6 ms·

"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.

bilbo0s 5y ago
Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast majority of us have neither the expertise, nor the time, to develop 100% secure code. The best most of us conscientious types can do is to provide comprehensive monitoring, so that a user can use those tools to know if and when something is amiss.
- formerly_proven 5y ago
  > And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
  - antihero 5y ago
    Is there a way to rescind said permissions?
    - saagarjha 5y ago
      Short of not using those apps, no.
  - bilbo0s 5y ago
    Again, from the perspective of a cyber security expert, all that is great! Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there. Here's the thing though, it's not. That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to the app devs have to adopt a security mindset. Users should not download that free app that lets you see what you would look like as your favorite French pastry. They should not click on the link in that sms they got from that strange phone number. They should be careful about giving out their phone number. Give everyone your gmail google phone number instead and let them send texts to that. Then check those texts on your gmail google phone if you're a high profile target. (Or even just a guy/gal who has a few people out there who really don't like them.) Keep a buffer between the world and your phone. Etc etc etc. Devs want access to the file system. Awesome, but they'd better make sure in using that filesystem they are not inadvertently allowing users to take any actions deleterious to the system. Devs want access to the GPU. Again, no problem. But you'd better know how to write secure GPU code. There is no way a browser, or .NET, or Python or an OS can provide you access to a GPU "safely". If they give you the gun, they expect you will use it responsibly. Browsers and other platform providers should also act responsibly. I understand developers want features. At the same time, is it responsible to hand out access to these features without some kind of plan to keep irresponsible devs from compromising security at scale? Sometimes there just is no way to do that, and I understand. (Access to the GPU is an example. Devs just have to know what they're doing.) But sometimes it is possible to do things in a more secure fashion, or to just wait on delivering that feature altogether. Point is, for a secure environment, everyone has to play their part. There are so many of these 0-clicks and 0-days out there in the wild. Everyone wants to make a better environment. Well, I'm not seeing how that happens without getting everyone's cooperation. Or, at a minimum, getting everyone to be a bit more careful with their behaviors.
    - saagarjha 5y ago
      Do you have concrete examples of how a developer could, say, write secure code to run on the GPU?
  - ec109685 5y ago
    What special permissions were used to enable the attack? AFAIK, the hacker broke out of the sandbox in addition to rooting iMessage. Also, the surface area available to a sandbox is too large. Firecracker like VM isolation is required for safety, which Apple seems to be moving towards when it comes to parsing from their apps at least.
- xyzzy123 5y ago
  That's a defeatist position. 99% of the problem is just wanting to not have to rewrite a hundred parsers in memory-safe languages. It's just economics and engineering. They don't have to change everyone's minds or fix the world. They'd need to invest a lot but so far nobody really thinks it's worth it.
  - CyberRage 5y ago
    People try to address that will simpler solutions that wouldn't break backwards compatibility or require a full re-write. Isolation, mitigation and prevention of exploitation is common.
- simion314 5y ago
  >People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before Rust was born, the issue was that either the languages were too slow, were not cross platform or had weird license or were "garbage". If this gaints like Apple, Google, Facebook would contribute on rewriting or prove that the core libraries they use are correct then things would improve, but how would they continue to increase their obscene profits ?
  - delusional 5y ago
    "If we could just have one more layer of abstraction, THEN we would be secure". You'll end up making a standard library so big that it will never be secure. And even more portantly, you'll strangle innovation by disallowing improvements to the standard library.
    - simion314 5y ago
      I would not make it illegal for cool devs to invent their own language or libraries. I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing, you could rewrite your own in CoolLang using QunatumReactiveAntiFunctionalPatterns. It is your choice if you use a proven correct zip library or you use a different one written by some stranger in a weekend In CoolLang. Something like JVM or.Net would be part of the solution because you could pacify developers because they can use their darling language but target the same platform as the others. We still need true engineers to create an OS and Standard library from the ground up, designed for security and not chaotically evolved.
      - giantrobot 5y ago
        > I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing Wanting those things is fine but delivering those things is extremely difficult. JSON/XML/Zip have so many weird edge cases it's maybe impossible to write parsers that are complete to the spec yet also truly secure. XML and Zip bombs aren't explicit features of either format but they're side effects of not being explicitly forbidden. You're also want "good" parsers without specifying in which dimension you want them to be "good". You can have a complete parser that's reasonably secure but then pay for that with CPU cycles and memory. You can have a small and fast parser that's likely incomplete or has exploitable holes.
jka 5y ago
Or perhaps one step further (albeit verging into conspiracy theory territory): they intentionally push ahead with known-flawed approaches, projects and engineering practices because it's profitable and there's generally a net benefit to them in being more-aware and more-in-control of the vulnerabilities within that ecosystem than anyone else could be. (instead of taking the time to wait for research results, best practices, security reviews and privacy concerns up-front at design-time, and even -- shock -- perhaps deciding not to build some societally risky products in the first place)
- tptacek 5y ago
  Apple spends more on security than all but 2 other industry firms (they may spend more than those 2 as well), and has a comparable computing footprint to those firms. This is a facile complaint.
  - jka 5y ago
    My comment may have been facile and poorly-argued, sure, but if consumer devices are being sold that can be remotely exploited without user interaction during something as commonplace as rendering images.. surely it's worth considering the potential for structural improvements in industry? Perhaps the associated billions of dollars of spending is indeed the answer, and will translate into measurable improvements. If so, very well. Perhaps there are Conway-style architectural issues at hand here as well, though. Can disparate teams working on (a large number of) proprietary interconnected products and features reliably produce secure results? It seems wasteful that similarly-functioning tools -- like messaging apps -- are continuously built and rebuilt and yet the same old issues (generally exacerbated by increasing web scale) mysteriously re-appear time and again.
    - tptacek 5y ago
      This isn't a facile argument. I might disagree with it --- I think things are more complicated than they seem --- but I can't call it facile.
CyberRage 5y ago
Yes but practically this isn't viable. Nothing is impossible unless it disobeys the laws of physics(which are also limited to what we currently know) It would be equivalent to saying, well it isn't economic enough for energy companies to simply create nuclear fusion reactors... Some things are just extremely hard and there's no obvious answer even if you had "unlimited" funds.
falsenapkin 5y ago
It's baffling that they won't at least disable previews for senders not in your contacts. Ideally they would provide a way to block certain types of senders outright. I will NEVER want to receive an iMessage from an unknown email address, but that's where all of the spam crap comes from. Recently I was on my phone when I received an email address iMessage and the toast showed an absolutely insane link, when I opened iMessage (not even that conversation) to go delete the thread my phone screen went blank quickly 2 or 3 times in a row, something I've never seen before. I deleted the thread and turned the thing off.
- leoqa 5y ago
  Sounds like it was triggering a crash or running 70,000 logic gates?
- abecedarius 5y ago
  Does it solve this to set a different app as your default app for texts? (Hopefully a more secure app.)
  - falsenapkin 5y ago
    I want to trust Apple more than a random 3rd party app in general but regardless I don't think you have an option for alternate SMS on iOS. Anyway the problem here, I think, is that you can somehow send an iMessage (not SMS?) via an account that is backed by an email address instead of a phone number. So even if texts/SMS could have an alternate app, iMessage would still be accepting messages from bad accounts.
    - abecedarius 5y ago
      "Apple does not allow other apps to replace the default SMS/messaging app." https://support.signal.org/hc/en-us/articles/360007321171-Can-I-send-SMS-MMS-with-Signal-#ios_sms https://support.signal.org/hc/en-us/articles/360007321171-Ca... Oops, I must've been remembering Android. Well, it's one way Apple could fix this unconscionably lasting security hole.
BiteCode_dev 5y ago
More likely: our gov gag ordered us to keep up.
deleted 5y ago
[deleted]

bilbo0s 5y ago

Apple, or Microsoft, or Samsung, or Ubuntu, or Google, or whoever can do all the system level bulletproofing they want. People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. It would take a sea change in the mindsets of software engineers globally to centralize the software development process around a security mindset. That's not going to happen unfortunately. The vast majority of us have neither the expertise, nor the time, to develop 100% secure code. The best most of us conscientious types can do is to provide comprehensive monitoring, so that a user can use those tools to know if and when something is amiss.

formerly_proven 5y ago
> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
- antihero 5y ago
  Is there a way to rescind said permissions?
  - saagarjha 5y ago
    Short of not using those apps, no.
- bilbo0s 5y ago
  Again, from the perspective of a cyber security expert, all that is great! Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there. Here's the thing though, it's not. That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to the app devs have to adopt a security mindset. Users should not download that free app that lets you see what you would look like as your favorite French pastry. They should not click on the link in that sms they got from that strange phone number. They should be careful about giving out their phone number. Give everyone your gmail google phone number instead and let them send texts to that. Then check those texts on your gmail google phone if you're a high profile target. (Or even just a guy/gal who has a few people out there who really don't like them.) Keep a buffer between the world and your phone. Etc etc etc. Devs want access to the file system. Awesome, but they'd better make sure in using that filesystem they are not inadvertently allowing users to take any actions deleterious to the system. Devs want access to the GPU. Again, no problem. But you'd better know how to write secure GPU code. There is no way a browser, or .NET, or Python or an OS can provide you access to a GPU "safely". If they give you the gun, they expect you will use it responsibly. Browsers and other platform providers should also act responsibly. I understand developers want features. At the same time, is it responsible to hand out access to these features without some kind of plan to keep irresponsible devs from compromising security at scale? Sometimes there just is no way to do that, and I understand. (Access to the GPU is an example. Devs just have to know what they're doing.) But sometimes it is possible to do things in a more secure fashion, or to just wait on delivering that feature altogether. Point is, for a secure environment, everyone has to play their part. There are so many of these 0-clicks and 0-days out there in the wild. Everyone wants to make a better environment. Well, I'm not seeing how that happens without getting everyone's cooperation. Or, at a minimum, getting everyone to be a bit more careful with their behaviors.
  - saagarjha 5y ago
    Do you have concrete examples of how a developer could, say, write secure code to run on the GPU?
- ec109685 5y ago
  What special permissions were used to enable the attack? AFAIK, the hacker broke out of the sandbox in addition to rooting iMessage. Also, the surface area available to a sandbox is too large. Firecracker like VM isolation is required for safety, which Apple seems to be moving towards when it comes to parsing from their apps at least.
xyzzy123 5y ago
That's a defeatist position. 99% of the problem is just wanting to not have to rewrite a hundred parsers in memory-safe languages. It's just economics and engineering. They don't have to change everyone's minds or fix the world. They'd need to invest a lot but so far nobody really thinks it's worth it.
- CyberRage 5y ago
  People try to address that will simpler solutions that wouldn't break backwards compatibility or require a full re-write. Isolation, mitigation and prevention of exploitation is common.
simion314 5y ago
>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before Rust was born, the issue was that either the languages were too slow, were not cross platform or had weird license or were "garbage". If this gaints like Apple, Google, Facebook would contribute on rewriting or prove that the core libraries they use are correct then things would improve, but how would they continue to increase their obscene profits ?
- delusional 5y ago
  "If we could just have one more layer of abstraction, THEN we would be secure". You'll end up making a standard library so big that it will never be secure. And even more portantly, you'll strangle innovation by disallowing improvements to the standard library.
  - simion314 5y ago
    I would not make it illegal for cool devs to invent their own language or libraries. I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing, you could rewrite your own in CoolLang using QunatumReactiveAntiFunctionalPatterns. It is your choice if you use a proven correct zip library or you use a different one written by some stranger in a weekend In CoolLang. Something like JVM or.Net would be part of the solution because you could pacify developers because they can use their darling language but target the same platform as the others. We still need true engineers to create an OS and Standard library from the ground up, designed for security and not chaotically evolved.
    - giantrobot 5y ago
      > I want a good default for string manipulation,http, file manipulation, json/xml/zip and other format parsing Wanting those things is fine but delivering those things is extremely difficult. JSON/XML/Zip have so many weird edge cases it's maybe impossible to write parsers that are complete to the spec yet also truly secure. XML and Zip bombs aren't explicit features of either format but they're side effects of not being explicitly forbidden. You're also want "good" parsers without specifying in which dimension you want them to be "good". You can have a complete parser that's reasonably secure but then pay for that with CPU cycles and memory. You can have a small and fast parser that's likely incomplete or has exploitable holes.

jka 5y ago

Or perhaps one step further (albeit verging into conspiracy theory territory): they intentionally push ahead with known-flawed approaches, projects and engineering practices because it's profitable and there's generally a net benefit to them in being more-aware and more-in-control of the vulnerabilities within that ecosystem than anyone else could be. (instead of taking the time to wait for research results, best practices, security reviews and privacy concerns up-front at design-time, and even -- shock -- perhaps deciding not to build some societally risky products in the first place)

tptacek 5y ago
Apple spends more on security than all but 2 other industry firms (they may spend more than those 2 as well), and has a comparable computing footprint to those firms. This is a facile complaint.
- jka 5y ago
  My comment may have been facile and poorly-argued, sure, but if consumer devices are being sold that can be remotely exploited without user interaction during something as commonplace as rendering images.. surely it's worth considering the potential for structural improvements in industry? Perhaps the associated billions of dollars of spending is indeed the answer, and will translate into measurable improvements. If so, very well. Perhaps there are Conway-style architectural issues at hand here as well, though. Can disparate teams working on (a large number of) proprietary interconnected products and features reliably produce secure results? It seems wasteful that similarly-functioning tools -- like messaging apps -- are continuously built and rebuilt and yet the same old issues (generally exacerbated by increasing web scale) mysteriously re-appear time and again.
  - tptacek 5y ago
    This isn't a facile argument. I might disagree with it --- I think things are more complicated than they seem --- but I can't call it facile.

CyberRage 5y ago

Yes but practically this isn't viable. Nothing is impossible unless it disobeys the laws of physics(which are also limited to what we currently know) It would be equivalent to saying, well it isn't economic enough for energy companies to simply create nuclear fusion reactors... Some things are just extremely hard and there's no obvious answer even if you had "unlimited" funds.

falsenapkin 5y ago

It's baffling that they won't at least disable previews for senders not in your contacts. Ideally they would provide a way to block certain types of senders outright. I will NEVER want to receive an iMessage from an unknown email address, but that's where all of the spam crap comes from. Recently I was on my phone when I received an email address iMessage and the toast showed an absolutely insane link, when I opened iMessage (not even that conversation) to go delete the thread my phone screen went blank quickly 2 or 3 times in a row, something I've never seen before. I deleted the thread and turned the thing off.

leoqa 5y ago
Sounds like it was triggering a crash or running 70,000 logic gates?
abecedarius 5y ago
Does it solve this to set a different app as your default app for texts? (Hopefully a more secure app.)
- falsenapkin 5y ago
  I want to trust Apple more than a random 3rd party app in general but regardless I don't think you have an option for alternate SMS on iOS. Anyway the problem here, I think, is that you can somehow send an iMessage (not SMS?) via an account that is backed by an email address instead of a phone number. So even if texts/SMS could have an alternate app, iMessage would still be accepting messages from bad accounts.
  - abecedarius 5y ago
    "Apple does not allow other apps to replace the default SMS/messaging app." https://support.signal.org/hc/en-us/articles/360007321171-Can-I-send-SMS-MMS-with-Signal-#ios_sms https://support.signal.org/hc/en-us/articles/360007321171-Ca... Oops, I must've been remembering Android. Well, it's one way Apple could fix this unconscionably lasting security hole.

BiteCode_dev 5y ago

More likely: our gov gag ordered us to keep up.

deleted 5y ago

[deleted]