3 ms·
This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/
by sva_ 5y ago
This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
Really worth the read, it was quite eye-opening.
> JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
> The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.
- gfd 5y agoHoly shit
- d0mine 5y agoIt is so improbable and complicated that it is easier to believe that it is just a parallel construction to hide the fact backdoors are used.
- Gigachad 5y agoIt doesn’t seem all that unrealistic. These companies buy and research every single bug they can get for iOS and eventually you have enough that you can glue them together in to full exploits. When you have enough funding, this stuff becomes realistic.
- scoopertrooper 5y agoNever underestimate the extremes computer science types will go to in order to prove a point.
- axiosgunnar 5y agoI believe this line of thought has not been given enough attention recently.
- sva_ 5y agoI'm not sure if you're being sarcastic, but for parallel construction they'd still need to find this exploit. Are you saying Google Project Zero is out there to hide the traces of backdoors?
- ugl 5y agoTerrifyingly smart folks there.
- 55555 5y agoThis is an impressive example, but is it really a common example? I think typical examples are much more mundane and possible only due to poorly written code and memory overflow exploits, etc, no?
- sva_ 5y agoDifficult to say. I'd keep in mind that NSO Group is a private company, with limited funding and limited privileges. There are also government actors out there with secret services. Who knows what they have been up to recently.
- CyberRage 5y agodefinitely rare and highly targeted exploits. Exploits for mobile phones in the "open market" are in the millions of dollars, for a single working exploit. But the incentive is growing as these devices are becoming the center of our lives.
- Digit-Al 5y agoYou have to admire the ingenuity. Just wish it was being put to better use. I can't even fathom the amount of effort required to, basically, create an entire scripting language running in an environment like that.