3 ms·

Given how these 0days were clearly “burned” for this occasion tells me the NSA has no shortage of them.

jerf 3y ago
I think if we could somehow see all the "zero days" that are out there that all of us, and I mean, things that exist at all, not just things discovered by some human and an exploit written, even those in the industry and those well-endowed with cynicism, would be surprised. I include myself even as I expound this opinion. Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. Software is to a large extent built on default-unsafe primitives, and we wrest security from them at great effort and with dubious efficacy. We still have fights on HN about whether or not "memory safety" is necessary, and that is frankly so far below the level we need to operate that it would be humorous if it weren't sad. Granted, that fight is dying down as we gradually converge on "yes, it's necessary", but it's like level 2 and we need to be operating on level 18.
- hsudvsish 3y ago
  > Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. good thing we live in a free democratic society!
  - renewiltord 3y ago
    We do. And a resilient free society creates agents that it cannot police so that it can achieve its aims. No-ships are necessary for the Secher Nbiw.
jeroenhd 3y ago
I don't know about the current status quo, but three years ago Zerodium stopped buying several types of iOS exploits because of how many submissions they received: https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiring-ios-exploits/ https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiri... It's gotten to the point where full-chain Android exploits, traditionally easier to find and use because of lacking update policies and incompetent manufacturer chains, are worth more than their iOS counterparts: https://zerodium.com/program.html https://zerodium.com/program.html Because of iOS' excellent update rate and generally very secure operating system model, I'd expect this to mean that there are so many exploits for either platform that the trade of exploits for the ostensibly more secure platform isn't restricted by the amount of exploits anymore, but rather by the rate the existing 0day stock gets burned by use. I expect intelligence agencies to be fully stocked with more 0days than they currently need. Not just intelligence agencies either; for your average large international criminal organization, whether it's the maffia or the NSO group, there should be plenty of exploits to be found and bought.
- swang 3y ago
  i think you're extrapolating a bit too much from that tweet from more than 3 years ago considering they resumed buying them ~6 months later. https://twitter.com/Zerodium/status/1326498688621948928 https://twitter.com/Zerodium/status/1326498688621948928 now did they have too many? maybe. but maybe also because they were expecting apple to announce a new ios at the wwdc that was happening in june.. or maybe lots of 0-day exploiters suddenly wanted to dump their exploits knowing that apple was probably going to be patching them soon. oddly enough that tweet about resuming payment coincided with the release timeline of ios 14. most of this is irrelevant though because we lack any information. what is, "too many"? 10? 100? 1000? it could be that just like any other middleman they sometimes need to sit on "inventory" and they can't just buy up that many at one time in case apple fixes them all in an update.
- joshspankit 3y ago
  And the iOS jailbreak community is starved waiting for single root-priv exploit because no one [wants to|can] give them away for free any more.
  - MichaelZuo 3y ago
    Can't 100k community members just each pony up 10 bucks?
    - joshspankit 3y ago
      Yes, but it quickly becomes a power struggle of who gets the 1mil (assuming multiple exploits being viable)

jerf 3y ago

I think if we could somehow see all the "zero days" that are out there that all of us, and I mean, things that exist at all, not just things discovered by some human and an exploit written, even those in the industry and those well-endowed with cynicism, would be surprised. I include myself even as I expound this opinion. Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. Software is to a large extent built on default-unsafe primitives, and we wrest security from them at great effort and with dubious efficacy. We still have fights on HN about whether or not "memory safety" is necessary, and that is frankly so far below the level we need to operate that it would be humorous if it weren't sad. Granted, that fight is dying down as we gradually converge on "yes, it's necessary", but it's like level 2 and we need to be operating on level 18.

hsudvsish 3y ago
> Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. good thing we live in a free democratic society!
- renewiltord 3y ago
  We do. And a resilient free society creates agents that it cannot police so that it can achieve its aims. No-ships are necessary for the Secher Nbiw.

jeroenhd 3y ago

I don't know about the current status quo, but three years ago Zerodium stopped buying several types of iOS exploits because of how many submissions they received: https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiring-ios-exploits/ https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiri... It's gotten to the point where full-chain Android exploits, traditionally easier to find and use because of lacking update policies and incompetent manufacturer chains, are worth more than their iOS counterparts: https://zerodium.com/program.html https://zerodium.com/program.html Because of iOS' excellent update rate and generally very secure operating system model, I'd expect this to mean that there are so many exploits for either platform that the trade of exploits for the ostensibly more secure platform isn't restricted by the amount of exploits anymore, but rather by the rate the existing 0day stock gets burned by use. I expect intelligence agencies to be fully stocked with more 0days than they currently need. Not just intelligence agencies either; for your average large international criminal organization, whether it's the maffia or the NSO group, there should be plenty of exploits to be found and bought.

swang 3y ago
i think you're extrapolating a bit too much from that tweet from more than 3 years ago considering they resumed buying them ~6 months later. https://twitter.com/Zerodium/status/1326498688621948928 https://twitter.com/Zerodium/status/1326498688621948928 now did they have too many? maybe. but maybe also because they were expecting apple to announce a new ios at the wwdc that was happening in june.. or maybe lots of 0-day exploiters suddenly wanted to dump their exploits knowing that apple was probably going to be patching them soon. oddly enough that tweet about resuming payment coincided with the release timeline of ios 14. most of this is irrelevant though because we lack any information. what is, "too many"? 10? 100? 1000? it could be that just like any other middleman they sometimes need to sit on "inventory" and they can't just buy up that many at one time in case apple fixes them all in an update.
joshspankit 3y ago
And the iOS jailbreak community is starved waiting for single root-priv exploit because no one [wants to|can] give them away for free any more.
- MichaelZuo 3y ago
  Can't 100k community members just each pony up 10 bucks?
  - joshspankit 3y ago
    Yes, but it quickly becomes a power struggle of who gets the 1mil (assuming multiple exploits being viable)