9 ms·
Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage e
by pseudo0 3y ago
Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff.
If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.
- kylemh 3y agosure, that's why China is banning gov't officials from using their devices...
- zshrc 3y agoPlease... Androids no better. At least Apple will have it patched within the year of discovery. Can't say the same for other Android vendors.
- teawrecks 3y agoInteresting how your response makes it seem like the person you're responding to mentioned android at all.
- acdha 3y agoI think it’s safe to assume that most people know that’s the only other common choice.
- Gigachad 3y agoAndroid is moving away from C and towards more secure languages. From one of their recent blog posts, the majority of code written for android is now in memory safe languages.
- berbec 3y agoIs the programming language likely the issue here?
- carstenhag 3y agoWell, theoretically all can be secure (in regards to buffer overflows etc). Some just forbid to shoot you in the arm. And head.
- tialaramex 3y agoOf course, it's not necessary to use a language where "Give control of your phone to remote attackers" is one of the possibilities at all. General purpose languages, whether that's something like C or Rust or even Javascript are not the appropriate tool. Turing Completeness is a bad idea from a security point of view, not a wonderful feature.
- Gigachad 3y agoYes, almost all of these major exploits are memory safety related and would be mostly impossible in a memory safe language.
- btilly 3y agoThat's like asking whether it is the lack of a seatbelt that was the issue after sometime died in a car crash. Well, of course the real issue was the car crash. But wearing a seatbelt would have sure helped!
- nielsbot 3y agoApple also has memory-safer languages it is moving to: Swift: A memory-safer systems programming language: https://www.swift.org https://www.swift.org Firebloom: A memory-safer C variant: https://support.apple.com/en-il/guide/security/sec30d8d9ec1/web https://support.apple.com/en-il/guide/security/sec30d8d9ec1/... Not sure what the answer is for existing memory-unsafe code.
- ctz 3y ago> Not sure what the answer is for existing memory-unsafe code. It's an engineering approach that involves writing "A buffer overflow issue was addressed with improved memory handling" an awful lot. Hopefully one day they will finish improving the memory handling!
- saagarjha 3y agohttps://www.youtube.com/watch?v=lgivCGdmFrw https://www.youtube.com/watch?v=lgivCGdmFrw
- tialaramex 3y agoAnd for this problem specifically Android can use WUFFS. WUFFS is a special purpose language for Wrangling Untrusted File Formats Safetly. Trading away generality (the ability to write a program which say, sends email) gets them complete safety and excellent performance. In Rust we can't trivially write a bounds miss by mistake. But in WUFFS we just can't write a bounds miss at all. Like, that's not a thing in WUFFS, it doesn't compile. You can write your own bounds checks and show WUFFS that works, or you can write code which clearly can't have a bounds miss with no checks, that works too. But you can't just "forget" or "screw up" those won't compile. This would be frustrating in a general purpose language. WUFFS doesn't have a "Hello, World" program because it lacks both strings and the idea of outputing to the screen. But WUFFS isn't a general purpose language, however it's the correct way to write the code that takes image files we got from some dubious source and processes them. When Apple announced they wanted to provide proper security for vulnerable iPhone users, this is what that would look like coming from a company which actually cared about security. What you got is what it looks like from a company which prioritised marketing.
- saagarjha 3y agoWould any of your comment change if I told you the bug was in a Google image parser that they currently also ship to production?
- teaearlgraycold 3y agoGoogle at large is slowly banning use of non memory safe languages. Android in particular is doing well at adopting Rust.
- kernal 3y ago>Please... Androids no better. The Pixel is. >At least Apple will have it patched within the year of discovery. Can't say the same for other Android vendors. And the Pixel would have the patch released quicker.
- chaxor 3y agoThe pixel is decent if using graphene is. Not sure if any system is good by default. Apple fans think their defaults are somehow more private or secure, mostly due to marketing.
- kernal 3y agoDecent? From a security perspective it's superior to the iPhone. As for Graphene, unless you've personally vetted the code I don't see how it can be trusted. And I won't even go into the drama that OS comes with.
- paravirtualized 3y ago> unless you've personally vetted the code I don't see how it can be trusted. As opposed to proprietary Google code that cannot be vetted?
- kernal 3y agoWhat about the proprietary binary blobs that Graphene is reliant on? Who vetted those?
- paravirtualized 3y agoI think that we both can agree that less = better, so I don't see your point.
- imchillyb 3y agoPixel is not an OS, is not Android. Pixel is a series of hardware that make up less than five percent of the android hardware market. One device series does not offer a glimpse of the market. Op’s point stands.
- ok123456 3y agoOn Android you can disable automatic link preview and downloading of MMS messages. You can also swap out the application that handles text messages entirely. This eliminates this whole class of attack.
- ajross 3y agoAlso the application that handles text message is itself sandboxed and limited to a fixed set of permissions (to be fair, that include messaging other humans, so an exploit would still be very bad, just not "remote root" bad). That's the part that is still unclear with this BLASTPASS business. Surely iOS isn't running the messaging app as a device root, right? There's some other presumably-unpatched privilege elevation attack going on?
- saagarjha 3y agoYes. The ImageIO vulnerability just allows for an initial foothold.
- ChrisMarshallNY 3y agoI have friends with Android phones that are running 5-year-old operating systems. I have one friend that absolutely refuses to update his 7-year-old Samsung. I got the fix on my phones (including my 8), iPads and Watch, today.
- indymike 3y ago> Androids no better. That does not make the situation right for Apple.
- fomine3 3y agoYou can just avoid crappy Android vendors. 1 year is low bar.
- l33t7332273 3y ago>no wonder China is banning government officials from using their devices. Do you actually think security is the reason they are being banned? I think the reasons are far more political than technical.
- pyinstallwoes 3y agoTechnology is political.
- CatWChainsaw 3y agoHard truth for people to hear, here. So many insist that all technology is neutral. It's really satisfying to watch the super "enlightened/rational/logical" crowd react emotionally though.
- pmontra 3y agoTo foster your point, I quote a comment from another post on HN now > And the whole reason for the hydrogen burning [by SLS' engines] was to keep the space shuttle contractors jobs. Once again it's not a technical reason but a pork barrel one.
- bawolff 3y agoAll things are political and technology is a thing. That doesn't mean you can't analyze if a specific technical decision was made primarily on technical grounds/merit or if it is mostly a political one without a technical basis.
- pbhjpbhj 3y agoSame reason USA have forced Huawei to be banned around the place.
- m3kw9 3y agoSometimes even if they wanted to ban purely for security reasons, it would be blocked because it could trigger political repercussions, or seen as a offensive move by the opposition country
- 3y ago
- NegativeK 3y agoIf you show me software that's immune to advanced 0-days, I'll show you software that isn't usable.
- ketralnis 3y agoThat's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché. We can and should improve development practises, mitigate vulnerabities (ASLR, WAFs, etc), isolate systems from each other, and model threats in a way that we know where and how to do those things. It's not easy but just moaning "everything sucks" isn't how to fix it.
- otterley 3y agoApple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.
- mensetmanusman 3y agoNot only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.
- sudosysgen 3y agoIt's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.
- PradeetPatel 3y agoDifficult often implies additional resourcing and development related costs. Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values. Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.
- npteljes 3y ago>no wonder China is banning government officials from using their devices A totalitarian regime can have a different, plausible reason: no sufficient control over said devices.
- Obscurity4340 3y agoiPhones can be provisioned with pretty extensive profiles/MDM so I doubt that part. They probably see all the zero-days and decide game respects game. Just not secure enough for such an incredibly insular power structure as theirs, even without the US connections.
- npteljes 3y ago>decide game respects game Elaborating on this, the US banning Huawei doesn't help either.
- Obscurity4340 3y agoI don't get why they wouldn't already insist on Huwawei and HarmonyOS unless this is more of an Inner Party issue where all the high-ups use iPhone intentionally because its more private than Huawei I wonder what phone Z has been using all this time...
- bombolo 3y ago[dead]
- darkclouds 3y agoA few years ago kaspersky caught something that had to be removed by their rescue ISO. That ISO was blocked from downloading its updates and their UK support team couldn’t resolve the issue so never got to find out what it was, but it doesn’t look good there was a block preventing it from working.
- goffer 3y agoChina not worried about 0-clicks on Apple. They are worried about US-Apple collusion with iOS software.
- jbverschoor 3y agoI think they're more concerned that Apple is moving parts of manufacturing out of China.
- davisr 3y agoHow on Earth do you not see how those are related?
- lxgr 3y agoWho needs zero-days if you control the entire software (client and server side) and hardware ecosystem?
- internetter 3y agoIt's impossible to create a backdoor that can only be used by the intended party
- alphabetting 3y agoFunny because at the same time US govt is worried about China-Apple relationship
- deepfriedrice 3y agoThe article references Lockdown mode [0] which appears to be Apple's solution for this (and other) class of zero days. [0] https://support.apple.com/en-ca/HT212650 https://support.apple.com/en-ca/HT212650
- tialaramex 3y agoLockdown mode means you're able to use less stuff. In this case the "pass" feature doesn't exist in Lockdown mode and that's the attack target AIUI. So, if most people don't use it (because less stuff works) then it can be "successful" statistically because maybe the attackers aren't targeting the stuff you're allowed to use and you don't get exploited. But this isn't a stable solution really. If Lockdown is popularized, NSO obviously will attack the things which are available in Lockdown. Apple shows no sign of only allowing it in Lockdown once it's actually safe - instead they've just arbitrarily decided what to allow and what not to allow.
- jdright 3y agoNot entirely true because NSO (or their clients) have very specific target requeriments. If they want to target another Jamal Khashoggi and lockdown mode is used, they have their incentive to buy and create the demand for any 0day that they can then re-sell to their lovelly clients. No need statistics for this, the incentive is purely greed.
- Closi 3y agoLockdown mode massively reduces the attack surface, which would make it far harder to find an exploit.
- fh9302 3y agoThe downsides of using Lockdown Mode are minimal and well worth if you are an at-risk target. It's about reducing the attack surface and potentially getting notified if nation state actors try to attack your phone.
- saagarjha 3y agoThe list is not arbitrary, but generally based on remote attack surface.
- ssss11 3y agoHahha what? True banned them because they’re American. There may be some zero days that NSO has exploited but it’s nothing like the cluster that is Android.
- deleted 3y ago[deleted]