34 ms·
NSO group iPhone zero-click, zero-day exploit captured in the wild
- nnx 3y agoIt’s interesting that latest Safari TP (r178) somehow crashes on macOS Ventura, with or without the patch, when reading HN comments on this specific article. Is there a honeypot in a comment on this page? /paranoid
- abledon 3y agoMy IphoneSE feels like the old Battlestar Galactica around these new phones
- midasuni 3y agoThat would be the Nokia 3310
- Obscurity4340 3y agoThis is why you don't use your iPhone's keychain or iCloud keychain. These exploits give access to everything.
- theshrike79 3y agodupe of: https://news.ycombinator.com/item?id=37423506 https://news.ycombinator.com/item?id=37423506
- parhamn 3y ago> The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim. Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they'll paying for a while for their decisions around the iMessage architecture.
- tw04 3y agoAt least they’re trying? Meanwhile Google has spent 2 decades refusing to release a messenger that encrypts by default because they think they should be able to mine all your personal conversations. I take that back, they announced encrypted messaging, then never released it, then probably fired the engineer who said it’d be a feature in allo (or whatever their last attempt was).
- robear 3y agoIsn't Messages E2E by default?
- s3p 3y agoiMessage or android messages? iMessage is E2E by default, unless one or more parties own multiple apple devices, in which case apple stores an encryption key on iCloud and maintains E2EE connections with every connected Apple device. This changes if you turn on Advanced data protection-- then iCloud no longer has the ability to decrypt messages. Somewhat unrelated but ADP is off by default as most customers do not want or need this.
- robear 3y agoAndroid Messages, the competitor to iMessage. The parent claimed that Google resists encrypting anything so they can mine your data. I was merely trying to ask for accuracy. I don't know the technical aspects of every Google messaging app but as the other responses in the thread confirm, Messages is end to end encrypted by default for non-SMS messages.
- pmontra 3y agoI just checked and Google does have a Messages app, different from the Messages app on my phone, probably by Samsung, which deals with SMSes. According to Play it has 1B+ downloads so it's probably preinstalled. Anyway, the competitor of iMessage and Messages is WhatsApp. Nobody is sending me SMSes except banks so even iPhone users use WhatsApp to send messages to friends and to groups in my country. If somebody would insist using only iMessage they would be out of the loop. And about Messages, well, I don't have that app, I receive no SMSes, I still communicate with everybody so I guess that nobody uses Messages too.
- MiguelHudnandez 3y agoThese fixes came out today, apparently timed with the announcement, make sure updates are applied for you and yours. https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
- purkka 3y agoInterestingly, no kernel vulnerability or anything is mentioned. As far as I know, any parsing code for iMessages should run within the BlastDoor sandbox – is there another vulnerability in the chain that is not reported here?
- bri3d 3y agoOne CVE is in Wallet and Citizen Lab mention PassKit. My guess is that BlastDoor deserializes the PassKit payload successfully, then sends it to PassKit which subsequently decodes a malicious image outside of BlastDoor.
- notactuallyben 3y agoYup. You can just have your crafted webp (This is the patch for the ImageIO bug https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a https://chromium.googlesource.com/webm/libwebp/+/902bc919033...) image with the .png extension (inside your passkit - https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/PassKit_PG/Creating.html https://developer.apple.com/library/archive/documentation/Us...) and you send it to your target..
- baz00 3y agoImage I/O has been mentioned elsewhere. Suspect it's code that's running in process from that library that's doing it.
- MiguelHudnandez 3y agoI think you're right but I don't see any detailed information from The Citizen Lab. I expect a lot more information after some embargo timer runs out. For context, here's another report from them outlining a similar vulnerability: https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/ https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-n...
- victorbjorklund 3y agoWas just wondering why my Mac wanted to update (since it felt I updated it very recently).
- llamaInSouth 3y agoWhats the usual update schedule?
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- aborsy 3y agoI wonder if the lockdown mode would have prevented this attack? Has an iPhone in the lockdown mode been hacked so far, using a zero day vulnerability (not tricking the user to install a malicious program)?
- s3p 3y agoIt does. The page even recommends lockdown mode as a mitigation for affected parties (people who aren't updated)
- onionisafruit 3y agoI think that is a general recommendation in the linked post, not specifically for this issue.
- o1y32 3y agoThere is an update just issued that is at the bottom of the page. It confirms that lockdown prevents this specific attack.
- Obscurity4340 3y agoIts super interesting to me how much its emphasized that you shouldn't use this (Lockdown Mode) unless you are a journalist or otherwise in direct danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality other than disabling a lot of Apple nonsense from running in the background expanding your attack surface.
- UnicornsOnLSD 3y agoBlocking "most attachments", including links, from iMessage would be a very visible and annoying change
- ramraj07 3y agoApple doesn't want it's users to have an interior experience. It might be subtle so it makes sense that they don't want fully uninformed users from enabling it for no real reason. Currently it's not clear anyone who's not under risk of state sponsored monitoring should bother enabling it. Thus it's not clear why they should message it any other way.
- mariojv 3y agoI wonder if Apple has a mechanism for notifying people who were affected by the exploit after they update.
- tempotemporary 3y agoThey do: https://support.apple.com/en-us/102174 https://support.apple.com/en-us/102174
- pseudo0 3y agoHere we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff. If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.
- kylemh 3y agosure, that's why China is banning gov't officials from using their devices...
- zshrc 3y agoPlease... Androids no better. At least Apple will have it patched within the year of discovery. Can't say the same for other Android vendors.
- teawrecks 3y agoInteresting how your response makes it seem like the person you're responding to mentioned android at all.
- acdha 3y agoI think it’s safe to assume that most people know that’s the only other common choice.
- Gigachad 3y agoAndroid is moving away from C and towards more secure languages. From one of their recent blog posts, the majority of code written for android is now in memory safe languages.
- berbec 3y agoIs the programming language likely the issue here?
- scarface_74 3y ago[flagged]
- curiousgal 3y agoI've never met a person who threw away a phone because of the lack of updates.
- anonymoushn 3y agoI got a new phone last year because my old phone could not call emergency services. Even if it was still receiving updates it's not clear that this would be fixed though. Google seems to think that local regulations prevent them from fixing this users of certain of their phones on certain carriers.
- zelphirkalt 3y agoMaybe not throw away but give away. Just look at how many people buy a new phone every 2 years or even shorter period. Something must happen to their old phones.
- flutas 3y agoPeople do that exact same thing with iPhones, so clearly Apple must suck too. /s A lot of phone purchases anymore fall into the fashion side of consumerism. They don't actually care about X, Y or Z new features. They just want to show off that they have the new thing.
- deleted 3y ago[deleted]
- threeseed 3y agoIt is extremely common. Most older devices are unable to run newer apps as the newer SDKs are not present.
- c0pium 3y ago[flagged]
- envy2 3y agoWould be nice if either CitizenLab or Apple had published some IOCs...
- AceJohnny2 3y agoIOC = Indicator Of Compromise ?
- envy2 3y agoYes.
- dang 3y agoRelated ongoing thread: iOS 16.6.1 fixes two vulnerabilities known to be actively exploited in the wild - https://news.ycombinator.com/item?id=37423506 https://news.ycombinator.com/item?id=37423506 - Sept 2023 (7 comments)
- mathverse 3y agoThe only thing preventing this would be grsec for iOS.
- insanitybit 3y agoGrsecurity generally focuses on the kernel side of things, although it does include a number of userspace mitigations as well. Still, when you have such ripe primitives not even Grsecurity can protect you. What we really need is to just have radically lower bug density. Buffer overflows need to die. UAFs need to be made far less common. The "distance" between vulns needs to be greatly increased. Having design and validation issues sitting smushed between a dozen memory safety issues is just not something you can deal with through software mitigation techniques. An app like iMessage is just too sensitive (ie: unauthenticated communication with many image parsers) to be built the way that it is. Fundamentally it just can't be safe without core components being rewritten with memory safety in mind. Grsecurity and other mitigations would be an awesome defense in depth and would be particularly helpful to avoid subsequent privescs, but I'm far more concerned with "anyone can text me an image and own me thanks to 1990s style bugs".
- mathverse 3y agoGrsec would make achieving code exec much harder or impossible.
- insanitybit 3y agoI'm not convinced that that's true. All we know is that one vulnerability was a "buffer overflow" - pretty vague. If this were, for example, an overflow on the heap, which Grsecurity mitigations would even impact it? Improved ASLR? Mprotect restrictions? There are very few mitigations in the Grsecurity patches that even touch userspace in a way that isn't focused on kernel protection. Maybe if it's a stack based overflow something like PAX_RANDUSTACK would have had some impact but it depends. And in case this at all comes off as me thinking anything negative about Grsecurity, I assure you that's not the case. I proudly wear the "Grsecurity Cheerleader" badge that Spender threw my way over a decade ago.
- fuddle 3y agoFor anyone interested in learning more about the NSO group, I'd recommend this podcast episode: https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- pseg134 3y ago[flagged]
- FirmwareBurner 3y agoThe US could demand NSO on a platter if they realty wanted to, but they don't. Israel intelligence often aids the US alphabet boys and the NSA on various offensive operations and intelligence gathering, which is why NSO is allowed to keep doing business by both parties.
- deleted 3y ago[deleted]
- fatfingerd 3y agoThe US government gives them billions of dollars and they help the US government maintain puppet dictatorships like Saudi Arabia..
- hot_gril 3y agoAnd the US barely has an inherent interest in Saudi Arabia. Israel is credited for helping the US "fight terrorism in the Middle East" or maintain those puppets, but really they're just helping us help them. When it comes to things that don't directly benefit Israel, they don't care. Israel has never even fought ISIS for example, the largest recent terrorist threat in the region. And they're allowed to maintain some neutrality in situations like Russia's attack on Ukraine. You might even call them neutral wrt ISIS since they aren't in this mostly symbolic list: https://www.state.gov/the-global-coalition-to-defeat-isis-partners/ https://www.state.gov/the-global-coalition-to-defeat-isis-pa... For all the things Israel has done against the US's wishes (like West Bank settlement), the US has struggled to do just one thing Israel doesn't like: the Iran nuclear deal. But at least one of our major parties is somewhat willing to push it. I think they're also somewhat annoyed with our focus on Ukraine.
- ch4s3 3y agoClearly putting the NSO group on the Commerce Department blacklist didn't go far enough. These scumbags belong in the Hague(metaphorically at least).
- RetpolineDrama 3y ago>Clearly putting the NSO group on the Commerce Department blacklist didn't go far enough Somewhere in a nondescript subterranean hangar north of vegas an unacknowledged aerial platform is getting an itchy nose
- Zuiii 3y agoGiven where the group is headquartered, I doubt it. That unacknowledged aerial platform will remain firmly planted on the ground until the next defenseless target is chosen.
- themoonisachees 3y agoI hear NSO group keeps several million barrels of oil on them at all times, and also definitely WMDs.
- sneak 3y agoPlease don't suggest that people should be murdered with drone-launched missiles for making software. Making software is a peaceful act, regardless of what purpose that software serves.
- Obscurity4340 3y agoThat is not a reasonable position, "peacefully" writing software that you know is to be used to murder and silence other people makes you just as complicit those crimes (definitely an accessory). No better than a getaway driver.
- sneak 3y agoSoftware is speech (ie protected expression), like writing books. A getaway driver is involved after the crime is committed. To assign the same level of culpability to a tool-maker would imply that they have the ability to predict the future. A better example would be a car or firearm manufacturer. How the tool is used is up to the user. Software doesn't root people's phones, cops and spies do. Someone sent that iMessage, and it wasn't the author of the software.
- bastard_op 3y agoSo at what point does the world bring sanctions against Israel for allowing organizations like this to exist there? Everyone knows NSO is just a dubiously legal version of common APT groups, so how do they still exist after these years?
- deleted 3y ago[deleted]
- vxNsr 3y agoAny politician who attempted something like that would immediately find themselves on the wrong side of the table with various three letter agencies. You’re incredibly naive if you think Israel or really anyone else is responsible for this. They’re simply doing the bidding of various first world intel orgs that want/need plausible deniability.
- throwaway143261 3y ago[flagged]
- lijok 3y agoYou’re asking why Walmart shoppers are not demanding Walmart be closed down
- mensetmanusman 3y agoGame theory. They alert the big players of who is doing what, if they didn’t exist, China and Russia would get all this business and be at the cutting edge (and not share the most pertinent info).
- deleted 3y ago[deleted]
- black_puppydog 3y agothis is actually not specific to israel, there are similar groups in other countries. finfisher was somewhere in benelux I think? hacking team was in italy. these two were pretty much dismantled but are just regrouping under new names. this is a problem of all nation states wanting this kind of service, not of israel in particular.
- arecurrence 3y agoWe're all very lucky that CitizenLab exists as they are often the first discovery point of numerous similar exploits. They proactively scan the phones of internationally sensitive people and publish their findings. I'm not aware of any other public service that has had this much success exposing mobile device attacks. Attacks which have completely and utterly compromised the entire device that someone keeps with them all day every day. I tip my hat to CitizenLab and the good work they do.
- deleted 3y ago[deleted]
- aaron695 3y ago[dead]
- ruuda 3y agoAgain a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution! [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- hot_gril 3y agoAnd a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.
- l33t7332273 3y agoI would describe a one click rootkit as terrifying as opposed to wonderful.
- c0pium 3y agoIf it makes you feel better the click was actually unnecessary theater.
- dhosek 3y agoYeah, the whole way that the jailbreaks installed was scary enough for me to never want to go near them.
- hot_gril 3y agoYour phone would reboot with a pineapple logo and console messages flying across the screen like a 1337 h4cker, starting with the "regents of the University of California, Berkeley" message. Then you'd go install a ton of Cydia hacks.
- wyldfire 3y agoWow this sounds like stagefright was way back when. So for those keeping score, is Android now ahead of iOS in this aspect of security?
- madeofpalk 3y agoI never hear about Android vulnerabilities, but it seems wrong to say they haven't existed.
- alphabettsy 3y agoMaybe, but probably not. They have regular security releases that often patch critical vulnerabilities such as https://source.android.com/docs/security/bulletin/2023-08-01 https://source.android.com/docs/security/bulletin/2023-08-01 The bigger issue with Android IMO is you might not get the patches right away depending on your device and it’s age.
- Etheryte 3y agoWhile there's a big difference between a CVE and a CVE, Android has had 939 CVEs in 2023 alone [0]. I wouldn't necessarily hold my breath on this one. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html?year=2023 https://www.cvedetails.com/vulnerability-list/vendor_id-1224...
- bennyg 3y agoI’d put money on there being an Android variant of Pegasus out there in the wild right now.
- Operyl 3y agoThe price of an Android zero-click is now 500k more than the price of an iOS zero-click for Zerodium now. It would appear they have a significant stock of iOS zero-clicks and a lesser amount for Android: https://zerodium.com/program.html https://zerodium.com/program.html
- SigmundA 3y agoNot sure Android just had a bunch of CVE published with little fanfare here: https://source.android.com/docs/security/bulletin/2023-09-01 https://source.android.com/docs/security/bulletin/2023-09-01
- nevi-me 3y agoI appreciate that a solution is for people to update immediately. It really makes me wonder if my Android phones over the years have had 1-days exploited by the sheer incompetence of the ecosystem in updating phones. Not much confidence when you get an update with security patches from 2-3 months ago.
- j0hnyl 3y agoThese exploits are highly targeted, they aren't just flying around hitting random devices.
- thethimble 3y agoBest way to secure your devices is to not be a target! /s
- nevi-me 3y agoI understand that, and I'm partially assessing that in the context of any high targets who might be using the latest Android flagship, that frankly still suffers from the same problem as all Android phones.
- aaomidi 3y agoOnly when they’re unknown. Once they’re known they’re built into shit like kali Linux.
- j0hnyl 3y ago1-day / n-day zero click nso exploits are certainly not available in kali linux.
- robocat 3y ago> they aren't just flying around hitting random devices. For the moment, but only until other wankers reverse engineer the security flaws based on the updated 16.6.1 firmware from Apple. After that you too are vulnerable if you haven't updated.
- 3y ago
- rank0 3y agoThese dudes are insane. I wonder how much exploits like this are worth…
- processunknown 3y agoProbably seven figures
- p0rkbelly 3y ago8 figures. easily. Apple itself pays $1-million for bug bounties of this type. https://security.apple.com/bounty/categories/ https://security.apple.com/bounty/categories/
- qingcharles 3y agoAnd worth every penny of that to avoid the PR that ensues with one of these in the wild.
- lijok 3y ago0-click for iphone up to around 10 million other 0-days for iphone up to around 2 million
- comment0r 3y agoAccording to Zerodium [1] it would be up to 2 million USD in this case. [1] http://zerodium.com/program.html http://zerodium.com/program.html
- internetter 3y agoInteresting that android FCPs are worth more than iOS counterparts. Does that mean android is more secure?
- markus_zhang 3y agoPerhaps more users?
- m3kw9 3y agoI wonder if lockdown mode can block this exploit
- lijok 3y agoYes, it’s in the article
- redbell 3y ago> The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim. I’m, in no way, a security savvy but the above achievement must be a lot of work by the NSO group!
- _greim_ 3y agoAren't these zero-days sold to highest bidders? Just an honest days work...
- londons_explore 3y agoHow many exploits has iMessage had now? Isn't it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn't so different from ActiveX? And on top of that, maybe the whole app should run in a sandbox. And on top of that, perhaps it should all be a webview to give one more layer of protection.
- DanHulton 3y agoOn plain text -- in short, it doesn't exist: https://www.youtube.com/watch?v=gd5uJ7Nlvvo https://www.youtube.com/watch?v=gd5uJ7Nlvvo And there have definitely been UTF-8 parsing bugs before and likely will again.
- doug_durham 3y agoEvery process in iOS is run in a sandbox. That is why these exploits are so hard to come by.
- markus_zhang 3y agoI so respect those who figured out these exploits. I don't like people using them of course but the technical brilliance is indisputable.
- callalex 3y agoThere is even precedent for doing this seamlessly: the Apple Mail client will not render media from unknown senders without user confirmation. iMessage should have the exact same behavior for the same reasons. It’s frustrating to watch greedy project managers re-learning the exact same lessons that a previous generation already learned the hard way, especially when they all work in the same building.
- cozzyd 3y agoThis is for a different reason (all useful e-mail clients do the same thing!). If Mail (or thunderbird or whatever) loaded the media, then the sender could know you opened the e-mail (by sending each recipient a unique image), leaking information.
- kbos87 3y agoNaive question, does apple have any way of detecting and informing users who are current victims of these types of exploits when security fixes are issued?
- deleted 3y ago[deleted]
- trog 3y agoPatches only out for Ventura - any word on whether other versions like Monterey, Sonoma or iOS 17 are vulnerable?
- cowthulhu 3y agoDoes anyone know to what extent this compromises the device? I might have missed it, but didn’t see it explained in the article. Does the attacker get full access to the device, or do they only compromise a subset of the devices functionality?
- drewtato 3y agoThey say at the top that the exploit can install Pegasus, so probably some or all of Pegasus's functionality. That doesn't really narrow it down, but it likely can constantly run in the background, use the sensors, read texts, and send info over the internet at least.
- aaomidi 3y agoDoesn’t a reboot of the phone “fix” this?
- Obscurity4340 3y agoIts super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody parrots the nonsense caveat that everyone shouldn't use it, only those special enough should like it was a zero-sum game or scarce resource. Everyone should use it because it disables a lot of nonsense that doesn't serve you and probably even saves battery power. Also, the more people use it, the less it can be used to fingerprint specific users.
- s3p 3y ago> They really do try to talk you out of it. Who? Apple? I can't find any statements from them begging us not to use it. It's also a dumb argument since they can just --not-- release the feature if they don't want us to use it.
- andrewia 3y agoIt does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromises between the two, perhaps letting you lower your security for a few minutes when you need the extra functionality. For example, Safari could detect when JavaScript is being slow and pop up an offer to re-enable JIT.
- barryrandall 3y agoI’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.
- jiofj 3y ago
- Horffupolde 3y ago[flagged]
- drexlspivey 3y agoThey bought an exploit you mean
- andrewia 3y agoThe issue is that NSO makes spyware available to far more countries by lowering the barrier to entry. Looking at their sales history, they have little criteria for sales besides following the preferences of the Israeli government. They sometimes sell to nations that generally promote human rights, and other times sell to nations that are very repressive yet important allies to Israel.
- 0xcde4c3db 3y agoYes. There's at least a principled discussion to be had about the pros and cons of something like "full disclosure" vs. "responsible disclosure", but based on everything that's come out about the company I'm pretty comfortable at least provisionally tossing NSO Group in the same bucket as the ghouls who charge prisoners a per-minute fee for phone calls to their families.
- black_puppydog 3y agoyes I can totally blame the bully for using the stick he just found, and selling their services of "beating up blameless victims" to the next-biggest bullies. that's what responsibility looks like. NSO group are 100% responsible for what happens here. (which doesn't pe-empt someone else also being 100% responsible, for the record. I know, sounds unintuitive :D )
- MuffinFlavored 3y agohow compromised are you if you are affected? can you read token/cookie data from other apps (like banking)?
- agnosticmantis 3y agoI find it interesting that most comments here are blaming the victim (Apple’s iMessage and by transitivity its users) rather than the aggressor (NSO and its users). How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing?
- Zetice 3y agoBecause “hunting down and extinguishing” is a wild overreaction?
- deleted 3y ago[deleted]
- vimax 3y agoApple makes security claims in a world where these types of attacks are known about and expected. They are responsible for fulfilling their own claims. If an air bag fails, you fault the manufacturer. They don’t escape responsibility by saying it’s the other drivers fault. I’ll also add that Apple is not the victim here, the targeted end users are.
- agnosticmantis 3y agoThis is a false comparison. Being hacked by NSO isn’t an accident. There’s an agent involved here with clear intent to harm and significant monetary motives. If in a car accident we knew one party intentionally caused the crash (and were paid for it handsomely), we’d hold them responsible, regardless what claims car companies make regarding safety.
- hugh-avherald 3y agoIt doesn't make sense to talk about IT safety if you exclude intentional hacking. To take your example, we do hold car companies responsible for harm from collisions with other vehicles, regardless of which driver was at fault.
- vimax 3y ago
- jononomo 3y agoYou can turn on lockdown mode on your iPhone and then specifically exclude certain apps and websites from being impacted by it -- this seems like a reasonable middle ground for most people.
- nickaflip 3y agoIf you are curious about NSO Group, Pegasus, or Citizen Lab - Darknet Diaries podcast (Episode 100) does a good job diving into the history.
- balls187 3y agoIt really is a great episode. Link for those curious: https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- RadixDLT 3y agothe nso go their hands on the vault 7 tools https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
- deleted 3y ago[deleted]
- tornato7 3y agoI just received a random image of a champagne bottle via iMessage from an unknown number. Any way to tell if this is the attempted exploit? I had patched my phone prior to receiving the image.
- goldinfra 3y agoI don't need to be able to accept iMessage messages from random numbers. I'd be happy to enable "Prevent messages from unknown numbers" for example. Is this possible?
- NL807 3y agoThere is a "Filter Unknown Senders" feature. https://support.apple.com/en-au/guide/iphone/iph203ab0be4/ios https://support.apple.com/en-au/guide/iphone/iph203ab0be4/io...
- MichaelZuo 3y agoNotably this doesn't actually prevent a zero-click exploit from being received.
- ramraj07 3y agoIs this needed on top of lockdown mode?
- TheDong 3y agoI don't want the huge number of inconveniences of lockdown mode. I just want to have apple block messages from unknown senders to iMessage server-side, before they forward any untrusted data to any of my devices. lockdown mode also doesn't add server-side filtering for unknown imessage senders, so that doesn't seem as good for this purpose.
- Obscurity4340 3y agoYeah, its starting to get weird that they refuse to implement this. Its almost like certain stakeholders need to be able to randomly text you with malware and refuse the notion of being silenced.
- Obscurity4340 3y agoSame thing with the iCloud email addresses you can't delete and that have to exist if you have an AppleID, despite never using them.
- udev 3y agoI don't understand Apple here. Just put an army of people on fuzzing the shit out of iMessage and all its possible file attachments. You tried and failed? Fire the bozo who lead the effort. Try again. You did not even try? Fire the c-level bozo who failed to see it coming and failed to approve such an effort. But cynically, more and more it feels like some bugs have to stay unfixed, for NSA use, just that NSO is also getting on the game.
- deleted 3y ago[deleted]
- olliej 3y agoGiven all the major tech companies aggressively fuzz everything maybe, just maybe, you're missing the additional possibility: fuzzing is still random and extensive fuzzing does not mean you will encounter the same code paths as anyone else. You need to understand "do fuzzing" is not a magic trick to find all bugs in software. Similarly: definitionally you will only ever see the bugs that are not found prior to shipping - any bugs that are found prior to software shipping will have been fixed.
- udev 3y agoFuzzing is not a magic trick, in the same way as invariants are not, and unit tests are not, and debugging is not. All these techniques have degrees of mastery, and if applied carefully, and in combination, can save you a lot of grief. Dumb fuzzing will not get you anywhere, same as dumb unit testing, and dumb debugging. In this case, iMessage is particularly well suited for some smart fuzzing because all the attack vectors seem to involve smallish malicious attachment files.
- olliej 3y agoYou're missing the point: It is possible fro multiple distinct groups to all fuzz the same code and find different non-overlapping bugs. You are erroneously saying "one group of people found a bug that could be found by fuzzing therefore apple is not fuzzing". LibJPEG is decades old at this point and is still getting around 10 CVEs a year, despite being one of the projects I believe google constantly fuzzes. zlib is getting a few a year despite being a vastly more constrained format than anything else imaginable, and again being a heavily fuzzed library. If "do lots of fuzzing" caught every bug, then you'd get a big release that fixed all of them, and you'd never see any more. > In this case, iMessage is particularly well suited for some smart fuzzing because all the attack vectors seem to involve smallish malicious attachment files. I chose to include libjpeg above specifically to rebut this comment. That there are still CVEs coming in for libjpeg this year, despite years of fuzzing should be sufficient to show that even small attachments aren't magically invulnerable due to fuzzing. Fuzzing is a useful tool but pretending that some project or software is going to be secure because it's been fuzzed a lot is nonsense, and pretending that fuzzing will find all the bugs is complete fiction. Even software written in memory safe languages benefits from fuzzing: a memory safe language simply means your code will not continue if doing so would result in a memory safety violation, but for most memory safe languages that means at best an exception, but in most cases it means termination - that's what you get in Rust, Swift, or even functional languages like Haskell - and program termination can mean user data loss, or at least a bad user experience, so fuzzing is helpful even if bugs don't cause "security" issues.
- fortran77 3y agoHow did the "Citizen Lab" connect this to the "NSO Group?" Is it just pure breathless speculation?
- black_puppydog 3y agothe exploit was used to install the pegasus malware. very hard to imagine anyone else doing that.
- piuantiderp 3y agoOne can't help wondering if this is kind of announcement is partly meant to cast lockdown mode in a positive light
- kmos17 3y agoThere needs to be a more fine tuned lockdown mode, for example to disable automations and risks in imessage and safari but leave device accessories working. Losing bluetooth accessories to protect yourself from zero click imessage exploits is just bad. imessage is the major wide open attack surface.
- sangnoir 3y agoiMessage is also a huge part of Apple's moat - it's unlikely Apple will ever allow green-bubble alternative text apps that may be more secure.
- seanhunter 3y agoSettings already allows you to "tune your lockdown mode" to suit your preferences. For example Settings > Messages > iMessage is literally a switch to turn off iMessage if you feel that it's problematic. Settings > Safari > Privacy and security has various settings which allow you to have a 'more fine tuned lockdown' for safari.
- phendrenad2 3y agoYes but it's missing the one thing that would make a huge difference: Blocking images from people not on your contact list.
- spacebacon 3y agoIn addition to lockdown mode, pair with a vpn and security researcher Jeff Johnsons "stop the madness", and "stop the script". Both are paid safari plugins for ios. Stop the script is the best way to stop inline javascript on ios. Disabling JS on iphone can't do that.
- animitronix 3y agoAnother day, another reason to be glad I don't have a single fucking Apple product in my house.
- xyst 3y agoIf it’s not apple it’s probably something else.
- xyst 3y agofor sensitive work, got to air gap that device(s). for any communication, use burners (pre-paid phones) or meet IRL
- 10g1k 3y agoQuestion. Back in the dark ages, a "zero day exploit" was a piece of malware which would lay in wait, doing nothing, counting down the days, until it hit day zero, and then it would trigger and do naughty things. Some folks also referred to this as a time bomb, but that was a less `|33+ term for it. We used to see a lot of these available on sites such as asta... never mind. Fast forward to the era of "cyber" being hugely popular, and the massive flood of people doing short Kali or "Ethical Hacking" courses and getting into IT security jobs, and I see various formal IT security publications describing a zero day exploit as "ANYTHING which is known and not yet patched". To me, there is absolutely nothing about that description which relates to the "zero" or the "day" or the "zero day". I suspect this new terminology is the result of that influx of people with no background in either computer science or hacking, latching on to a cool sounding term and misunderstanding it completely. What is your take on this? Do you go with the ye olde terminology, or the currently accepted terminology in fancy publications? Do you believe the meaning changed, and if so, when and how and why?
- Obscurity4340 3y agoThe more important designation is whether a hack is "zero-click", meaning it requires no user interaction.If such is the case, it cannot truly be defended against, it is purely automatic or automatistic and if your phone is on and has the conditions necessary for it to take root, it will happen without fail.
- hansoolo 3y agoI thought of it as "it has been known to the public for 0 days". Basically it has been publicly unknown before.
- javajosh 3y agoI'm confused why they waited to patch this vulnerability until it was found in the wild. Or am I misunderstanding? Is this not the same NSO zero click exploit from like a year ago?
- saagarjha 3y agoNo, it’s a new one.
- eviks 3y agoAgain iMessage? Would be nice if you could expel insecure components like that from your walled apple paradise
- dagmx 3y agoThere’s literally always been a toggle to disable iMessage since the day it was introduced to the shared messaging app.
- HDThoreaun 3y agoEvery app is insecure they just choose iMessage because every iPhone has it and you can send the payload with just a phone number making it slightly easier to exploit.
- TheDong 3y ago"slightly easier"? For someone to send me a message on signal, they have to either social engineer me into adding a number I don't know, or they have to steal a device from one of my existing contacts, get it unlocked, and send from it. There is no way for them to go from knowing my phone number to me receiving and processing an untrusted image without them first somehow becoming a contact. iMessage has no option to require friending first, before receiving unsolicited messages. That doesn't seem like a "slightly easier" thing, but a rather significant difference.
- gzer0 3y ago[flagged]
- microtonal 3y agoThat’s in line with Apple’s security note, which says that it’s a vulnerability in ImageIO: https://support.apple.com/en-us/HT213906 https://support.apple.com/en-us/HT213906 I wonder though, wasn’t Blastdoor supposed to stop these privilege escalations in their tracks?
- gzer0 3y ago[flagged]
- glitchcrab 3y agoMore LLM generated nonsense I suspect
- deleted 3y ago[deleted]
- abhishekjha 3y agoIs there a POC for the same for a novice in the hacking field? Would love to see it run myself.
- saagarjha 3y agoThe bug is in the WebP decoder. Shellcode execution is not been a thing on iOS because of codesigning. ROP is basically not a thing on new devices because of PAC.
- nicce 3y ago> The shellcode would then disable memory protections like ASLR and DEP that normally prevent arbitrary code execution. This would allow the attacker to execute a ROP gadget chain or other payload to jailbreak the sandbox and run remote commands on the device. This sounds like chicken - egg scenario. Can you clarify how original shellcode bypasses those protections? I don’t think you can disable DEP on runtime.
- vinay_ys 3y agoI would expect them to get to iCloud via this attach chain even with advanced data protection on. Which means if you are targeted, they not only get data from your iPhone but also all the data you backed up to iCloud from your other apple devices. I suspect they would be able to compromise apps like 1Password through this. Which means all services whose password and 2FA is stored together in 1Password is compromised. It is good to know lockdown mode stopped this attach chain. Given this has happened so many times, new security posture for a normal/regular security conscious person should be: 1. Disable iMessage. 2. Enable lockdown mode. 3. Disable iCloud. (If you choose to keep iCloud enabled, definitely enable Advanced Data Protection and disable iCloud Web, disable passcodes and keychain on iCloud. Disable iCloud mail – it uses 3rdparty proofpoint for scanning – more surface area for compromise). 4. Don't store password and 2FA together in the same system like 1password. Always use FIDO2 physical key based 2FA, if available.
- Obscurity4340 3y agoI cannot fathom how terrifyiny it is to be using iCloud Keychain. Would honestly rather become a new customer with Lastpass over that.
- mem0r1 3y agoI wonder why Apple does not include a hypervisor in iOS, and "risky" processes such as iMessage, Safari (maybe a Secure Safari version) could then be executed in a separate virtual machine. The hardware (CPU + RAM) in the iPhones these days should be able to sustain it. Or would there be serious drawbacks to this ?
- siikanen 3y agoI guess degrading battery life is the key here. The battery life is already bad enough and the competition is high to make the battery last longer
- black_puppydog 3y agoWow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place." /s
- heywhatupboys 3y agopeople will put experience on their resume building literal bombs etc. why would this be any different, it is really a non-issue in comparison
- illumin8 3y agoI don't see why companies that facilitate criminal acts are not swiftly brought to legal justice. We should not be tolerating companies like NSO group in any sense. If the Israeli government wants to look the other way, we should designate NSO group a terrorist organization and start sanctioning any country that won't bring them to justice. If Snowden and Assange can be extradited to the US and tried for crimes, executives of NSO group absolutely should as well. Lock 'em up!
- Obscurity4340 3y agoThe NSO is less of an issue to me than the fact they are finding exploits Apple isn't (assuming Apple truly isn't aware of these and/or building them in on request) and that Apple has more than enough to budget for. To me, the NSO (as evil as they are) is like a regulator who cuts through a company's "self-regulation" claims and proves that the company they are regulating is either intentionally making their own platform insecure or is at best, negligent to mitigating and being proactive in addressing obvious issues. Apple could pay all these people and companies way more than they could ever hope to earn on the free world market to simply fuck off. They are notoriously stingy with bug bounties and constantly disillusion those who are helping to ostensibly make their platforms more secure. I view NSO in a similar light to Correllium, whom Apple has tried to shutdown (unsuccessfully). Its like trying to blame a whistleblower rather than prosecuting the misconduct that comes to light. The energy and blame is misplaced and this lawsuit only distracts from the fact that iMessage is basically the skeleton key to access anything and everything on a modern iPhone, after all this time.
- aihkas 3y agoCan't believe the whole western world governments and companies can't say or do anything to stop those murderous psychopaths.
- pt_PT_guy 3y agoI always appreciate how NSO do incredible black hat security. Some of their exploits are true art. Props to their tech skills and creativity.
- sebstefan 3y agoAn exploit like that is apparently worth $2 000 000 on Zerodium. https://zerodium.com/program.html https://zerodium.com/program.html Kind of insane, the only higher you can get is finding the same on Android
- sylware 3y agoWhy there are still people who do not understand that when Big Tech talks "security", it is theirs against you, not yours?
- KernelPanic 3y agoHere are several comments regarding rewriting everything in safer languages like Rust, among others. However, before such a transition can potentially take place, I believe it's more realistic to achieve another important goal: enabling robust logging capabilities, akin to the Endpoint Security Framework on MacOS or System Events on Windows, for iOS. With the implementation of such tooling, enterprises could potentially integrate mobile endpoints into their SIEM systems, making it easier to detect attacks of this nature. I've personally utilized the mvt-ios tool to investigate iPhone backups. Within these backups, there is a SQLite file that mvt-ios scans for potentially malicious process names. (I've examined all publicly available STIX2 IOCs and having tooling that simply reports the names of processes from mobile phone to a central SIEM would be adequate for identifying these attacks.) Unfortunately, this method cannot be used in real-time across all devices. To employ it, one must first create a complete backup of the phone and then scrutinize that backup. If we had a tool similar to the Endpoint Security Framework available for mobile devices, we could activate enterprise-level security monitoring systems and potentially establish secure communications in the current era, rather than waiting for everything to be rewritten in Rust (a bit of irony).
- bjornsing 3y agoGood to see NSO loosing a valuable exploit chain. If this becomes common enough they’ll think twice about (enabling) targeting legitimate civil society organizations, for purely economic reasons: the risk of detection and reporting of vulnerabilities is much higher than when targeting terrorists and criminals.
- smashah 3y ago[flagged]
- kramerger 3y ago> "Apple is aware of a report that this issue may have been actively exploited." Wasn't this captured in the wild?? Then why the "may"?
- joshspankit 3y agoBecause PR
- illiac786 3y agoDoes someone know why this isn’t a Rapid Security Response?
- monkpit 3y agoThis kind of thing always confuses me. How can anyone assume any machine is NOT compromised already… Like… ever? You really have no way of knowing that a box is not owned as soon as it has connectivity (and possibly even before that). I feel like many people have the idea that security is “these machines are good until we detect some intrusion”. But it seems like the more sane default is “every machine is compromised and I should never trust anything ever” if you take security seriously. Maybe the latter is gaining popularity, but I still feel like the former ideology is pretty prominent.
- hospitalJail 3y ago> “every machine is compromised and I should never trust anything ever” This is where I am already at. However, you can't totally live like this in 2023. You need to take some risks. I just can't believe how bad iPhone security is STILL. Capitalism prioritizes profits over all, it seems Apple has no problem cutting on security and spending on marketing the word "SECURITY" with black text and a white background.
- deleted 3y ago[deleted]
- forcedmaddie 3y agoI worked for NSO and later at a very similar company in Barcelona. AMA
- klausa 3y agoWere you not concerned with unethical and potentially fatal outcomes of your work? I’m trying to phrase this in a way that doesn’t come standoffish - in some way you clearly _weren’t_, since you did the work. But I’m wondering whether this ever entered the picture for you, and how you dealt with that.
- forcedmaddie 3y ago[flagged]
- forcedmaddie 3y agoFor some reason my original comment got flagged. It went: I was concerned. Just as much as an average Facebook employee when it turned out someone built a psyop weapon on top of their data to manipulate elections’ outcomes.
- klausa 3y agoThat seems like a cop-out? The number of degrees of separation between average Facebook's engineer work and "direct harm to a human being" seems like it'd be orders of magnitudes higher than when working on exploits for companies with the client list like that of NSO's. Or do you not think about it in those terms?
- forcedmaddie 3y agoBut number of affected people and the scale of impact was also on another order of magnitude. Moreover, that tool depended on private companies that operated without any oversight. It’s a very different situation for exploits (although I agree that they often end up in the wrong hands) NSO is probably one of the worst offenders when it comes to screening their clients. This raises ethical issues. It was a factor for me and many of my former colleagues. However, for every abusive operation that gets exposed, there are many legitimate ones conducted by democratic governments. I think we are far from a mass-surveillance scenario, and those exploits are not as widely available as the media might portray.