egg
      - canadaduane 5y ago
        Was "Cuckoo's Egg" autocorrected to "Cook's egg"?
        arunc 5y ago
        Yes, indeed. I don't see an edit option.
        lordnacho 5y ago
        Can't edit after two hours, but it's present before that cutoff.
      - blackberg 5y ago
        That summary sparks interest indeed, thanks for recommending! Just ordered a copy.
    - judge2020 5y ago
      These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1]. 0: https://news.ycombinator.com/item?id=30322715 https://news.ycombinator.com/item?id=30322715 1: https://www.seattletimes.com/business/rights-group-verifies-polish-senator-was-hacked-with-spyware/ https://www.seattletimes.com/business/rights-group-verifies-... ^2: For instance, the Coinbase Super bowl ad that was only a bouncing QR code would have been a very interesting way to start WW3 if it were Russia hacking millions upon millions of americans' phones, exfiltrating any potentially sensitive information (company emails, etc) in an instant, and/or destroying the device via some exploit chain that destroys the OS and requires a full firmware factory reset to recover.
      - IncRnd 5y ago
        You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
        rfoo 5y ago
        Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
        onion2k 5y ago
        once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
    - masklinn 5y ago
      Image parsers are complicated and often exposed to untrusted data, they’ve always been a big vector of exploits.
    - rasz 5y ago
      Did you miss https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) ?
    - heavyset_go 5y ago
      Exploits via image libraries have been a perennial threat. A lot of jailbreaks on various devices and consoles over the last 20 years owe their existence to such exploits.
    - jack_pp 5y ago
      they are safe, unless they're being targeted by state actors.
  - hliyan 5y ago
    Wow, so basically: 1. iMessage has a feature to send and receive GIFs 2. These GIFs are copied to a specific path early in the message processing pipeline (even before the message is displayed) 3. But the copy code doesn't just copy the GIF. It uses the CoreGraphics APIs _renders_ the image to a new GIF file at the destination path. 4. The code uses the ImageIO lib to guess the image format, ignoring the .gif file extension. So you can trick this code to accept a non-GIF file. 5. You can use the above to invoke one of over 20 image codecs that were not intended to be invoked in this code, including the CoreGraphics PDF parser. 6. CoreGraphics PDF parser has a very specific vulnerability in its JBIG2 image codec. 7. JBIG2 takes an image of text, identifies repeating glyphs and uses that fact for better compression. To avoid confusing slightly differing glyphs in things like images of poor quality prints (think e and é, or 3 and 8), it has a way of applying a diff over each instance of an identified repeating glyph. 8. This logic has an integer overflow bug: the 'number of symbols' variable is a 32-bit integer, which can be overflowed using a carefully crafted file. Now the attacker can can set the buffer for symbols to a much smaller value. 9. Making a long story short, this allows overwriting heap memory, setting arbitrary values in the objects used in the JBIG2 logic. 10. The JBIG2 logic uses AND, OR, XOR and XNOR operations when iterating through these objects (to apply the 'diff' on glyphs). The attacker can craft a file that strings together these logic operations so that it basically forms a software logic circuit. 11. So this exploit basically emulates a computer architecture inside an image codec, which can be used to operate on arbitrary memory! Is that right? If so, this is mind-blowing.
    - ironSkillet 5y ago
      If a hack can be called beautiful, this fits the bill. How do people come up with these?
      - miohtama 5y ago
        Being trained in Israeli intelligence corps, moving to civilian life, retaining your spook skills and being funded by Saudi billionaire prince who hates human right activism and criticism.
        5y ago
- deleted 5y ago
  [deleted]
- anothernewdude 5y ago
  As of windows 7, the parsing of some font files was handled inside the Windows Kernel.
- livinglist 5y ago
  hi
pakwa 5y ago
Tech has essentially created this problem. Can’t tech fix it?
- aikinai 5y ago
  Construction has essentially created the problem of potholes. Can they fix it?
  - rmbyrro 5y ago
    Good analogy. Question here is: can they fix potholes faster than new ones show up? Seems answer is no for tech. And construction, these days.
    - arunc 5y ago
      It takes an expert to know that there's vulnerability. Whereas construction engineer can "see" the pothole and so they can fix it. Software engineer has to "know from exploits" that there's a vulnerability so they can fix it. It's not far away when OS are written in memory safe languages like Rust.
      - pjmlp 5y ago
        You mean far away like 1961? https://en.m.wikipedia.org/wiki/Burroughs_large_systems https://en.m.wikipedia.org/wiki/Burroughs_large_systems Nowadays still being sold to governments that care about security. https://itupdate.com.au/page/unisys-clearpath-mcp-unsurpassed-security https://itupdate.com.au/page/unisys-clearpath-mcp-unsurpasse... https://www.unisys.com/ms/client-education/course-catalog/clearpath-mcp https://www.unisys.com/ms/client-education/course-catalog/cl... Or maybe 1983? https://en.m.wikipedia.org/wiki/Rational_R1000 https://en.m.wikipedia.org/wiki/Rational_R1000 Maybe 1982, https://news.ycombinator.com/item?id=22375449 https://news.ycombinator.com/item?id=22375449 Plenty of examples (those are a tiny snippet) on how safe OSes should be written, until there is liability the easiest way will always win.
      - rmbyrro 5y ago
bredren 5y ago
>Fearful that her iPhone had been hacked as well, al-Hathloul contacted the Canadian privacy rights group Citizen Lab and asked them to probe her device for evidence I wonder if she had a preexisting relationship w the group or how she was connected with them. Presumably her work included a network of journalist protection orgs. But had she had a device “probed” like this before? It’s such an important point of contact I wonder about the details of this.
- walrus01 5y ago
  Loujain has strong connections in the metro Vancouver BC area. People working in network security/infosec and associated with UBC IT are well aware of Citizen Lab and possibly put her in contact with them. Citizen Lab at the University of Toronto is fairly well known throughout the Canadian academic research/computer science/network engineering community.
walrus01 5y ago
Loujain is a University of British Columbia graduate and was a political prisoner: https://www.google.com/search?client=firefox-b-1-d&q=loujain+al-hathloul https://www.google.com/search?client=firefox-b-1-d&q=loujain... https://en.wikipedia.org/wiki/Loujain_al-Hathloul https://en.wikipedia.org/wiki/Loujain_al-Hathloul Let's not forget that the present Saudi regime (MBS) is responsible for luring political opponents/journalists, killing them, and dismembering them with bone saws. https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khashoggi https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khashog...
- BeetleB 5y ago
  The irony is that he's also the one who forced the country to allow women to drive.
  - Synaesthesia 5y ago
    It's just a very minor victory for women's rights and it was a very impractical law anyway. It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies. Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.
    - newyankee 5y ago
      The entire reason Saudi is so powerful is because of Oil Wealth and its special relationship to US since WW2
    - BeetleB 5y ago
      - svilen_dobrev 5y ago
        wonders of i'net.. you know, there is something called female circumcision. And the society+culture behind it, has been applying it even on women born and living outside it, when they once visited their relatives.. (described in book: Ever Since Adam and Eve: The Evolution of Human Sexuality - Malcolm Potts and Roger Short, 1999)
DethNinja 5y ago
Would compiling image parsers with ASLR and bounds checking prevent these zero-click hacks? I haven’t researched the exploits in detail but it seems to me Apple can develop better protection against such zero-click exploits. At the very least, iMessages shouldn’t preview images from unknown contacts.
- jazzyjackson 5y ago
  I'm convinced that a bad image parser is apple's backdoor, but I only have my paranoia as proof.
  - viktorcode 5y ago
    What Apple stands to gain from a backdoor? It's clear what the cost of risk is, but what is the gain?
    - PickledHotdog 5y ago
      Just spitballing, but market access to China and the like?
      - user_7832 5y ago
        Why use a backdoor if you have the frontdoor, the walls, the roof.. and the entire server? Censorship, Surveillance and Profits: A Hard Bargain for Apple in China - https://nyti.ms/3oAvIVH https://nyti.ms/3oAvIVH > Apple has largely ceded control to the Chinese government. Chinese state employees physically manage the computers. Apple abandoned the encryption technology it used elsewhere after China would not allow it. And the digital keys that unlock information on those computers are stored in the data centers they’re meant to secure.
- a1a106ed5 5y ago
  The image parser uses ASLR. The turing complete NAND computing device they describe in the article was used to do computations on the pointers leaked with the infoleak, resulting in an ASLR bypass. Brilliant.
fartcannon 5y ago
Isn't the walled garden and locked down OS/hardware supposed to prevent these things?
- nine_k 5y ago
  Only provably correct software would prevent such things. A walled garden could make it simpler to enforce that only software proved correct can be installed, but without the proof, it does not guarantee much,,only makes certain things less probable. Writing provably correct software us now a rare and expensive engineering feat. Most consumer OSes have nothing of thus sort, sadly. And I mean just the limited set of system software, not third-party installable apps, of course.
  - d0mine 5y ago
    "Beware of bugs in the above code; I have only proved it correct, not tried it." https://www-cs-faculty.stanford.edu/~knuth/faq.html https://www-cs-faculty.stanford.edu/~knuth/faq.html
  - fulafel 5y ago
    Formal correctness proofs are both unattainable and insufficient. We don't know how to do it at the required scale, and it doesn't save us from flawed formal specifications, we'll have the bugs in the formal requirements instead of in the code. There are more cost efficient and proven ways to effectively address these kinds of vulnerabilities, like limiting complexity, using programming language features to eliminate classes of bugs, using other verifiable engineering disciplines, and compartmentalisation. Proofs also have their place locally in verifying small components. But making this commercially viable would large numbers of customers and users who are willing to make big compromises in functionality, features, third party apps etc.
    - nine_k 5y ago
      Limiting complexity is often not an option, because the complexity is of the subject area. Things like image format decoders are easiest to produce formal analysis and proofs for. It's sadly still too expensive and slow to produce. Fuzzing as a mandatory testing step could be useful in some cases. I agree about bugs in specifications though :(
aborsy 5y ago
Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?
- zionic 5y ago
  Because Animoji was more important. Incase anyone was wondering, yes the amount they spent on that particular feature vastly eclipsed their spend on the kinds of teams that could have caught this.
  - saagarjha 5y ago
    I really don't get why you would make a statement like this with such confidence. Apple employees hundreds of people on its security teams and pays each of those engineers fairly well. Animoji is a spin off of their Face ID work, which you could arguably call a security feature in its own right but not strictly a red team.
  - AussieWog93 5y ago
    To be fair, Animoji probably sell more phones that protection against State-backed adversaries.
  - anaganisk 5y ago
    I find it very hard to believe that the richest company in the world, didn’t have enough money to implement Animoji. And they had to eclipse the budget of security team. Could you provide a source for that?
    - mrep 5y ago
      3rd richest if we are going by profits: https://companiesmarketcap.com/most-profitable-companies/ https://companiesmarketcap.com/most-profitable-companies/
      - anaganisk 5y ago
deleted 5y ago
[deleted]
KKKKkkkk1 5y ago
How come the company that made Pegasus is being sanctioned, but the government that used Pegasus to abduct, kill, and then dismember a dissident - isn't?
- webkike 5y ago
  Because it’s easier?
- zakary 5y ago
  The simple answer is that to the people that really matter in decisions like that, those in the intelligence and the state departments of countries like the US, software like Pegasus is an important tool in staying ahead of adversaries. And in order to do its job effectively, it’s best if people don’t know about it. Pegasus may be sanctioned, but another company will make a product to takes its place and the game will start again. A similar argument can be made in favour of keeping the Saudis on side; they are useful for what they can do to help attain the foreign policy goals of the US and it’s allies. Those goals are mostly related to making sure the US continues to have access to all the stuff they need to stay on top of the geopolitical tree
  - GekkePrutser 5y ago
    How does it help to stay ahead of adversaries when they're selling it to basically everyone including most adversaries?
    - tapas73 5y ago
      you can sell basic version. Leaving premium to your self.
- trasz 5y ago
  That government is an important US ally.
  - marcosdumay 5y ago
Arrezz 5y ago
I have always wondered about how exploits like these manage to stay secret for any length of time? I would imagine that leaking such a thing could he very rewarding but I guess there is too much risk involved.
bagacrap 5y ago
I guess enemies of a state should be using feature phones?
- ectopod 5y ago
  Feature phones are notorious for having terrible security. Most of them can be quietly hacked with an SMS from the carrier. And they support MMS so you're not immune to image parsing bugs either.
pkphilip 5y ago
This Saudi women's activist - Loujain al-Hathloul, is one of the most courageous people I have ever heard of. She was arrested for driving a car in 2018 and remained in prison till 2021 and she was subjected to severe torture and abuse. https://en.wikipedia.org/wiki/Loujain_al-Hathloul https://en.wikipedia.org/wiki/Loujain_al-Hathloul Her husband is another exceptionally courageous person and it is inspiring to see their cheer and steadfast courage despite all the hardship they face. It is sad to see Saudi Arabia continuing to harass this couple.

400 points by arunc 5y ago

"The image files tricked the iPhone into giving access to its entire memory, bypassing security and allowing the installation of spyware that would steal a user's messages." Seems like there is a lot behind this summary of the hack. How does an image file trick the iPhone into all that?

Steko 5y ago
Here's the writeup: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... edit, previous discussion: https://news.ycombinator.com/item?id=29568625 https://news.ycombinator.com/item?id=29568625
- TheBozzCL 5y ago
  Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.
  - shp0ngle 5y ago
    There are two different types of attacks. One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures. Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.
    - vatys 5y ago
      How does one know which category they are in?
      - iqanq 5y ago
        If you are a feminist activist in saudi arabia, I guess you know the deal
      - Cyph0n 5y ago
        If you are asking, you are probably in the first category, along with myself and the vast majority of people.
      - shp0ngle 5y ago
        You never really know. But nobody is going to burn zero days on mass surveillance. It’s just for specifically targeted people.
      - Spooky23 5y ago
        Are you or someone you associate with interesting? Negotiate big contracts? Work in aerospace or defense? Have access to inside information about a public company? Have access or are a high level political official?
      - itsokimbatman 5y ago
        Think about who would want to spy on you, what they'd want to know, and how much they'd be willing to spend to know it. If the most they could get out of you was a few thousand bucks from your bank account and maybe your email password, you're probably in the first category. On the other hand, if you have access to highly confidential information (think classified government info or you're literally working on the next iPhone) or are the type of person who makes enemies of spoiled rich oligarchs in despotic nations then you're probably in the second.
        aborsy 5y ago
        Who will target you if you are working on next iPhone?
        markdown 5y ago
        China. Xiaomi, Huawei, Oppo, Honor... there are quite a few Chinese phone brands that would benefit from knowing what Apple are working on.
    - IncRnd 5y ago
      That's terrible advice that is among some of the worst advice that could be given. There are many other types of attacks that are not viral, are not ransomware and do not originate from state actors.
    - heavyset_go 5y ago
      > Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware. If this was the case, exploits would never be published or abused, and jailbreaks wouldn't exist because this logic says that those who find exploits will either disclose them "responsibly" or sell them to a nation-state. If the idea of non-state hackers doesn't bother you, recognize that organized crime is a billion dollar industry and fraud rings would love root access on tons of normal people's devices, including your own.
  - schoen 5y ago
    In the late 1990s there were a ton of hoaxes about image files supposedly being viruses. Most famously: https://en.wikipedia.org/wiki/Goodtimes_virus https://en.wikipedia.org/wiki/Goodtimes_virus I remember telling lots of people at the time that this was impossible, because images weren't executable code, and viruses spread through running programs, not through viewing images. Unfortunately, this elegant, straightforward distinction didn't hold up over time. :-( https://en.wikipedia.org/wiki/Weird_machine https://en.wikipedia.org/wiki/Weird_machine
    - 5co 5y ago
    - nomel 5y ago
      > Unfortunately, this elegant, straightforward distinction didn't hold up over time. :-( I think it was more that it was never true, rather than not holding up in time. ;) The earliest I can find is a vulnerability in Netscape 3.0 (1996), not found until four years later: https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerability https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerabil...
      - thrashh 5y ago
        You just need a buffer overflow in a file format parser. Thus the distinction has never existed. There has never been such thing as a “safe” format.
    - anshumankmr 5y ago
      >because images weren't executable code I believe that is what the creators of this virus must be relying on. All I hope is that creating this image virus doesn't become common knowledge (cause that we will fundamentally reshape how we interact on social media).
      - krisoft 5y ago
        > All I hope is that creating this image virus doesn't become common knowledge All I hope is that devs start replacing parsers with ones written in a safe language.
  - morcheeba 5y ago
    One of the earlier iPhone jailbreaks was a tiff image... complicated decompression/rendering algorithms leave room for implementation errors, which can be taken advantage of. https://en.wikipedia.org/wiki/JailbreakMe#JailbreakMe_1.0_(iOS_1.1.1) https://en.wikipedia.org/wiki/JailbreakMe#JailbreakMe_1.0_(i...
    - ElFitz 5y ago
      At some point it was also used as a way to get a custom firmware onto a PSP. Then modders somehow managed to update the batteries' firmware (cf "Pandora battery") and use that. Sony couldn’t patch it, and it was basically game over for them until they released a new generation of hardware, with motherboards immune to the trick. Fun times.
  - Terry_Roll 5y ago
    The problem with cpu's is they dont know what instructions are supposed to run in order. Pipeline cache goes a little way towards getting the instructions in order, but ultimately a cpu does not know what instructions it has to run in order for a group of instructions to not be malicious. Think of a cpu like an old human telephone exchange where the operator is plugging in different cables to different sockets and hopefully you get the idea. I'm amazed at the tech giants with all their funding and they still cant build secure operating systems or have the resources to reduce attack vectors within their own OS'es.
    - pvg 5y ago
      We've gone from 'every OS and device is easily exploitable' to mass market devices/OS pairings where drive-by exploits cost a million dollars.
    - saagarjha 5y ago
      You should look up Rice's theorem, because what you are suggesting is intractable and has nothing to do with the design of CPUs.
      - Terry_Roll 5y ago
        I wouldnt consider Rice's theorem to be relevant for what I was thinking. Sure all programs have common repeatable elements, like open a file, read/write, close file, so you wouldnt have an instruction or few out of the blue suddenly being run, in effect out of context, but thats whats happening here, the normal instructions that would be required to do a task, suddenly start using instructions that are not required in most cases before resorting back to the rest of the instructions for the original task. Its abit like saying, would you expect some instructions for virtualisation to run if you load a jpg to display on screen? I wouldnt expect instructions for virtualisation functionality to be running in this example. Or would I expect some instructions for encryption to run if I were to load a sound file to play over speakers? No I wouldnt expect that to happen, but thats the sort of thing thats happening here, some instructions not normally associated with a task are occurring, so how do you detect and alert and maybe halt those instructions? There isnt anything in the CPU AFAIK that would pick this up, it would need the OS to act as a co-party to perhaps halt this, and I dont know if the OS or even AV software goes to this extent? At best, you'd have something like a dmesg feed or the Intel Processor Trace (https://news.ycombinator.com/item?id=30110088 https://news.ycombinator.com/item?id=30110088) to get the output of instructions being called (possibly independent of the OS), but like I say I dont know of any OS or AV product that goes to this level of monitoring. Thats where I am coming from.
  - retrac 5y ago
    https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter about this sort of thing since. Both at a high level architecturally (don't process image files in the kernel) and at a lower level (use a language that takes measures to constrain its buffers). But the basic scenario hasn't been entirely eliminated. There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process.
    - bombcar 5y ago
      Which is why the only safe way to operate is assume anything that is susceptible to outside data is already compromised - and so run them in sandboxes.
      - junon 5y ago
        You should read the writeup. This was run in a sandbox. Sandboxes are not silver bullets and too can have bugs.
      - thaumasiotes 5y ago
        That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.
        Scoundreller 5y ago
        This is why I run a 1-task only Windows VM inside a Linux VM on a Mac. Ain’t nobody ripping through x3 0-days for my chats.
        saagarjha 5y ago
        If you're a targeted journalist, they'll go through more than three to get you. Full chains are fairly long these days.
  - walrus01 5y ago
    There's been buffer overflows/RCE exploits in all sorts of software that can parse images since, well, forever. I remember more than 20 years ago seeing a notice about the embedded Internet Explorer rendering engine in Microsoft Outlook Express having an RCE zero day which could be exploited by simply loading an image in the body of an email. Rich multimedia parsing display systems in messaging apps are a very tempting attack surface for entities such as NSO.
    - baybal2 5y ago
      Why a messenger app needs a picture viewer?
      - saagarjha 5y ago
        Because people send each other pictures?
      - alasdair_ 5y ago
        > Why a messenger app needs a picture viewer? A picture is worth a thousand words.
  - arunc 5y ago
    "Cook's egg" is a recommended reading. Summary here (spoilers ahead): https://icdt.osu.edu/cuckoos-egg https://icdt.osu.edu/cuckoos-egg
    - canadaduane 5y ago
      Was "Cuckoo's Egg" autocorrected to "Cook's egg"?
      - arunc 5y ago
        Yes, indeed. I don't see an edit option.
        lordnacho 5y ago
        Can't edit after two hours, but it's present before that cutoff.
    - blackberg 5y ago
      That summary sparks interest indeed, thanks for recommending! Just ordered a copy.
  - judge2020 5y ago
    These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1]. 0: https://news.ycombinator.com/item?id=30322715 https://news.ycombinator.com/item?id=30322715 1: https://www.seattletimes.com/business/rights-group-verifies-polish-senator-was-hacked-with-spyware/ https://www.seattletimes.com/business/rights-group-verifies-... ^2: For instance, the Coinbase Super bowl ad that was only a bouncing QR code would have been a very interesting way to start WW3 if it were Russia hacking millions upon millions of americans' phones, exfiltrating any potentially sensitive information (company emails, etc) in an instant, and/or destroying the device via some exploit chain that destroys the OS and requires a full firmware factory reset to recover.
    - IncRnd 5y ago
      You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
      - rfoo 5y ago
        Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
        onion2k 5y ago
        once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
  - masklinn 5y ago
    Image parsers are complicated and often exposed to untrusted data, they’ve always been a big vector of exploits.
  - rasz 5y ago
    Did you miss https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) ?
  - heavyset_go 5y ago
    Exploits via image libraries have been a perennial threat. A lot of jailbreaks on various devices and consoles over the last 20 years owe their existence to such exploits.
  - jack_pp 5y ago
    they are safe, unless they're being targeted by state actors.
- hliyan 5y ago
  Wow, so basically: 1. iMessage has a feature to send and receive GIFs 2. These GIFs are copied to a specific path early in the message processing pipeline (even before the message is displayed) 3. But the copy code doesn't just copy the GIF. It uses the CoreGraphics APIs _renders_ the image to a new GIF file at the destination path. 4. The code uses the ImageIO lib to guess the image format, ignoring the .gif file extension. So you can trick this code to accept a non-GIF file. 5. You can use the above to invoke one of over 20 image codecs that were not intended to be invoked in this code, including the CoreGraphics PDF parser. 6. CoreGraphics PDF parser has a very specific vulnerability in its JBIG2 image codec. 7. JBIG2 takes an image of text, identifies repeating glyphs and uses that fact for better compression. To avoid confusing slightly differing glyphs in things like images of poor quality prints (think e and é, or 3 and 8), it has a way of applying a diff over each instance of an identified repeating glyph. 8. This logic has an integer overflow bug: the 'number of symbols' variable is a 32-bit integer, which can be overflowed using a carefully crafted file. Now the attacker can can set the buffer for symbols to a much smaller value. 9. Making a long story short, this allows overwriting heap memory, setting arbitrary values in the objects used in the JBIG2 logic. 10. The JBIG2 logic uses AND, OR, XOR and XNOR operations when iterating through these objects (to apply the 'diff' on glyphs). The attacker can craft a file that strings together these logic operations so that it basically forms a software logic circuit. 11. So this exploit basically emulates a computer architecture inside an image codec, which can be used to operate on arbitrary memory! Is that right? If so, this is mind-blowing.
  - ironSkillet 5y ago
    If a hack can be called beautiful, this fits the bill. How do people come up with these?
    - miohtama 5y ago
      Being trained in Israeli intelligence corps, moving to civilian life, retaining your spook skills and being funded by Saudi billionaire prince who hates human right activism and criticism.
      - 5y ago
deleted 5y ago
[deleted]
anothernewdude 5y ago
As of windows 7, the parsing of some font files was handled inside the Windows Kernel.
livinglist 5y ago
hi

pakwa 5y ago

Tech has essentially created this problem. Can’t tech fix it?

aikinai 5y ago
Construction has essentially created the problem of potholes. Can they fix it?
- rmbyrro 5y ago
  Good analogy. Question here is: can they fix potholes faster than new ones show up? Seems answer is no for tech. And construction, these days.
  - arunc 5y ago
    It takes an expert to know that there's vulnerability. Whereas construction engineer can "see" the pothole and so they can fix it. Software engineer has to "know from exploits" that there's a vulnerability so they can fix it. It's not far away when OS are written in memory safe languages like Rust.
    - pjmlp 5y ago
      You mean far away like 1961? https://en.m.wikipedia.org/wiki/Burroughs_large_systems https://en.m.wikipedia.org/wiki/Burroughs_large_systems Nowadays still being sold to governments that care about security. https://itupdate.com.au/page/unisys-clearpath-mcp-unsurpassed-security https://itupdate.com.au/page/unisys-clearpath-mcp-unsurpasse... https://www.unisys.com/ms/client-education/course-catalog/clearpath-mcp https://www.unisys.com/ms/client-education/course-catalog/cl... Or maybe 1983? https://en.m.wikipedia.org/wiki/Rational_R1000 https://en.m.wikipedia.org/wiki/Rational_R1000 Maybe 1982, https://news.ycombinator.com/item?id=22375449 https://news.ycombinator.com/item?id=22375449 Plenty of examples (those are a tiny snippet) on how safe OSes should be written, until there is liability the easiest way will always win.
    - rmbyrro 5y ago

bredren 5y ago

>Fearful that her iPhone had been hacked as well, al-Hathloul contacted the Canadian privacy rights group Citizen Lab and asked them to probe her device for evidence I wonder if she had a preexisting relationship w the group or how she was connected with them. Presumably her work included a network of journalist protection orgs. But had she had a device “probed” like this before? It’s such an important point of contact I wonder about the details of this.

walrus01 5y ago
Loujain has strong connections in the metro Vancouver BC area. People working in network security/infosec and associated with UBC IT are well aware of Citizen Lab and possibly put her in contact with them. Citizen Lab at the University of Toronto is fairly well known throughout the Canadian academic research/computer science/network engineering community.

walrus01 5y ago

Loujain is a University of British Columbia graduate and was a political prisoner: https://www.google.com/search?client=firefox-b-1-d&q=loujain+al-hathloul https://www.google.com/search?client=firefox-b-1-d&q=loujain... https://en.wikipedia.org/wiki/Loujain_al-Hathloul https://en.wikipedia.org/wiki/Loujain_al-Hathloul Let's not forget that the present Saudi regime (MBS) is responsible for luring political opponents/journalists, killing them, and dismembering them with bone saws. https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khashoggi https://en.wikipedia.org/wiki/Assassination_of_Jamal_Khashog...

BeetleB 5y ago
The irony is that he's also the one who forced the country to allow women to drive.
- Synaesthesia 5y ago
  It's just a very minor victory for women's rights and it was a very impractical law anyway. It's still a very oppressive country where being a dissident means getting threatening phone calls from the security agencies. Remember 2011 when there were popular protests all around the Arab world? Well they tried to do one in Saudi as well but the intimidation was so high, that it never got off the ground.
  - newyankee 5y ago
    The entire reason Saudi is so powerful is because of Oil Wealth and its special relationship to US since WW2
  - BeetleB 5y ago
    - svilen_dobrev 5y ago
      wonders of i'net.. you know, there is something called female circumcision. And the society+culture behind it, has been applying it even on women born and living outside it, when they once visited their relatives.. (described in book: Ever Since Adam and Eve: The Evolution of Human Sexuality - Malcolm Potts and Roger Short, 1999)

DethNinja 5y ago

Would compiling image parsers with ASLR and bounds checking prevent these zero-click hacks? I haven’t researched the exploits in detail but it seems to me Apple can develop better protection against such zero-click exploits. At the very least, iMessages shouldn’t preview images from unknown contacts.

jazzyjackson 5y ago
I'm convinced that a bad image parser is apple's backdoor, but I only have my paranoia as proof.
- viktorcode 5y ago
  What Apple stands to gain from a backdoor? It's clear what the cost of risk is, but what is the gain?
  - PickledHotdog 5y ago
    Just spitballing, but market access to China and the like?
    - user_7832 5y ago
      Why use a backdoor if you have the frontdoor, the walls, the roof.. and the entire server? Censorship, Surveillance and Profits: A Hard Bargain for Apple in China - https://nyti.ms/3oAvIVH https://nyti.ms/3oAvIVH > Apple has largely ceded control to the Chinese government. Chinese state employees physically manage the computers. Apple abandoned the encryption technology it used elsewhere after China would not allow it. And the digital keys that unlock information on those computers are stored in the data centers they’re meant to secure.
a1a106ed5 5y ago
The image parser uses ASLR. The turing complete NAND computing device they describe in the article was used to do computations on the pointers leaked with the infoleak, resulting in an ASLR bypass. Brilliant.

fartcannon 5y ago

Isn't the walled garden and locked down OS/hardware supposed to prevent these things?

nine_k 5y ago
Only provably correct software would prevent such things. A walled garden could make it simpler to enforce that only software proved correct can be installed, but without the proof, it does not guarantee much,,only makes certain things less probable. Writing provably correct software us now a rare and expensive engineering feat. Most consumer OSes have nothing of thus sort, sadly. And I mean just the limited set of system software, not third-party installable apps, of course.
- d0mine 5y ago
  "Beware of bugs in the above code; I have only proved it correct, not tried it." https://www-cs-faculty.stanford.edu/~knuth/faq.html https://www-cs-faculty.stanford.edu/~knuth/faq.html
- fulafel 5y ago
  Formal correctness proofs are both unattainable and insufficient. We don't know how to do it at the required scale, and it doesn't save us from flawed formal specifications, we'll have the bugs in the formal requirements instead of in the code. There are more cost efficient and proven ways to effectively address these kinds of vulnerabilities, like limiting complexity, using programming language features to eliminate classes of bugs, using other verifiable engineering disciplines, and compartmentalisation. Proofs also have their place locally in verifying small components. But making this commercially viable would large numbers of customers and users who are willing to make big compromises in functionality, features, third party apps etc.
  - nine_k 5y ago
    Limiting complexity is often not an option, because the complexity is of the subject area. Things like image format decoders are easiest to produce formal analysis and proofs for. It's sadly still too expensive and slow to produce. Fuzzing as a mandatory testing step could be useful in some cases. I agree about bugs in specifications though :(

aborsy 5y ago

Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?

zionic 5y ago
Because Animoji was more important. Incase anyone was wondering, yes the amount they spent on that particular feature vastly eclipsed their spend on the kinds of teams that could have caught this.
- saagarjha 5y ago
  I really don't get why you would make a statement like this with such confidence. Apple employees hundreds of people on its security teams and pays each of those engineers fairly well. Animoji is a spin off of their Face ID work, which you could arguably call a security feature in its own right but not strictly a red team.
- AussieWog93 5y ago
  To be fair, Animoji probably sell more phones that protection against State-backed adversaries.
- anaganisk 5y ago
  I find it very hard to believe that the richest company in the world, didn’t have enough money to implement Animoji. And they had to eclipse the budget of security team. Could you provide a source for that?
  - mrep 5y ago
    3rd richest if we are going by profits: https://companiesmarketcap.com/most-profitable-companies/ https://companiesmarketcap.com/most-profitable-companies/
    - anaganisk 5y ago

deleted 5y ago

[deleted]

KKKKkkkk1 5y ago

How come the company that made Pegasus is being sanctioned, but the government that used Pegasus to abduct, kill, and then dismember a dissident - isn't?

webkike 5y ago
Because it’s easier?
zakary 5y ago
The simple answer is that to the people that really matter in decisions like that, those in the intelligence and the state departments of countries like the US, software like Pegasus is an important tool in staying ahead of adversaries. And in order to do its job effectively, it’s best if people don’t know about it. Pegasus may be sanctioned, but another company will make a product to takes its place and the game will start again. A similar argument can be made in favour of keeping the Saudis on side; they are useful for what they can do to help attain the foreign policy goals of the US and it’s allies. Those goals are mostly related to making sure the US continues to have access to all the stuff they need to stay on top of the geopolitical tree
- GekkePrutser 5y ago
  How does it help to stay ahead of adversaries when they're selling it to basically everyone including most adversaries?
  - tapas73 5y ago
    you can sell basic version. Leaving premium to your self.
trasz 5y ago
That government is an important US ally.
- marcosdumay 5y ago

Arrezz 5y ago

I have always wondered about how exploits like these manage to stay secret for any length of time? I would imagine that leaking such a thing could he very rewarding but I guess there is too much risk involved.

bagacrap 5y ago

I guess enemies of a state should be using feature phones?

ectopod 5y ago
Feature phones are notorious for having terrible security. Most of them can be quietly hacked with an SMS from the carrier. And they support MMS so you're not immune to image parsing bugs either.

pkphilip 5y ago

This Saudi women's activist - Loujain al-Hathloul, is one of the most courageous people I have ever heard of. She was arrested for driving a car in 2018 and remained in prison till 2021 and she was subjected to severe torture and abuse. https://en.wikipedia.org/wiki/Loujain_al-Hathloul https://en.wikipedia.org/wiki/Loujain_al-Hathloul Her husband is another exceptionally courageous person and it is inspiring to see their cheer and steadfast courage despite all the hardship they face. It is sad to see Saudi Arabia continuing to harass this couple.