23 ms·
‘Zero-click’ hacks are growing in popularity
- stunt 5y agoAs a software engineer I still don't understand how this is even possible. What kind of logic behind a URL preview can bypass everything? I think companies like NSO Group are just finding backdoors not software bugs.
- dpacmittal 5y agoAFAIK, they are exploiting vulnerabilities in image and video decoders
- tebbers 5y agoYep it’s usually that or body parsers, that sort of thing.
- strstr 5y agoFrom what I recall the stagefright vulnerability might be a good example.
- ajconway 5y agoThere are software engineers who sometimes write code that’s not perfect.
- xvector 5y agoSo frustrated with the slow adoption/transition to memory-safe languages.
- petalmind 5y agoTrue. Perl exists for more than 30 years already.
- giantrobot 5y agoAda throws out its back with a chuckle.
- sva_ 5y agoThis one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. > The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.
- gfd 5y agoHoly shit
- d0mine 5y agoIt is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.
- Gigachad 5y agoIt doesn’t seem all that unrealistic. These companies buy and research every single bug they can get for iOS and eventually you have enough that you can glue them together in to full exploits. When you have enough funding, this stuff becomes realistic.
- scoopertrooper 5y agoNever underestimate the extremes computer science types will go to in order to prove a point.
- jeroen 5y agoFrom the article: > In December, security researchers at Google analyzed a zero-click exploit they said was developed by NSO Group, which could be used to break into an iPhone by sending someone a fake GIF image through iMessage. And the thread from back then: https://news.ycombinator.com/item?id=29568625 https://news.ycombinator.com/item?id=29568625 That Project Zero blog post lays out the details under the "One weird trick" header.
- bawolff 5y agoURL preview is a pretty big attack surface, you have to fetch over network using complex protocols, parse the result for a variety of formats, and then render it.
- 55555 5y agoRight. Showing an “image preview” for myriad file types means executing them, essentially, and perhaps on buggy code.
- phendrenad2 5y agoI like how all of the replies to this are basically "No they exploited things that were already there". Yeah, and the things that were already there were written by..? Robots? Monkeys? Oh, employees. Got it. rolls eyes I think it's completely reasonable to assume that any OS vendor has enemy spies working for them. How could they not?
- xyzzy123 5y ago"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.
- bilbo0s 5y agoApple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast majority of us have neither the expertise, nor the time, to develop 100% secure code. The best most of us conscientious types can do is to provide comprehensive monitoring, so that a user can use those tools to know if and when something is amiss.
- formerly_proven 5y ago> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
- antihero 5y agoIs there a way to rescind said permissions?
- saagarjha 5y agoShort of not using those apps, no.
- bilbo0s 5y agoAgain, from the perspective of a cyber security expert, all that is great! Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there. Here's the thing though, it's not. That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to the app devs have to adopt a security mindset. Users should not download that free app that lets you see what you would look like as your favorite French pastry. They should not click on the link in that sms they got from that strange phone number. They should be careful about giving out their phone number. Give everyone your gmail google phone number instead and let them send texts to that. Then check those texts on your gmail google phone if you're a high profile target. (Or even just a guy/gal who has a few people out there who really don't like them.) Keep a buffer between the world and your phone. Etc etc etc. Devs want access to the file system. Awesome, but they'd better make sure in using that filesystem they are not inadvertently allowing users to take any actions deleterious to the system. Devs want access to the GPU. Again, no problem. But you'd better know how to write secure GPU code. There is no way a browser, or .NET, or Python or an OS can provide you access to a GPU "safely". If they give you the gun, they expect you will use it responsibly. Browsers and other platform providers should also act responsibly. I understand developers want features. At the same time, is it responsible to hand out access to these features without some kind of plan to keep irresponsible devs from compromising security at scale? Sometimes there just is no way to do that, and I understand. (Access to the GPU is an example. Devs just have to know what they're doing.) But sometimes it is possible to do things in a more secure fashion, or to just wait on delivering that feature altogether. Point is, for a secure environment, everyone has to play their part. There are so many of these 0-clicks and 0-days out there in the wild. Everyone wants to make a better environment. Well, I'm not seeing how that happens without getting everyone's cooperation. Or, at a minimum, getting everyone to be a bit more careful with their behaviors.
- b112 5y agoZero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing history, all of it, no matter what language, no matter how careful, there is always a vulnerability to be had. Thinking about software, and security any other way, is an immediate fail. Arguing the contrary, is arguing that the endless litany of endless security updates, for the stuff discovered, doesn't exist. And those updates oyly cover stuff discovered. There are endless zero days right now, being exploited in the wild, without patches, of which we are unaware. We're seen vulnerabilities on every kernel, in mainline software, on every platform, sitting for years too. And you know those are discovered by black hats, and used for a long time before being found out by the rest of the community. Humans cannot write safe software. Ever. No matter what. Get over it. Only detailed, targeted monitoring can help you detect intrusion attempts, expose as little as possible, keep updated, and do your best.
- Grimburger 5y ago> safe code is impossible > Humans cannot write safe software. Ever. No matter what. Formally proven code does what it says on the box? Do we have different definitions of safe perhaps?
- speedgoose 5y agoThe proof may be valid but the implementation may have a mistake, or the compiler, or the operating system, or the hardware.
- AussieWog93 5y agoOr if it dynamically loads anything that isn't formally proved.
- mh7 5y agoOne can be fundamentally mistaken about what "it says on the box" See WPA2/KRACK for example. It becomes an infinite recursion of "how do we know the proof of the proof of the..." is what we actually want?
- A4ET8a8uTh0 5y agoInteresting. Would a whitelist approach have prevented this ( no random person sending you a gif )?
- allisdust 5y agoIt's high time governments and mega corps fund projects that rewrite all media decoding libraries in pure Rust (or some managed language is performance is not a concern). People keep saying RIR is some how pointless but the reality is that its impossible to keep ahead of those vulnerabilities that aren't found yet.
- deleted 5y ago[deleted]
- mathverse 5y agoGrsecurity for iOS/Android would stop them.
- fsflover 5y agoQubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files https://www.qubes-os.org/doc/config-files. I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/ https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/.
- bawolff 5y ago> it doesn't show non-ASCI symbols in window titles in dom0: Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.
- deleted 5y ago[deleted]
- formerly_proven 5y agoThere have been many exploits related to Unicode text rendering.
- foxfluff 5y ago> Was there a zero day in the font renderer? As far as I'm concerned, freetype is another spelling for CVE. There have been multiple high impact vulns. Though it usually seems to require crafted fonts, so I wouldn't be too concerned about window titles using system fonts. Web fonts on the other hand.. disable 'em.
- bouke 5y agoNot supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.
- Proven 5y ago
- 5y ago
- gfd 5y agoWhy aren't these used to steal cryptocurrencies? According to the article you can buy a similar exploit for just $1-2.5 million. Considering the amount of money floating around that space, that it hasn't happened yet is surprising to me (or maybe I just don't pay attention to people who own crypto and are public about it, maybe they do get hit by zero-days all the time?).
- bannedbybros 5y ago
- deleted 5y ago[deleted]
- markus_zhang 5y agoJust use dumb phones. Maybe one old smartphone purely for business to minimize personal information leak.
- throwaway48375 5y agodumb phones have their own problems
- rasz 5y agoDumb phones still had Bluetooth https://en.wikipedia.org/wiki/Bluebugging https://en.wikipedia.org/wiki/Bluebugging
- dagmx 5y agoDumb phones still had security issues and usually had no way to update the software or firmware
- anthk 5y agoRust won't be the miracle stopping this. Porting unveil/pledge to all OSes will.
- foxfluff 5y agoThere's no silver bullet. Pledge on a complex application that does too many things [requests too many permissions] doesn't help much. IMO complexity and churn remain the biggest problems but people are not willing to engage it. There's always at least one legitimate use case for some faddy trendy new feature, always a reason for more complexity, fuck anyone who doesn't want it. And so you get a massive body of constantly changing code that auditors can't keep on top of. What would it be like if your chat app was max 3000 lines of code and received no more than a handful of small patches per year since 2008? You could audit that in an evening or two and be reasonably confident in its security, and you could also be reasonably confident that it hasn't grown a bunch of new vulns in the next three releases, and you could quickly audit it again to be sure. Alas, practically nobody takes you seriously if you advocate for simplicity. Usually it's the opposite; I tend to get attacked if I suggest that a program/system might be too complex.
- saagarjha 5y agoAre you familiar with how sandboxing works on iOS?
- xavxav 5y agoNot to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional. We truly need to work more towards eliminating every memory unsafe language in use today, until then we're fighting a forest fire with a bucket of water.
- chromanoid 5y agoFollowing this idea, using a memory managed language like Go, Java or C# should also prevent most security issues (at least in non-core systems). Somehow I don't think this would work.
- tester756 5y agoWhat makes you think so?
- chromanoid 5y agoWhile I think garbage collected languages produce programs that are more safe, I also think they are often enablers for new classes of security issues. For example ysoserial, log4j etc.
- tester756 5y ago(This is genuine question) Is log4j's bug actually unique to Java/C#/gc-based languages?
- 41b696ef1113 5y ago>Is log4j's bug actually unique to Java/C#/gc-based languages? Not to my understanding. It would be possible in any language with or without a GC.
- rosndo 5y agoYears ago we used to regularly have worms that’d infect millions of computers without any clicks at all. The truth is that “Zero-Click” hacks are becoming increasingly rare. But of course everything is new for journos unfamiliar with the field.
- deleted 5y ago[deleted]
- caoilte 5y agoerrr what? Im struggling to figure out what you might mean here. Are you talking about floppy disk shared worms?
- kro 5y agoI think they talk about worms that spread by infecting other devices in the local network using RCEs in net-services like rdp/smb/.. That or maybe drive-by downloads / java/activeX code execution, which have become more rare
- maxmouchet 5y agohttps://en.wikipedia.org/wiki/Blaster_(computer_worm) https://en.wikipedia.org/wiki/Blaster_(computer_worm)
- toredash 5y agohttps://en.m.wikipedia.org/wiki/Melissa_(computer_virus) https://en.m.wikipedia.org/wiki/Melissa_(computer_virus) For instance
- efdee 5y agoMaybe Code Red <https://en.wikipedia.org/wiki/Code_Red_(computer_worm) https://en.wikipedia.org/wiki/Code_Red_(computer_worm)>, Conficker <https://en.wikipedia.org/wiki/Conficker https://en.wikipedia.org/wiki/Conficker> or Blaster <https://en.wikipedia.org/wiki/Blaster_(computer_worm) https://en.wikipedia.org/wiki/Blaster_(computer_worm)>.
- pyman 5y agoThere are no laws in Israel preventing companies like NSO from building and selling zero-day and zero-click exploits? Without proper regulations the Israeli government is creating a sophisticated and dangerous platform for these kind of illegal attacks.
- markdown 5y agoIsrael are arguably the worlds biggest beneficiary of the arms trade. Why would they have anything against selling weapons?
- recuter 5y agoOnly in your active imagination. In reality it is roughly in 8th place with 3% marketshare. https://www.weforum.org/agenda/2019/03/5-charts-that-reveal-the-state-of-the-global-arms-trade/ https://www.weforum.org/agenda/2019/03/5-charts-that-reveal-...
- lupire 5y agoNow try that analysis per capita.
- kevin_thibedeau 5y agoThat doesn't include the free weapons the US gives them with their annual stipend.
- markdown 5y agoAccording to that link, it's #1 per capita. Add to this the enormous annual gifts from the US, and you'll find that I'm correct. Per capita, they're the biggest beneficiaries of the arms trade, and the worlds largest arms dealer. I don't blame you for not seeing that though. The propaganda about Israel being in serious danger from stones and home made rockets is quite effective.
- jraby3 5y agoIn the article it states that it’s illegal to sell to over 90 countries. But maybe resellers are getting it to these countries?
- manholio 5y agoI have a Galaxy Tab 3 which was on sale in my area until 2018. It's a perfectly usable device. Samsung refuses to upgrade past Android 7. The last security patch is more than a year old. Mobile security is a huge mess because of planned obsolescence. There should exist no security reasons that force me to junk a device faster than 10 years if the manufacturer is still in business. Regulatory action is required, that should think past the traditional "warranty" periods, removing security support is a remote confiscation of private property.
- smichel17 5y agoSimilar story here. The worst part is that the locked bootloader means that I can't upgrade it myself, either.
- oefrha 5y agoWhat's the evidence that zero-click hacks are growing in popularity? TFA doesn't seem to provide any, and given that in the not so distant past, every other Windows PC was infested with viruses and/or trojans, it's hard to believe device security is on a downward trajectory.
- orbital-decay 5y agoYeah, there was a time when installing Windows XP with an Ethernet cable plugged in was impossible, because the PC would get infected before even finishing the setup, and reboot.
- staticassertion 5y agoYou can just count ITW exploits against Chrome, for example, to see that they're increasing over the last 3 years. I assume the same is true for some other software.
- Hnrobert42 5y agoIt seems one way to stop many of them would be to only access email using a web client.
- upofadown 5y agoText email. HTML email provides access to a vast attack surface on the user's device. Normally webmail clients will cheerfully send along all the HTML. Filtering is a futile game of whack a mole. If you are only doing text email (or some very restricted HTML interpretation) then there is no extra risk in using a local email client. The lack of a HTML interpreter probably means you would be safer than with a webmail client. If you are doing some form of email as a precaution, you still need a secure place to do it. That might not be a typical smart phone.
- aborsy 5y agoWe need a security focused phone. General purpose consumer phones are focused on features; security is not a top priority for the average person. What are the options now?
- phh 5y agoNot sure who is "we" here, but yes I agree, a general purpose customer phone can't be considered secure against state-level hackers, there MUST be tradeoffs. As an example, I consider that a secure phone MUST have boot-time full disk encryption passphrase, which needs to be different from lockscreen. For obvious reasons (which is that the user will tend forget their password), you can't have this even as an option on general purpose phones. That being said. GrapheneOS is IMO a pretty good option wrt security (like they chose to disable JIT, which impacts performance, but supposedly improve security), even though lately their focus is no longer security for business reasons. Architecture-wise, the best smartphone are pinephones/Librem, because of separation of modem (which is in the case of state-actors, an actual danger), and you can force encryption of all communications (it's even possible to do VoLTE encryption CPU-side rather than modem-side), but I think at the moment their OS really lags behind Android when it comes to security.
- xvector 5y ago> even though lately their focus is no longer security for business reasons. Context?
- phh 5y agoTheir latest developments are about making GrapheneOS more usable, not more secure. Like they are working on a camera app, and our integrating Google apps. (Don't mistake me, I totally respect them for what they are doing)
- staticassertion 5y agoI would imagine https://grapheneos.org/ https://grapheneos.org/ is the state of the art.
- 0x008 5y agocan we change this click bait title? both statements are not true. a) zero click hacks have always been popular b) of course there are ways to stop them.
- dariosalvi78 5y agoWhy would anybody work for those companies?
- Arrezz 5y agoI have always wondered if the increasing technical complexity of the world and the bugs it will bring is faster than the efforts of bughunters/security industry. Often times it feels like a losing battle but I would love to see some research on the subject, might be hard to get any solid data however.
- nonrandomstring 5y ago> 'Zero-click' hacks A.K.A. 'Hacks' (as opposed to social engineering)
- stonewareslord 5y agoA one-click hack can still be a hack. Clicking a link should not be able to break out of a sandbox, run arbitrary code, etc and should still be considered a hack. I think both should be considered hacks, but zero click is much scarier, so it makes sense to distinguish them
- newuser94303 5y agoAre there messaging apps on Android that make you more vulnerable?
- obblekk 5y agoWhy don't Apple & Google spend a few billion dollars over a few years to rewrite their (non-crypto) unix stack from scratch? It seems like that would be an enduring competitive advantage, good for their users, and reduce future liabilities. Every programming language can result in bugs, but some are worse/more frequent/harder to solve afterwards than others. Better yet, why wasn't "rebuild commonly used standard libraries" in the US Infrastructure bill last year? The government could pay programmers a lot, and pay whitehat pen-testers a lot (+ per bug discovered) and in a few years of iteration, we'd have incredibly hardened, durable software infrastructure that would benefit us for decades to come, in the public domain.
- joshgachnang 5y agoIsn't Google (allegedly) already doing this with Fuchsia?
- Natsu 5y agoThey've done their own version of a lot of things, but then have open sourced what they can to grow the base of people familiar with that tech who can make things with it. I mean, on some level you can try to make your own custom TempleOS for everything, but that only gets you (possibly) reduced scrutiny and hiring issues simply because nobody knows how to use it. But if you're already a target, the reduced scrutiny is probably a bad thing since the good guys won't point out the bugs to get them fixed.
- Dinux 5y agoFuchsia isn't Unix afaik
- sorry_outta_gas 5y agoThey have always been popular... lol
- dang 5y agoRecent and related: A Saudi woman's iPhone revealed hacking around the world - https://news.ycombinator.com/item?id=30393530 https://news.ycombinator.com/item?id=30393530 - Feb 2022 (158 comments) Before that: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution - https://news.ycombinator.com/item?id=29568625 https://news.ycombinator.com/item?id=29568625 - Dec 2021 (341 comments)