7 ms·

NSO developed 3 new ways to hack iPhones, Citizen Lab says

129 points by lisper 4y ago

meibo 4y ago
It's 2023, and iPhones are still being hacked with the same broken serialization functions that have been breaking iMessage for literal years. This is Apple apps/services, they continue making these mistakes in new code. People are being persecuted with this, is no one there accountable?
- DSingularity 4y ago
  Sometimes I wonder if it’s by design. Israel relies on penetrating everything from iPhones to social media accounts to crush Palestinian resistance and to maintain the authority of the PLO in the west bank by helping it suppress its dissenters. That wouldn’t work if social media and cellular networks were actually secure. That’s not even to mention the obvious advantage of US security apparatus having access to these popular systems.
  - ttul 4y ago
    What incentive for the Apple possibly have to make their phones vulnerable to NSO hacking tools? Apple makes more money than god selling iPhones. The State of Israel’s entire defense budget is about $18B/yr, which is less than Apple’s annual R&D budget. And they have to defend an entire country with that $18B. The idea that Apple is playing ball with the IDF is frankly ludicrous.
    - heavyset_go 4y ago
      The same reason that any giant company plays ball with the US government: sweetheart deals, favorable treatment, preferential contracts, protection of their interests in both domestic and foreign markets, etc. Apple regularly gives up users' private data when the government simply asks them to[1], despite spending billions of dollars on "privacy" marketing. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html
      - sonofhans 4y ago
        Your “when the government asks them to” should read “so that the government doesn’t shut them down.” The two things you mention are not at all comparable. You’re trying to associate them for rhetorical effect, but there’s no analogy here. Thing 1: Apple complies with US law. How do you think it would work if Apple said “Fuck you” to US law enforcement requests? Can you provide examples of other companies that have done this, or are doing this now, and had it work at all? I can’t think of a single US-based tech company that doesn’t cooperate with law enforcement. At least Apple is transparent about it. Thing 2: Apple markets privacy — https://www.apple.com/privacy/ https://www.apple.com/privacy/ They make a bunch of concrete statements, most of which are empirically verifiable. What is wrong with this? Again, can you point to any at-all-similar company that does it better, or more explicitly?
        heavyset_go 4y ago
        Nope, those are not all responses to subpoenas, warrants, court orders, etc. Apple specifically lists the requests they're legally obligated to respond to in one section, and then lists requests they choose to respond to with users' private data in another. That's to say that Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so, as there is with warrants.
        musicale 4y ago
        > Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so I'm having trouble finding this part specifically. Can you point to where that is described, and what some examples are?
        infotogivenm 4y ago
        Yea, definitely citation needed on that. What I have seen OTOH, is Apple go to considerable expense not to comply with broadening LEO requests. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
    - coldtea 4y ago
      "Nice company you've got here. You wouldn't want anything bad to happen to it, right?"
    - bugglebeetle 4y ago
      What do “incentives” have to do with anything in a post-Snowden reality?
  - thenaturalist 4y ago
    This is the biggest jump of whattaboutism I've seen in five years. Jeez, I if I had one wish from a genie some day, it would be to absolutely get rid of the curse that is whattaboutism.
- wepple 4y ago
  You act like it’s trivial to fix. They’ve already sandboxed the parsers (which this exploit appears to bypass, crashing MessagesBlastDoorService) which massively drives the effort up. They also had to bypass pointer authentication. Whilst, yes, you can wonder why it isn’t all rewritten in swift (if it isn’t already), exploits will continue to be found and exploited, forever.
  - tialaramex 4y ago
    It arguably is trivial to fix, if you prioritise fixing this. If you say OK, we want to offer safety first and features are only a nice-to-have, you can make that happen. Apple have as usual decided that nope, some of their features are a must have and if safety has to be sacrificed to get features well, sucks to be you getting exploited. Something like Swift isn't up to it. It's less easy to blow your foot off than if you wrote C++ but necessarily (as a general purpose language) you can do it. But what if we give up generality? Languages like WUFFS give up general purpose programming, solving only a narrow problem but doing so with cast iron safety because they're able to prove the system always has valid state. This is entirely appropriate when (as so often) we didn't really need generality, which means having it is a gift for bad guys. "Lockdown mode" should have begun with stuff that's definitely safe, rather than just arbitrarily picking a smaller set of features in the hope that the smaller surface can be more easily defended.
  - eviks 4y ago
    So how is rewriting it in a safer language not trivial in this example?
    - wepple 4y ago
      Well obviously you can’t just rewrite the particular components used in this exploit chain, as attackers will hit something else next time. So you’re rewriting practically an entire OS stack from scratch, in a different language (one that is ill-suited for low-level operations needed in many parts of an OS) I’d say that’s not trivial?
      - 4y ago
ccooffee 4y ago
> In one encouraging sign, some of the most recent attacks failed against users who had activated Apple’s recently introduced Lockdown Mode, which stops some communications from unknown callers and reduces the number of programs that are automatically invoked. I'd not heard about Apple's "Lockdown Mode" (which applies to both computers and phones). Per a support page[1], there's a lot of small tweaks that reduce convenience of the devices, but it sounds like they will fundamentally still _mostly work_. Is "Lockdown Mode" a well-known thing that I just missed? It feels like Apple has put a target on things like URL previews for malicious actors, while also labeling the defense mechanism as an expert-only tool. [1] https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650
- MuffinFlavored 4y ago
  > Is "Lockdown Mode" a well-known thing that I just missed? https://www.google.com/search?q=apple+lockdown+mode+ios https://www.google.com/search?q=apple+lockdown+mode+ios It's very new. August 2022 is the earliest I see anything, iOS 16 (the current release) It struck me as something designed for people like Jeff Bezos basically lol
deleted 4y ago
[deleted]
naturalpb 4y ago
> In one encouraging sign, some of the most recent attacks failed against users who had activated Apple’s recently introduced Lockdown Mode, which stops some communications from unknown callers and reduces the number of programs that are automatically invoked. I'm a huge fan of the idea of Lockdown Mode and have it enabled on my iPhone and MacBook, but I don't think it has mass adoption or appeal. It certainly needs some tuning before the masses will adopt it. Specifically, people in your Contacts should have the option to be trusted. Right now, FaceTime calls are blocked from them if they are not in your recent calls (an issue for me as I regularly purge my call history) and iMessage content is blocked (Live Photos, documents, etc).
- neom 4y ago
  Well that's good at least, I presume if you're under threat of being targeted by an NSO pwn, you're hopefully running lockdown mode. How crippled does the device feel? Is it usable? The two things you mentioned wouldn't be a problem for me. I've been considering enabling it for a while but wondered how restrictive it will realistically feel.
  - naturalpb 4y ago
    I'd suggest turning it on and seeing if you can live with it. Some issues that I've had: 1.) FaceTime calls from people not in your recent calls will be blocked with a silent notification. Sometimes I don't see it for hours 2.) Incoming iMessages will be stripped of Live Photos and document attachments 3.) Using Starbucks in a browser did not work until I disabled Lockdown Mode in Safari for the domain. Fortunately these exceptions are easy to make and persist I'm not a target for state-sponsored attacks but will generally trade usability for security when reasonable.
    - olliej 4y ago
      Losing Live Photos sounds like a feature to me :) (3) is weird. Conceivably it’s using wasm (I recall many years ago wasm had no interpreter mode, no idea of current state), or webgl (which seems plausibly like something that would be blocked)
heavyset_go 4y ago
For reference, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2]. Android being open source makes it easier for more parties to audit the software they run, and not just groups that are paid handsomely to exploit iOS for state sponsored hacking. [1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ [2] http://zerodium.com/program.html http://zerodium.com/program.html
- realusername 4y ago
  More than open-source, I would say it's also due to the fact that on Android there's no homemade apps with private apis like on iOS. Apple's security model clearly excludes their own apps and that shows on the issues publicly released. Secondly, on Android, very few system components are actually tied to the OS version, and it's getting thinner after every version. On iOS it's the norm.
  - deleted 4y ago
    [deleted]
- marcellus23 4y ago
  Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today. Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". Is this still true today?
  - heavyset_go 4y ago
    The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...
throw0101a 4y ago
Meta: if anyone wants to work at Citizen Lab (Toronto, Canada), they're looking for Manager, Information System Security: * https://citizenlab.ca/2023/03/manager-information-system-security-toronto/ https://citizenlab.ca/2023/03/manager-information-system-sec...
- Jackie4Chan 4y ago
  Would it not be wiser for them to search a candidate rather than ask for one? Or that's how they find out who not to hire?
- pseudo0 4y ago
  > Pay Scale Group & Hiring Zone: PM 3 — Hiring Zone: $82,692 – $96,473 — Broadband Salary Range: $82,692 – $137,819 Ouch. Toronto is one of the most expensive cities in North America. If they really want "expert" level skills across a number of infosec areas, they are going to have a lot of trouble finding a candidate that meets their requirements.
  - throw0101a 4y ago
    CL is affiliated with UToronto, see same job posting at: * https://jobs.utoronto.ca/job/Toronto-Manager%2C-Information-System-Security-ON/568434017/ https://jobs.utoronto.ca/job/Toronto-Manager%2C-Information-... And so uses the same wage schedule as them: * https://people.utoronto.ca/wp-content/uploads/2022/06/PM-Salary-Ranges-July-1-2022.pdf https://people.utoronto.ca/wp-content/uploads/2022/06/PM-Sal... * https://people.utoronto.ca/careers/salary-ranges/ https://people.utoronto.ca/careers/salary-ranges/ > […] they are going to have a lot of trouble finding a candidate that meets their requirements. Depends on whether they're trying to bring in someone international, or just in the local talent pool. You do get some good benefits: supplemental health stuff and a DB pension. I started a new position not too long ago where I got a decent salary bump, but if I was still at my old position I would be semi-tempted to at least would apply to see what the environment is about.
kornhole 4y ago
Can we mitigate these kinds of attacks by using a data only SIM card? If I use some kind of VOIP service for OTA calls and SMS, the calls would be off the baseband.
- TazeTSchnitzel 4y ago
  None of these attacks involved the baseband, they're exploiting bugs in iOS.
wepple 4y ago
https://archive.is/nVs90 https://archive.is/nVs90
EMM_386 4y ago
Honestly, whoever the NSO Group hires must be absolute wizards with some of these hacks. I've read the in-dept writeups on some of the previous ones and they are insane. Combining 5+ seperate problems to finally achieve the goal. I can't imagine what that interview is like. Not that I condone any of this stuff, quite the opposite. But from a programming perspective, it's pretty incredible.
- Hortinstein 4y ago
  The one where they altered a gif to invoke legacy pdf compatibility libraries that was somehow turing complete and used it to bootstrap a VM that performed memory analysis to escape a sandbox was likely the most impressive feat of engineering I have read...ever. I would love to read an entire book about how this was discovered, productized and deployed. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
  - EMM_386 4y ago
    Yep, that one was insane. These have to be ex-employees of national security groups like the NSA, etc. who are already familiar with this type of stuff. The Stuxnet-type employees who understand everything at the deepest levels and can (and will) do anything to make it happen. Top-tier engineering. Just used for nerfarious purposes, despite the PR spin. I'm actually surprised they have a PR person. "Um, nothing to see here!" would be my standard response.
ls612 4y ago
The important takeaway is that the vulns they were using have been fixed in the latest iOS 16 updates, which is a far faster response than the old NSO imessage zeroday which took Apple over a year to figure out.
xony 4y ago
[dead]
tholdem 4y ago
Apple has been kind of forced into the open source model by tools like Corellium[1] and some source code leaks. This means that the black box advantage that iOS has had is no longer as significant. Apple's move with the Security Research Device Program[2] proves this point. They wouldn't be offering it if they didn't think it was a serious problem for them. [1] https://www.corellium.com/ https://www.corellium.com/ [2] https://security.apple.com/research-device/ https://security.apple.com/research-device/

129 points by lisper 4y ago

It's 2023, and iPhones are still being hacked with the same broken serialization functions that have been breaking iMessage for literal years. This is Apple apps/services, they continue making these mistakes in new code. People are being persecuted with this, is no one there accountable?

DSingularity 4y ago
Sometimes I wonder if it’s by design. Israel relies on penetrating everything from iPhones to social media accounts to crush Palestinian resistance and to maintain the authority of the PLO in the west bank by helping it suppress its dissenters. That wouldn’t work if social media and cellular networks were actually secure. That’s not even to mention the obvious advantage of US security apparatus having access to these popular systems.
- ttul 4y ago
  What incentive for the Apple possibly have to make their phones vulnerable to NSO hacking tools? Apple makes more money than god selling iPhones. The State of Israel’s entire defense budget is about $18B/yr, which is less than Apple’s annual R&D budget. And they have to defend an entire country with that $18B. The idea that Apple is playing ball with the IDF is frankly ludicrous.
  - heavyset_go 4y ago
    The same reason that any giant company plays ball with the US government: sweetheart deals, favorable treatment, preferential contracts, protection of their interests in both domestic and foreign markets, etc. Apple regularly gives up users' private data when the government simply asks them to[1], despite spending billions of dollars on "privacy" marketing. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html
    - sonofhans 4y ago
      Your “when the government asks them to” should read “so that the government doesn’t shut them down.” The two things you mention are not at all comparable. You’re trying to associate them for rhetorical effect, but there’s no analogy here. Thing 1: Apple complies with US law. How do you think it would work if Apple said “Fuck you” to US law enforcement requests? Can you provide examples of other companies that have done this, or are doing this now, and had it work at all? I can’t think of a single US-based tech company that doesn’t cooperate with law enforcement. At least Apple is transparent about it. Thing 2: Apple markets privacy — https://www.apple.com/privacy/ https://www.apple.com/privacy/ They make a bunch of concrete statements, most of which are empirically verifiable. What is wrong with this? Again, can you point to any at-all-similar company that does it better, or more explicitly?
      - heavyset_go 4y ago
        Nope, those are not all responses to subpoenas, warrants, court orders, etc. Apple specifically lists the requests they're legally obligated to respond to in one section, and then lists requests they choose to respond to with users' private data in another. That's to say that Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so, as there is with warrants.
        musicale 4y ago
        > Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so I'm having trouble finding this part specifically. Can you point to where that is described, and what some examples are?
        infotogivenm 4y ago
        Yea, definitely citation needed on that. What I have seen OTOH, is Apple go to considerable expense not to comply with broadening LEO requests. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
  - coldtea 4y ago
    "Nice company you've got here. You wouldn't want anything bad to happen to it, right?"
  - bugglebeetle 4y ago
    What do “incentives” have to do with anything in a post-Snowden reality?
- thenaturalist 4y ago
  This is the biggest jump of whattaboutism I've seen in five years. Jeez, I if I had one wish from a genie some day, it would be to absolutely get rid of the curse that is whattaboutism.
wepple 4y ago
You act like it’s trivial to fix. They’ve already sandboxed the parsers (which this exploit appears to bypass, crashing MessagesBlastDoorService) which massively drives the effort up. They also had to bypass pointer authentication. Whilst, yes, you can wonder why it isn’t all rewritten in swift (if it isn’t already), exploits will continue to be found and exploited, forever.
- tialaramex 4y ago
  It arguably is trivial to fix, if you prioritise fixing this. If you say OK, we want to offer safety first and features are only a nice-to-have, you can make that happen. Apple have as usual decided that nope, some of their features are a must have and if safety has to be sacrificed to get features well, sucks to be you getting exploited. Something like Swift isn't up to it. It's less easy to blow your foot off than if you wrote C++ but necessarily (as a general purpose language) you can do it. But what if we give up generality? Languages like WUFFS give up general purpose programming, solving only a narrow problem but doing so with cast iron safety because they're able to prove the system always has valid state. This is entirely appropriate when (as so often) we didn't really need generality, which means having it is a gift for bad guys. "Lockdown mode" should have begun with stuff that's definitely safe, rather than just arbitrarily picking a smaller set of features in the hope that the smaller surface can be more easily defended.
- eviks 4y ago
  So how is rewriting it in a safer language not trivial in this example?
  - wepple 4y ago
    Well obviously you can’t just rewrite the particular components used in this exploit chain, as attackers will hit something else next time. So you’re rewriting practically an entire OS stack from scratch, in a different language (one that is ill-suited for low-level operations needed in many parts of an OS) I’d say that’s not trivial?
    - 4y ago

ccooffee 4y ago

> In one encouraging sign, some of the most recent attacks failed against users who had activated Apple’s recently introduced Lockdown Mode, which stops some communications from unknown callers and reduces the number of programs that are automatically invoked. I'd not heard about Apple's "Lockdown Mode" (which applies to both computers and phones). Per a support page[1], there's a lot of small tweaks that reduce convenience of the devices, but it sounds like they will fundamentally still _mostly work_. Is "Lockdown Mode" a well-known thing that I just missed? It feels like Apple has put a target on things like URL previews for malicious actors, while also labeling the defense mechanism as an expert-only tool. [1] https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650

MuffinFlavored 4y ago
> Is "Lockdown Mode" a well-known thing that I just missed? https://www.google.com/search?q=apple+lockdown+mode+ios https://www.google.com/search?q=apple+lockdown+mode+ios It's very new. August 2022 is the earliest I see anything, iOS 16 (the current release) It struck me as something designed for people like Jeff Bezos basically lol

deleted 4y ago

[deleted]

naturalpb 4y ago

> In one encouraging sign, some of the most recent attacks failed against users who had activated Apple’s recently introduced Lockdown Mode, which stops some communications from unknown callers and reduces the number of programs that are automatically invoked. I'm a huge fan of the idea of Lockdown Mode and have it enabled on my iPhone and MacBook, but I don't think it has mass adoption or appeal. It certainly needs some tuning before the masses will adopt it. Specifically, people in your Contacts should have the option to be trusted. Right now, FaceTime calls are blocked from them if they are not in your recent calls (an issue for me as I regularly purge my call history) and iMessage content is blocked (Live Photos, documents, etc).

neom 4y ago
Well that's good at least, I presume if you're under threat of being targeted by an NSO pwn, you're hopefully running lockdown mode. How crippled does the device feel? Is it usable? The two things you mentioned wouldn't be a problem for me. I've been considering enabling it for a while but wondered how restrictive it will realistically feel.
- naturalpb 4y ago
  I'd suggest turning it on and seeing if you can live with it. Some issues that I've had: 1.) FaceTime calls from people not in your recent calls will be blocked with a silent notification. Sometimes I don't see it for hours 2.) Incoming iMessages will be stripped of Live Photos and document attachments 3.) Using Starbucks in a browser did not work until I disabled Lockdown Mode in Safari for the domain. Fortunately these exceptions are easy to make and persist I'm not a target for state-sponsored attacks but will generally trade usability for security when reasonable.
  - olliej 4y ago
    Losing Live Photos sounds like a feature to me :) (3) is weird. Conceivably it’s using wasm (I recall many years ago wasm had no interpreter mode, no idea of current state), or webgl (which seems plausibly like something that would be blocked)

heavyset_go 4y ago

For reference, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2]. Android being open source makes it easier for more parties to audit the software they run, and not just groups that are paid handsomely to exploit iOS for state sponsored hacking. [1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ https://www.theregister.com/2020/05/14/zerodium_ios_flaws/ [2] http://zerodium.com/program.html http://zerodium.com/program.html

realusername 4y ago
More than open-source, I would say it's also due to the fact that on Android there's no homemade apps with private apis like on iOS. Apple's security model clearly excludes their own apps and that shows on the issues publicly released. Secondly, on Android, very few system components are actually tied to the OS version, and it's getting thinner after every version. On iOS it's the norm.
- deleted 4y ago
  [deleted]
marcellus23 4y ago
Your [1] is 3 years old and has quite a few caveats (temporary situation, non-Zerodium security experts don't quite seem to agree with the decision), and the diagrams in [2] don't seem to show that iOS exploits are any cheaper today. Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". Is this still true today?
- heavyset_go 4y ago
  The Zerodium payout structure has not changed in the 3 years since that article's publication[3]. And that is the way news works. It was news 3 years ago when iOS exploits became cheaper, now it's just how the market is. > Moreover, the reasons given in [1] don't include "Android being open-source make it easier to audit". From Wired[4]: > Shwartz credits Android's increased security partly to its open-source strategy finally paying off. While Apple has kept its operating system so locked down that even benevolent security researchers have difficulty sussing out its bugs—a problem it's tried to solve with a recent expansion and opening up of its bug bounty program—Android's open-source approach has meant more eyes on its code. While that broadness initially led to more bugs, those vulnerabilities have been patched over time, slowly hardening the operating system. "So many vulnerabilities have been patched that the attack surface is decreased dramatically," says Shwartz. [3] https://web.archive.org/web/20201108190905/https://zerodium.com/program https://web.archive.org/web/20201108190905/https://zerodium..... [4] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z...

throw0101a 4y ago

Meta: if anyone wants to work at Citizen Lab (Toronto, Canada), they're looking for Manager, Information System Security: * https://citizenlab.ca/2023/03/manager-information-system-security-toronto/ https://citizenlab.ca/2023/03/manager-information-system-sec...

Jackie4Chan 4y ago
Would it not be wiser for them to search a candidate rather than ask for one? Or that's how they find out who not to hire?
pseudo0 4y ago
> Pay Scale Group & Hiring Zone: PM 3 — Hiring Zone: $82,692 – $96,473 — Broadband Salary Range: $82,692 – $137,819 Ouch. Toronto is one of the most expensive cities in North America. If they really want "expert" level skills across a number of infosec areas, they are going to have a lot of trouble finding a candidate that meets their requirements.
- throw0101a 4y ago
  CL is affiliated with UToronto, see same job posting at: * https://jobs.utoronto.ca/job/Toronto-Manager%2C-Information-System-Security-ON/568434017/ https://jobs.utoronto.ca/job/Toronto-Manager%2C-Information-... And so uses the same wage schedule as them: * https://people.utoronto.ca/wp-content/uploads/2022/06/PM-Salary-Ranges-July-1-2022.pdf https://people.utoronto.ca/wp-content/uploads/2022/06/PM-Sal... * https://people.utoronto.ca/careers/salary-ranges/ https://people.utoronto.ca/careers/salary-ranges/ > […] they are going to have a lot of trouble finding a candidate that meets their requirements. Depends on whether they're trying to bring in someone international, or just in the local talent pool. You do get some good benefits: supplemental health stuff and a DB pension. I started a new position not too long ago where I got a decent salary bump, but if I was still at my old position I would be semi-tempted to at least would apply to see what the environment is about.

kornhole 4y ago

Can we mitigate these kinds of attacks by using a data only SIM card? If I use some kind of VOIP service for OTA calls and SMS, the calls would be off the baseband.

TazeTSchnitzel 4y ago
None of these attacks involved the baseband, they're exploiting bugs in iOS.

wepple 4y ago

https://archive.is/nVs90 https://archive.is/nVs90

EMM_386 4y ago

Honestly, whoever the NSO Group hires must be absolute wizards with some of these hacks. I've read the in-dept writeups on some of the previous ones and they are insane. Combining 5+ seperate problems to finally achieve the goal. I can't imagine what that interview is like. Not that I condone any of this stuff, quite the opposite. But from a programming perspective, it's pretty incredible.

Hortinstein 4y ago
The one where they altered a gif to invoke legacy pdf compatibility libraries that was somehow turing complete and used it to bootstrap a VM that performed memory analysis to escape a sandbox was likely the most impressive feat of engineering I have read...ever. I would love to read an entire book about how this was discovered, productized and deployed. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- EMM_386 4y ago
  Yep, that one was insane. These have to be ex-employees of national security groups like the NSA, etc. who are already familiar with this type of stuff. The Stuxnet-type employees who understand everything at the deepest levels and can (and will) do anything to make it happen. Top-tier engineering. Just used for nerfarious purposes, despite the PR spin. I'm actually surprised they have a PR person. "Um, nothing to see here!" would be my standard response.

ls612 4y ago

The important takeaway is that the vulns they were using have been fixed in the latest iOS 16 updates, which is a far faster response than the old NSO imessage zeroday which took Apple over a year to figure out.

xony 4y ago

[dead]

tholdem 4y ago

Apple has been kind of forced into the open source model by tools like Corellium[1] and some source code leaks. This means that the black box advantage that iOS has had is no longer as significant. Apple's move with the Security Research Device Program[2] proves this point. They wouldn't be offering it if they didn't think it was a serious problem for them. [1] https://www.corellium.com/ https://www.corellium.com/ [2] https://security.apple.com/research-device/ https://security.apple.com/research-device/