6 ms·

It's 2023, and iPhones are still being hacked with the same broken serialization functions that have been breaking iMessage for literal years. This is Apple app

by meibo 3y ago

It's 2023, and iPhones are still being hacked with the same broken serialization functions that have been breaking iMessage for literal years. This is Apple apps/services, they continue making these mistakes in new code. People are being persecuted with this, is no one there accountable?

DSingularity 3y ago
Sometimes I wonder if it’s by design. Israel relies on penetrating everything from iPhones to social media accounts to crush Palestinian resistance and to maintain the authority of the PLO in the west bank by helping it suppress its dissenters. That wouldn’t work if social media and cellular networks were actually secure. That’s not even to mention the obvious advantage of US security apparatus having access to these popular systems.
- ttul 3y ago
  What incentive for the Apple possibly have to make their phones vulnerable to NSO hacking tools? Apple makes more money than god selling iPhones. The State of Israel’s entire defense budget is about $18B/yr, which is less than Apple’s annual R&D budget. And they have to defend an entire country with that $18B. The idea that Apple is playing ball with the IDF is frankly ludicrous.
  - heavyset_go 3y ago
    The same reason that any giant company plays ball with the US government: sweetheart deals, favorable treatment, preferential contracts, protection of their interests in both domestic and foreign markets, etc. Apple regularly gives up users' private data when the government simply asks them to[1], despite spending billions of dollars on "privacy" marketing. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html
    - sonofhans 3y ago
      Your “when the government asks them to” should read “so that the government doesn’t shut them down.” The two things you mention are not at all comparable. You’re trying to associate them for rhetorical effect, but there’s no analogy here. Thing 1: Apple complies with US law. How do you think it would work if Apple said “Fuck you” to US law enforcement requests? Can you provide examples of other companies that have done this, or are doing this now, and had it work at all? I can’t think of a single US-based tech company that doesn’t cooperate with law enforcement. At least Apple is transparent about it. Thing 2: Apple markets privacy — https://www.apple.com/privacy/ https://www.apple.com/privacy/ They make a bunch of concrete statements, most of which are empirically verifiable. What is wrong with this? Again, can you point to any at-all-similar company that does it better, or more explicitly?
      - heavyset_go 3y ago
        Nope, those are not all responses to subpoenas, warrants, court orders, etc. Apple specifically lists the requests they're legally obligated to respond to in one section, and then lists requests they choose to respond to with users' private data in another. That's to say that Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so, as there is with warrants.
        musicale 3y ago
        > Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so I'm having trouble finding this part specifically. Can you point to where that is described, and what some examples are?
        infotogivenm 3y ago
        Yea, definitely citation needed on that. What I have seen OTOH, is Apple go to considerable expense not to comply with broadening LEO requests. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
  - coldtea 3y ago
    "Nice company you've got here. You wouldn't want anything bad to happen to it, right?"
  - bugglebeetle 3y ago
    What do “incentives” have to do with anything in a post-Snowden reality?
- thenaturalist 3y ago
  This is the biggest jump of whattaboutism I've seen in five years. Jeez, I if I had one wish from a genie some day, it would be to absolutely get rid of the curse that is whattaboutism.
wepple 3y ago
You act like it’s trivial to fix. They’ve already sandboxed the parsers (which this exploit appears to bypass, crashing MessagesBlastDoorService) which massively drives the effort up. They also had to bypass pointer authentication. Whilst, yes, you can wonder why it isn’t all rewritten in swift (if it isn’t already), exploits will continue to be found and exploited, forever.
- tialaramex 3y ago
  It arguably is trivial to fix, if you prioritise fixing this. If you say OK, we want to offer safety first and features are only a nice-to-have, you can make that happen. Apple have as usual decided that nope, some of their features are a must have and if safety has to be sacrificed to get features well, sucks to be you getting exploited. Something like Swift isn't up to it. It's less easy to blow your foot off than if you wrote C++ but necessarily (as a general purpose language) you can do it. But what if we give up generality? Languages like WUFFS give up general purpose programming, solving only a narrow problem but doing so with cast iron safety because they're able to prove the system always has valid state. This is entirely appropriate when (as so often) we didn't really need generality, which means having it is a gift for bad guys. "Lockdown mode" should have begun with stuff that's definitely safe, rather than just arbitrarily picking a smaller set of features in the hope that the smaller surface can be more easily defended.
- eviks 3y ago
  So how is rewriting it in a safer language not trivial in this example?
  - wepple 3y ago
    Well obviously you can’t just rewrite the particular components used in this exploit chain, as attackers will hit something else next time. So you’re rewriting practically an entire OS stack from scratch, in a different language (one that is ill-suited for low-level operations needed in many parts of an OS) I’d say that’s not trivial?
    - 3y ago

by meibo 3y ago

DSingularity 3y ago

Sometimes I wonder if it’s by design. Israel relies on penetrating everything from iPhones to social media accounts to crush Palestinian resistance and to maintain the authority of the PLO in the west bank by helping it suppress its dissenters. That wouldn’t work if social media and cellular networks were actually secure. That’s not even to mention the obvious advantage of US security apparatus having access to these popular systems.

ttul 3y ago
What incentive for the Apple possibly have to make their phones vulnerable to NSO hacking tools? Apple makes more money than god selling iPhones. The State of Israel’s entire defense budget is about $18B/yr, which is less than Apple’s annual R&D budget. And they have to defend an entire country with that $18B. The idea that Apple is playing ball with the IDF is frankly ludicrous.
- heavyset_go 3y ago
  The same reason that any giant company plays ball with the US government: sweetheart deals, favorable treatment, preferential contracts, protection of their interests in both domestic and foreign markets, etc. Apple regularly gives up users' private data when the government simply asks them to[1], despite spending billions of dollars on "privacy" marketing. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html
  - sonofhans 3y ago
    Your “when the government asks them to” should read “so that the government doesn’t shut them down.” The two things you mention are not at all comparable. You’re trying to associate them for rhetorical effect, but there’s no analogy here. Thing 1: Apple complies with US law. How do you think it would work if Apple said “Fuck you” to US law enforcement requests? Can you provide examples of other companies that have done this, or are doing this now, and had it work at all? I can’t think of a single US-based tech company that doesn’t cooperate with law enforcement. At least Apple is transparent about it. Thing 2: Apple markets privacy — https://www.apple.com/privacy/ https://www.apple.com/privacy/ They make a bunch of concrete statements, most of which are empirically verifiable. What is wrong with this? Again, can you point to any at-all-similar company that does it better, or more explicitly?
    - heavyset_go 3y ago
      Nope, those are not all responses to subpoenas, warrants, court orders, etc. Apple specifically lists the requests they're legally obligated to respond to in one section, and then lists requests they choose to respond to with users' private data in another. That's to say that Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so, as there is with warrants.
      - musicale 3y ago
        > Apple regularly hands over users' private data when simply asked, even if there is no legal obligation to do so I'm having trouble finding this part specifically. Can you point to where that is described, and what some examples are?
        infotogivenm 3y ago
        Yea, definitely citation needed on that. What I have seen OTOH, is Apple go to considerable expense not to comply with broadening LEO requests. https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
- coldtea 3y ago
  "Nice company you've got here. You wouldn't want anything bad to happen to it, right?"
- bugglebeetle 3y ago
  What do “incentives” have to do with anything in a post-Snowden reality?
thenaturalist 3y ago
This is the biggest jump of whattaboutism I've seen in five years. Jeez, I if I had one wish from a genie some day, it would be to absolutely get rid of the curse that is whattaboutism.

wepple 3y ago

You act like it’s trivial to fix. They’ve already sandboxed the parsers (which this exploit appears to bypass, crashing MessagesBlastDoorService) which massively drives the effort up. They also had to bypass pointer authentication. Whilst, yes, you can wonder why it isn’t all rewritten in swift (if it isn’t already), exploits will continue to be found and exploited, forever.

tialaramex 3y ago
It arguably is trivial to fix, if you prioritise fixing this. If you say OK, we want to offer safety first and features are only a nice-to-have, you can make that happen. Apple have as usual decided that nope, some of their features are a must have and if safety has to be sacrificed to get features well, sucks to be you getting exploited. Something like Swift isn't up to it. It's less easy to blow your foot off than if you wrote C++ but necessarily (as a general purpose language) you can do it. But what if we give up generality? Languages like WUFFS give up general purpose programming, solving only a narrow problem but doing so with cast iron safety because they're able to prove the system always has valid state. This is entirely appropriate when (as so often) we didn't really need generality, which means having it is a gift for bad guys. "Lockdown mode" should have begun with stuff that's definitely safe, rather than just arbitrarily picking a smaller set of features in the hope that the smaller surface can be more easily defended.
eviks 3y ago
So how is rewriting it in a safer language not trivial in this example?
- wepple 3y ago
  Well obviously you can’t just rewrite the particular components used in this exploit chain, as attackers will hit something else next time. So you’re rewriting practically an entire OS stack from scratch, in a different language (one that is ill-suited for low-level operations needed in many parts of an OS) I’d say that’s not trivial?
  - 3y ago