14 ms·
Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcan
by ruuda 3y ago
Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution!
[1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- hot_gril 3y agoAnd a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.
- l33t7332273 3y agoI would describe a one click rootkit as terrifying as opposed to wonderful.
- c0pium 3y agoIf it makes you feel better the click was actually unnecessary theater.
- dhosek 3y agoYeah, the whole way that the jailbreaks installed was scary enough for me to never want to go near them.
- hot_gril 3y agoYour phone would reboot with a pineapple logo and console messages flying across the screen like a 1337 h4cker, starting with the "regents of the University of California, Berkeley" message. Then you'd go install a ton of Cydia hacks.
- l33t7332273 3y agoWhat is the significance of the “regents of the University of California, Berkeley” message? Is it the FreeBSD boot message?
- lxgr 3y agoRunning an exploit against any visiting device without a disclaimer/button probably gets you into very spicy territory from a legal point of view.
- deleted 3y ago[deleted]
- hot_gril 3y agoIt was a different time. There was nothing on my iPod touch that mattered enough.
- hot_gril 3y ago(And I could even patch the vulnerability via jailbreaking, haha)
- midasuni 3y agoI also find the inability to get root on my device terrifying
- pxmpxm 3y agoI guess you've never had sudo before.
- l33t7332273 3y agoI don’t see the analogy. If I could visit a website and it runs sudo commands on my machine without my input then I would be scared.
- hot_gril 3y agoOr non-sudo commands for that matter
- acdha 3y agoThis is the frustrating part: that is cool from a technical perspective but terrifying when you think about this stuff being used to target journalists, activists, etc. Maybe not everyone gets the bone saw but some will - and from the sounds of it it’s people standing up to abusive people: > Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.
- 14 3y agoWhat is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?
- cumshitpiss 3y agoIt continues to exist because state governments have an interest for it to exist Check out The Palestine Laboratory: How Israel Exports the Technology of Occupation Around the World
- mensetmanusman 3y agoIf they didn’t exist it would be a different company in Russia or China. The demand exists.
- mrbombastic 3y agoMaybe that’s true, it probably is, but they should still be sanctioned into oblivion considering they consistently are in the headlines on the wrong end of this being used for deeply questionable purposes.
- kevin_thibedeau 3y agoThe US enjoys some fruits of their labor and they're conveniently distanced from any explicitly funded operations to avoid blow back when exploits are publicized. They won't enforce sanctions or, more practically, withhold the massive defense subsidies they give to Israel.
- koito17 3y agoHuh? I could've sworn the TIFF bug was during the iPhoneOS 1.x days. I recall jailbreakme's exploit using corrupted fonts in a PDF, not TIFF images. A quick Google search led me to this https://appleinsider.com/articles/10/08/03/browser_based_ios_jailbreak_utilizes_scary_pdf_security_hole https://appleinsider.com/articles/10/08/03/browser_based_ios...
- dunham 3y agoYeah, the tiff bug was one of the the first few iOS jailbreaks. The wiki says 1.0-1.1.1: https://www.theiphonewiki.com/wiki/LibTiff_Exploit https://www.theiphonewiki.com/wiki/LibTiff_Exploit I wrote a patch to fix it that one of the jailbreaks used. I wasn't in the scene, but wanted to protect my ipod touch. So I figured out a patch and gave it to somebody named "pumpkin" on IRC. It's been a long time, but I remember it was fun to learn ARM assembly and figure out how to rewrite the code to get enough space to insert a test and return.
- hot_gril 3y agoYou're right, iOS 4 jailbreakme was PDF. But jailbreakme also existed for 1.x, using TIFF. https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
- jahewson 3y agoJBIG2, I should have known! Interesting that bug came not from Apple but from Xpdf.
- rakkhi 3y agoAgain buffer overflow in image decoding. Would think apple might just #threatmodel and #fuzz that to death... but you would be wrong. 2.7T market cap company can't do this...
- stefan_ 3y agoApple has a long history of investing in all kinds of mitigations and security devices that make the App Store model secure and an equally long history of procrastinating on what is again and again and again causing their customers to be exploited.
- jijji 3y agoplausible deniability?
- mensetmanusman 3y agoApple isn’t going to have internal bounties that can compete with nation state budgets.
- washadjeffmad 3y agoApple is a nation state.
- TheSpiceIsLife 3y agoApple has more employees than Kiribati's population. More employees than the smallest 60 countries.
- saagarjha 3y agoMost of those people are not engineers.
- TheSpiceIsLife 3y ago
- crazygringo 3y agoWhich actually makes me more sympathetic to Chrome not (yet) adopting JPEG-XL. Don't get me wrong, I think JPEG-XL is a great idea, but to everyone saying "how can supporting another image format possibly do any harm", this is the answer.
- lxgr 3y agoWhy not implement all image codecs in a safer language instead? That would seem to tackle the problem at its root rather than relying on an implementation's age as a proxy for safety, given that that clearly isn't a good measure.
- crazygringo 3y agoThat's a great question, and I'd love to know the answer.
- lxgr 3y agoOften it's infeasible to justify rewriting a lot of existing code, but my point is that these days this concern shouldn't really be an obstacle to integrating a new codec.
- azakai 3y agoIt should certainly lower the bar of adopting a new codec if the implementation is in a memory-safe language. Even so, it is more code, and somewhat more risk. Lack of safety elsewhere might end up using code that is otherwise safe in order to build an exploit (by sending it something invalid that breaks an invariant, or building gadgets out of it, etc.).
- bombolo 3y agoAdding something in rust into a browser means you now need to bundle all of the needed crates and that your browser now also needs rustc to build… at a minimum. You also need potentially to audit all the crates and keep them up to date and so on… without crates you can't do so much.
- sprite 3y agoWow that’s impressive.
- tlrobinson 3y agoMaybe a dumb question, but why are media decoders, which are notoriously high risk, not well sandboxed?
- cma 3y agoIt makes no sense, especially for things like thumbnails in file viewers.
- saagarjha 3y agoThey are.
- aaomidi 3y agoAnd why haven’t they been rewritten yet considering it keeps happening.
- UncleMeat 3y agoIt takes a while. At Google at least, new systems in android are required to be built in rust and there are major efforts to rewrite significant systems. But it takes time and rewrites are dangerous in other ways. And you need all the tooling to handle everything else an engineer does beyond simply writing code. From where I sit, it also feels like the industry has really only coalesced around "the only real solution is safer languages" in the last 2-3 years. "Rewrite it in swift/rust" was way more controversial in 2019. So hopefully we'll see significant progress in the next several years.
- tambourine_man 3y agoI’m not much into security but I’ll never forget this one. Fascinating.
- internetter 3y agoSomebody know articles like this on different exploits? What a great read!
- kylehotchkiss 3y agoUgh, apple needs to drop these antique image parsers
- anoncow 3y agoWill Rust be able to prevent such overflows?
- xxs 3y agoImage decoding can be ported to rust, however most video/image decoding software is rarely ported (performance reasons and what not) - and used as a library instead. Java would have similar issues as well. It'd be using a compiled C code as an external library in cases like these.
- deleted 3y ago[deleted]