3 ms·

These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyon

by judge2020 5y ago

These exploits are only really an issue for your grandparents and whoever if some large-scale mass hack is happening[^2]. As long as they stay up-to-date, anyone not targeted by nation state actors and not holding millions in cryptocurrency[0] likely has nothing to worry about, as these exploits are better used hacking journalists trying to expose corruption or political opponents running against the incumbent[1]. 0: https://news.ycombinator.com/item?id=30322715 https://news.ycombinator.com/item?id=30322715 1: https://www.seattletimes.com/business/rights-group-verifies-polish-senator-was-hacked-with-spyware/ https://www.seattletimes.com/business/rights-group-verifies-... ^2: For instance, the Coinbase Super bowl ad that was only a bouncing QR code would have been a very interesting way to start WW3 if it were Russia hacking millions upon millions of americans' phones, exfiltrating any potentially sensitive information (company emails, etc) in an instant, and/or destroying the device via some exploit chain that destroys the OS and requires a full firmware factory reset to recover.

IncRnd 5y ago
You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.
- rfoo 5y ago
  Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
  - onion2k 5y ago
    once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
    - rvnx 5y ago
      Yes, probably the backdoors that security companies implement on the phones to exfiltrate and sell data would reveal that.
  - thfuran 5y ago
    I wonder whether even as many as half of android phones are less than, say, six months behind on security updates. They're often quite slow in releasing for any given model, and that's while the phone even gets updates.
  - IncRnd 5y ago
    > Except we don't live in the past decade anymore. You do know that is a terible attitude for a real-world security posture meant to protect non-theoretical people's property and information against actual exploits? > In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. While you may wish for patches to always take care of exploits before any phones are compromised, that's not much more than wishful thinking. You assume that all 0day exploits are both known and fixed immediately. That is 100% false.
- theshrike79 5y ago
  Vulnerabilities on iOS are getting really scarce. People spend truckloads of money finding them and you need to pay twice that for the permission to burn said exploit. That stuff isn't burned on mass hacks on random phone users, it's way too valuable. BUT. There is a small sliver of time between the exploit being used on a high value target and Apple patching the hole. That's the spot where Joe Schmoe should be cautious.
  - bennysomething 5y ago
    You are probably right, but this attack only became visible because it had a bug. How many others are invisible currently? Well that's what I'm asking myself :)
    - theshrike79 5y ago
      A lot, but they're still only used for high-value targets. They're way too valuable to waste on some random person who happens to click a link.
      - ChuckNorris89 5y ago
        That's a bad argument for defense. If it can be used on one random person then it can be used on the hundreds of millions of random persons who use iPhone and Android. And getting even 1% of those massive user bases to click on a link and steal their money or private information, would be incredibly lucrative even for the short period until the patch rolls out, especially for the wealthier iOS userbase as a target. In my EU country, I'm still getting regular spam SMS with links to what I presume is some older Android malware that wrecked havock last year. So, if attackers are still at it, months after a patch was rolled out, it means they must be still getting returns on their "investment".
farfooflux 5y ago
I think it’s very possible to be in the grey zone. For example, I have worked as an activist, and a campaign I led was widely lauded by the mainstream media as being the key factor in a powerful government minister losing. Now, this is a western liberal democracy that probably doesn’t need to buy tools from NSO Group. But still, am I a fair target? Or what about a friend who is a journalist whose articles have recently attracted negative attention from the government of a fairly corrupt, despotic nation. Are they are target? I’m not talking about Snowden or Assange or executives at trillion dollar companies. In my circle I know a bunch of folk who are basically just normal people with jobs, but for whom their job means that someone working for some government somewhere might like to read their texts. How wide is the net? How can we protect ourselves?

IncRnd 5y ago

You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.

rfoo 5y ago
Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
- onion2k 5y ago
  once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
  - rvnx 5y ago
    Yes, probably the backdoors that security companies implement on the phones to exfiltrate and sell data would reveal that.
- thfuran 5y ago
  I wonder whether even as many as half of android phones are less than, say, six months behind on security updates. They're often quite slow in releasing for any given model, and that's while the phone even gets updates.
- IncRnd 5y ago
  > Except we don't live in the past decade anymore. You do know that is a terible attitude for a real-world security posture meant to protect non-theoretical people's property and information against actual exploits? > In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. While you may wish for patches to always take care of exploits before any phones are compromised, that's not much more than wishful thinking. You assume that all 0day exploits are both known and fixed immediately. That is 100% false.
theshrike79 5y ago
Vulnerabilities on iOS are getting really scarce. People spend truckloads of money finding them and you need to pay twice that for the permission to burn said exploit. That stuff isn't burned on mass hacks on random phone users, it's way too valuable. BUT. There is a small sliver of time between the exploit being used on a high value target and Apple patching the hole. That's the spot where Joe Schmoe should be cautious.
- bennysomething 5y ago
  You are probably right, but this attack only became visible because it had a bug. How many others are invisible currently? Well that's what I'm asking myself :)
  - theshrike79 5y ago
    A lot, but they're still only used for high-value targets. They're way too valuable to waste on some random person who happens to click a link.
    - ChuckNorris89 5y ago
      That's a bad argument for defense. If it can be used on one random person then it can be used on the hundreds of millions of random persons who use iPhone and Android. And getting even 1% of those massive user bases to click on a link and steal their money or private information, would be incredibly lucrative even for the short period until the patch rolls out, especially for the wealthier iOS userbase as a target. In my EU country, I'm still getting regular spam SMS with links to what I presume is some older Android malware that wrecked havock last year. So, if attackers are still at it, months after a patch was rolled out, it means they must be still getting returns on their "investment".

farfooflux 5y ago

I think it’s very possible to be in the grey zone. For example, I have worked as an activist, and a campaign I led was widely lauded by the mainstream media as being the key factor in a powerful government minister losing. Now, this is a western liberal democracy that probably doesn’t need to buy tools from NSO Group. But still, am I a fair target? Or what about a friend who is a journalist whose articles have recently attracted negative attention from the government of a fairly corrupt, despotic nation. Are they are target? I’m not talking about Snowden or Assange or executives at trillion dollar companies. In my circle I know a bunch of folk who are basically just normal people with jobs, but for whom their job means that someone working for some government somewhere might like to read their texts. How wide is the net? How can we protect ourselves?