12 ms·

0-days exploited by commercial surveillance vendor in Egypt

534 points by mikece 3y ago

mrwnmonm 3y ago
[dead]
Veserv 3y ago
Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration attackers with a basic attack potential" [4]. This is four entire levels lower than "demonstrating resistance to penetration attackers with a moderate attack potential" [5]. Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers despite nearly unlimited resources are regularly defeated by moderate attacks like commercial surveillance companies. They certify that they absolutely, 100% can not. [1] https://support.apple.com/guide/certifications/ios-security-certifications-apc3fa917cb49/1/web/1.0 https://support.apple.com/guide/certifications/ios-security-... [2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11238-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... [3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page14 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 14 [4] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page16 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 16 [5] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20
- deleted 3y ago
  [deleted]
- vuln 3y ago
  Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?
  - alephnerd 3y ago
    You as a private consumer wouldn't be able to buy one of these EAL4+ products without a relationship with a defense and security oriented reseller.
  - selectodude 3y ago
    https://www.commoncriteriaportal.org/products/index.cfm https://www.commoncriteriaportal.org/products/index.cfm? Generally only components are EAL certified. For example, the iPhone is not on there, but the security protecting access to Apple Pay on the iPhone 13 with A15 Bionic running iOS 15.4.1 (19E258) is EAL2+.
  - Veserv 3y ago
    Sure. The Common Criteria for Information Technology Security Evaluation [1] is the foremost internationally recognized standard (ISO 15408) for software security that most large companies certify against for at least some of their product portfolio. I believe there are US government procurement requirements to that effect, so many systems will have certifications of some form. For many companies you just search: "{Product} Common Criteria" and they will usually have a page for it on their website somewhere. You can also go directly to the certified products page: https://www.commoncriteriaportal.org/products/ https://www.commoncriteriaportal.org/products/ For smartphones you can see them there under "Mobility". Unfortunately, it is fairly hard to parse if you are not familiar with the terminology. The general structure of Common Criteria certifications is Security Functional Requirements (SFR) which are basically the specification of what the product is supposed to do and the Security Assurance Requirements (SAR) which are basically how you certify the SFRs are met (and what level of assurance you can have that the SFRs are met). SARs can be bundled into Evaluation Assurance Levels (EAL) which define collections that reasonably map to levels of confidence. You can add SARs beyond the current EAL which is how you get a EAL level with a +, but it is important to keep in mind that just cherry picking certain SARs does not necessarily give you a holistic assurance improvement. SARs and SFRs can be further pre-bundled into Protection Profiles (PP) which basically exist to provide pre-defined requirements and testing methodologies instead of doing it one-off every time. Some Protection Profiles support variable EAL/SAR levels, but these days people generally just certify against a Protection Profile with a fixed SAR bundle. This is what PP Compliant means. If you want to see what they certified against, you would need to look at the Protection Profile itself. For smartphones, the standard Protection Profile for the phone itself is Mobile Device Fundamentals. If you look at the SAR bundle there you will see that they correspond to EAL1 + a small number of EAL2, resulting in a overall level of EAL1+. As they are in-between EAL1 and EAL2 I just classified it as EAL1 for my earlier post. If you peruse further you will see that basically every Protection Profile that companies certify to as PP Compliant are basically the same EAL1+ or thereabouts. So, if you see PP Compliant, it probably means EAL1+ or so. Hope that helps. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/
- alephnerd 3y ago
  > neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA levels (EAL4+) for Common Criteria. You just gotta pay more and purchase via the relevant Systems Integrators. A consumer product line like the Apple iPhone isn't targeting DoD buyers. That's always been Blackberry Ltd's bread and butter
  - Veserv 3y ago
    I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in products that failed a EAL5 certification without a total rewrite. It used to say that in the standard somewhere, but the standard revisions have moved it so I can not quote it directly. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20
    - alephnerd 3y ago
      Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification. Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4. Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside). Least Priviliged Access, Entitelement Management, Identity Enforcement, etc are all much easier wins and concepts that haven't been tackled yet. Companies will provide EAL5+ if the opportunity is large enough, but it won't be publicized. Iykyk. If not, chat with your SI.
      - 3y ago
- manuelabeledo 3y ago
  > Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. So, OK I guess? It's worth noting that CC evaluation does not score the actual practical security of a device or system, but the level of testing it was submitted to, which is consistent with pretty much every single governmental certification out there.
  - Veserv 3y ago
    Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack potential". You are complaining that the 40 cm high jump test does not score actual jumping ability. You are right, it is a low bar that they should all be able to pass. You can not use the 40 cm high jump test to distinguish them. What you need to do is use the 100 cm high jump test. Some can pass it, but none of the large commercial vendors can. Sure, it would be nice if we had more gradations like the 60 cm and 80 cm tests, but we do not really know how to do that, so the best we can do is the 100 cm test.
    - manuelabeledo 3y ago
      I'm not really complaining, though. I'm just saying that security certifications are more about compliance than actual proof that a system cannot be easily compromised. In other words, they are more about legal requirements than guarantees. It is also misleading to assert that a device or a system are less secure because they haven't been certified. Vendors submit requests to validate against specific levels or certifications, and it is not the goal of the certification authority to determine "how high" they score.
      - Veserv 3y ago
        They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. I am judging them by their maximum ability ever demonstrated under the most favorable circumstances and they still can certify resistance against moderate attackers. They have never developed systems that can protect against the prevailing threat landscape and they can not develop such systems. Their best is not good enough.
- insanitybit 3y ago
  I mean, it occurs to me that maybe all of these companies aren't doing this for a reason - because common criteria and compliance are often stupid and don't represent real security. Perhaps these policies are the exception? But I've managed SOC2 for example and I can definitely say that there are plenty of ways to get your SOC2 without giving a shit about actual security.
  - Veserv 3y ago
    They failed. Repeatedly. For decades. They spent billions trying. The failed so much that the standard writers determined the only logical conclusion is that it must be practically impossible to retrofit a system that failed EAL5 certification to achieve EAL5 or higher certification without a complete rewrite and redesign. It says so right there in the standard [1]: "EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line". That was added due to the decades of experience where everybody who ever tried to do that failed no matter how much time or money they spent. We also have plenty of evidence that it does matter, they just can not do it. Here is Google touting their Common Criteria certification for the Titan M2 security chip hardware which is EAL4 + AVA_VAN.5 (resistance against penetration attackers with a high attack potential) [2]. Note that this is only the hardware (software was not certified; a critical severity vulnerability was actually disclosed in the software allowing complete takeover if I remember correctly) and only cherry picks AVA_VAN.5 so is still only EAL4, not a holistic EAL6 certification. Getting that certification was a deliberate effort and cost. If they literally did not care about the Common Criteria then they would just certify to the checkbox level like everybody else. It is because they could certify it to a higher level than most other can achieve that they chose to do it because then they could tout their unique advantage. Basically everybody gets a certification and basically everybody displays their certification on their page. There is something to be said about them opting for a EAL1 over a EAL4. It is basically assumed that any serious vendor could probably get a EAL4 with some effort. So, there is no differential advantage to displaying a EAL4 since everybody could get it. It is just a zero-sum game to pay for certification if everybody knows nobody has a true advantage. However, if you can achieve EAL5 or higher, then you do have a unique advantage because basically nobody else can do it. The fact that none of the major vendors attempts EAL5, shows that they can not do it. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 18 [2] https://security.googleblog.com/2022/10/google-pixel-7-and-pixel-7-pro-next.html https://security.googleblog.com/2022/10/google-pixel-7-and-p...
- kramerger 3y ago
  Isn't EAL1 what you get for just showing up? Basically, here is the product. Here are some design documents. We don't have anything more. Can we get our EAL1 please?
  - Veserv 3y ago
    Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed in: "ios vulnerabilities" into Google and then typed in "ios iphone" into the NVD and verified that all of the search results were fixed. AVA_VAN.1 certification please. To explain why, AVA_VAN.1 does not require a independent security analysis, it only requires a survey of the public domain for known vulnerabilities [2]. You need AVA_VAN.2 (which is only required in EAL2 and EAL3) before they actually attempt to look at for vulnerabilities themselves. [1] https://www.commoncriteriaportal.org/files/epfiles/st_vid11237-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid112... [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154
- wepple 3y ago
  There is a near zero chance that being EAL4 or higher certified would’ve prevented these attacks. CC might be better than PCI-DSS, but not by much.
- dang 3y ago
  Please don't post "regular reminder" style comments - they're too generic, and generic discussion is consistently less interesting. Good threads require being unpredictable. The best way to get that is to respond to specific new information in an article. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - deleted 3y ago
    [deleted]
- tptacek 3y ago
  Common Criteria EALs have nothing whatsoever to do with practical security. I'd be surprised to hear anybody on this site who has managed a CCTL security review for a product saying anything positive about the program. A fun exercise: find a list of commercial mainstream products with "high" EAL audits, and then look at their vulnerability histories.
  - Veserv 3y ago
    Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?
    - tptacek 3y ago
      The archetypical EAL5 product is a smartcard or cryptographic coprocessor (same thing, different package). They're certifiable because they don't do much. But if you'd like an example from the EAL4 list: start with FortiOS.
      - Veserv 3y ago
        EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect against “casual and inadvertent attacks”. The general crappiness of EAL4 goes all the way back to the Orange Book where EAL4 maps approximately to Level C2 (contemporaneous projects got certified to those levels simultaneously). That level was intentionally meant for toys before they put on their big person pants and release a grown up product with actual security [1]. It is a mystery why anybody thinks EAL4 and security belong in the same sentence. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an...
        tptacek 3y ago
        If you're saying "EAL4 and below is junk" (I'd say EAL* is junk, but whatever), all you're really saying is that minimal-function cryptographic coprocessors are safer than operating systems and applications. Well, yeah, sure. I don't think you needed the farce of Common Criteria to tell you that, though. But upthread, you knocked Apple for not achieving an adequate assurance level. As you can see now, and from your own last comment, that doesn't make any sense. It's possible (though deeply silly) that there's some iPhone configuration that could "achieve" EAL4, but you yourself don't believe that has any meaning. I don't either. I don't think EAL5 or EAL6 do, either, except that if you tell me your product is EAL5, I'll assume it's a small fixed-function device.
Macha 3y ago
It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels there's nothing preventing someone putting this in an ad campaign or sms/discord/matrix/whatever spam and spraying it everywhere to build a botnet or steal user credentials or whatever.
- waihtis 3y ago
  Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
  - Macha 3y ago
    There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing, implies there should be an exploit chain but we've only been told of the first.
    - waihtis 3y ago
      Gotcha, thank you.
    - insanitybit 3y ago
      There's also SELinux on Android.
    - tester756 3y ago
      that sounds like terrible joke sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox and stuff still manages to escape
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]
shmatt 3y ago
Another company founded by ex-Israeli intelligence. The funny thing about exploits is, once hundreds of employees or soldiers have access to the exploit, they don't need to physically copy the code. They just need to understand how it works, to then open 10 other companies that use the same exploit, or sell it to 20 other companies on the dark web. Although the IDF is great at stopping people from copying files outside of their networks, it can't stop people from remembering what they did during their service
- alephnerd 3y ago
  For every 1 zero day, there are around 10-20 others that haven't been publicized. You can make plenty of money by trying to find a niche and concentrating on that (eg. android exploitation, iOS exploitation, Windows exploitation, APAC buyers, US Defense buyers, Middle Eastern buyers, EU buyers, etc).
- deleted 3y ago
  [deleted]
- KirillPanov 3y ago
  One of these days people will wake up and realize that carrying a networked gps tracker with a microphone in their pocket is a really dumb idea.
alephnerd 3y ago
Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-menendez-indictment-00117627 https://www.politico.com/news/2023/09/22/egypt-guns-money-me...
- lainga 3y ago
  Hey, they nearly destroyed the Ottoman Empire in the 1840s...
- deleted 3y ago
  [deleted]
- KoftaBob 3y ago
  Probably part of the long running (now peaceful) rivalry they have with Israel.
  - alephnerd 3y ago
    Yep! Totally forgot about that!
- WarOnPrivacy 3y ago
  > Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military At a federal level law/power is continually traded for cash/favors. Heck, DoJ itself gets deployed in response to lobbyist demands (eg:copyright enforcement). From what I see this case was egregious and involved a non-favored foreign state. Maybe that's the bar at which DoJ begins to care about political ethics.
  - calgarymicro 3y ago
    > involved a non-favored foreign state Egypt is not 'non-favored'. The US has very close ties with Egypt's dictatorial regime[0], despite its awful domestic human rights record[1]. [0]https://thehill.com/blogs/congress-blog/foreign-policy/585521-egypt-us-relations-at-100-years-a-partnership-that-is-more/ https://thehill.com/blogs/congress-blog/foreign-policy/58552... [1]https://www.amnesty.org/en/latest/news/2022/09/egypt-human-rights-crisis-deepens-one-year-after-national-human-rights-strategy-launched/ https://www.amnesty.org/en/latest/news/2022/09/egypt-human-r...
hedora 3y ago
Though HTTPS is better than nothing, and this attack relies on HTTP to inject the initial payload, state sponsored attackers in some countries can likely just subvert CA or CDN infrastructure instead.
- pipo234 3y ago
  Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me
  - jefftk 3y ago
    > certified by our beloved LetsEncrypt Are you saying that CAs should be refusing to issue certs for potentially spoofed domains?
    - pipo234 3y ago
      ...or Digicert, Globalsign, the Hongkong post office, whichever CA is in your truststore. I just mentioned LetsEncrypt because it's free and exceptionally easy to use. I'm not implying in any way they aren't providing a great service, it's just that that service also gets misused because it's cheap and easy.
      - xcdzvyn 3y ago
        It really sounds that way, FYI. I interpreted it as a dig at LetsEncrypt in particular.
        pipo234 3y ago
        Please accept my apologies :-)
        xcdzvyn 3y ago
cotillion 3y ago
Ouch. Apparently Firefox has "Https First" also but requires the pref dom.security.https_first to be set. "HTTPS-Only Mode" is obviously best if you can do that.
- rany_ 3y ago
  You'd still need to resist the urge to not press "allow me anyway" and to be honest, even I'd click it knowing the risk (I just want to visit the damn site!). This doesn't solve anything unless the prompt is extremely suspicious (like the prompt showing for Google.com or some other site I know supports HTTPS).
  - rany_ 3y ago
    Replying to myself but also, they could easily trick you into clicking some link and exploiting you that way. HTTP isn't the issue here, it's just being exploited so they don't have to get you to click some link. In all likelihood they'd do that if the less direct/obvious method of transmission didn't work.
AtNightWeCode 3y ago
I don't get it. If it is over http then you can play around with anything in a proxy. You have no TLS tunnel so it is not encrypted. It is by design.
- vngzs 3y ago
  That's just the delivery method, not the exploit.
- d3w4s9 3y ago
  Yes it is not encrypted and the response returned from server can be modified to anything and ask for password etc, but that is far from an exploit that runs native code.
aborsy 3y ago
I’m not an expert, but would’t a VPN (commercial or to a server with known exit IP) prevent such attacks? It will kick out the MITM. Also I wonder if the lock down mode could block it.
- fullspectrumdev 3y ago
  Yes and also yes. These attacks when launched by government entities pretty much always rely on placing a box at the ISP that does the targeted interception/MiTM against a subset of subscribers. So using a VPN would ensure your traffic is tunnelled “beyond” their reach. Lockdown mode also would have prevented the iOS exploit chain, apparently.
toasterblender 3y ago
Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?
- entuno 3y ago
  Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle.
  - cco 3y ago
    > Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. For moral reasons do you mean? I would be surprised to learn there are a lot of people that are open to selling 0 day exploits to "bad actors" (granted that this term is doing a lot of heavy lifting here), but wouldn't want to work for Google or Apple. > ...it'll just be a never-ending cycle I think the idea is you pay them so well that they can work for a handful of years and remove any cash incentive reason for them to continue selling 0 days to bad actors.
    - eastbound 3y ago
      > “bad actors", but wouldn't want to work for Google or Apple - Everyone who doesn’t like US hegemony. Which happens about everywhere but US, in varied proportion, but even in Europe, and even worse in Middle-East, - Everyone who doesn’t like monopolies. Capitalism of competition (as opposed to state capitalism, when the state borrows a trillion per semester, ahem) requires that monopolies be broken down to avoid distortion of competition. Helping bad actors can be, under their viewpoint, less bad than the damage done to a billion consumers consumers at a time. Plus monopolies impose a monoculture of occidentalism, with certain values that a firm in Egypt might consider worse than sponsoring bad actors.
arkj 3y ago
Google search to intellexa results in an http site which got redirected. I am now installing the update.
deleted 3y ago
[deleted]
mtu9001 3y ago
Some men just want to watch the world burn.
fh9302 3y ago
The article doesn't mention it but Lockdown Mode on iOS blocked this exploit chain.
adm_ 3y ago
Related recent episode of Darknet Diaries about the Predator spyware: https://darknetdiaries.com/episode/137/ https://darknetdiaries.com/episode/137/.
boothemoo 3y ago
This vulnerability was most probably used by the Egyptian authorities to hack the mobile phone of the presidential candidate Ahmed El Tantawy who is competing with the current president Abdel Fatah El Sisi over presidency. https://x.com/jsrailton/status/1705271600868692416?s=46&t=KqcSzL3cJ9pV2lTJaJhL5g https://x.com/jsrailton/status/1705271600868692416?s=46&t=Kq...
account-5 3y ago
I've a question. This 0-day is a 0-click that didn't require any document download or anything. Simply visiting a http site would do it. What if you have JavaScript disabled be default. Would this exploit still work?
- bananapub 3y ago
  it's http interception so no, I doubt javascript matters at all
  - lucb1e 3y ago
    Without knowing more, that's a bit of an assumption. The vulnerability could be in image decoding, in which case an <img> tag is enough and no scripting is needed, but it could also very well require doing something funky with JavaScript.
    - bananapub 3y ago
      if it required javascript then it was already an exploit without the mitm
- saagarjha 3y ago
  Needing to visit a website makes it a 1-click attack, unless you can do passive redirection.
swordbeta 3y ago
Is the commit containing the fix for the v8 bug 1473247 CVE-2023-4762 available anywhere?
bingobongodude 3y ago
I am pretty sure I was hit with this. I had some REALLY weird redirects coming from text msgs. NOT from Egypt. Maybe paranoid. Offline / on new Linux devices for now.
- deleted 3y ago
  [deleted]
- saagarjha 3y ago
  Text messages with links that do weird redirects aren’t too unusual. What makes you think you were a target?
qingcharles 3y ago
I can't help but think Google cheekily outed the domains the vendor was using as a way to target some vigilante justice upon them.
1letterunixname 3y ago
If I were a government security regulator or intelligence agency, I would monitor bank accounts associated with Zerodium and similar 0day and payload marketplaces and offensive sec tools to issue a secret, internal threat forecast that marks the beginning potential of increasing, directed, high-value attacks. Probably already exists in various forms, but taking it semi-public to sensitive industries might be useful.
- saagarjha 3y ago
  This is basically “can the government prosecute money laundering and tax evasion”.
deleted 3y ago
[deleted]
crumpled 3y ago
The Citizen Lab post linked from this article has the details of the MITM attack. It's almost not even an attack, the network is designed to do content injection on demand.
sylware 3y ago
Ofc, the "services" have enough CA certificates private keys to legitimate any "man-in-the-middle" attack for any browsers. Worst case scenario they have root-kits they can easily inject on user systems in order to intercept some trafic before encryption. They have probably a significantly sized "library" at their disposal to work from, depending on the "targets", and it could even be kind of automated (up to a certain point) with proper finger-printing of user system/components. Presuming the other way around would be unreasonable.
vinay_ys 3y ago
What these 0days teach us is that if you are a person in the crosshairs of powerful adversaries you have to be super-paranoid and reduce your target surface to as small as possible. If you are James Bond and you want to have secure communications with M, you are better off using a custom appliance type mobile device meant only to do that one function and nothing else. You will have to rely on anonymous 3rd-party burner devices to leave messages encoded in pre-agreed sequence of rotating geo-locked codebooks on random message boards. Any less opsec and you are toast! If you are a normal human-being using connected digital devices normally, then you should assume anything you put on those devices is already stolen. If you want to keep things truly private, keep it off digital (paper, old-school analog tape etc). Then, at least they will have to physically steal it from you – which, depending on the situation, might be much harder for them, but not necessarily much safer for you. So, you lose either way. Only real way out is to have well-functioning democratic governments with strong transparency and checks and balances with strongly enforced privacy laws to protect its constituents from both domestic and foreign adversaries and strong support for initiatives like Citizen Labs.

534 points by mikece 3y ago

[dead]

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration attackers with a basic attack potential" [4]. This is four entire levels lower than "demonstrating resistance to penetration attackers with a moderate attack potential" [5]. Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers despite nearly unlimited resources are regularly defeated by moderate attacks like commercial surveillance companies. They certify that they absolutely, 100% can not. [1] https://support.apple.com/guide/certifications/ios-security-certifications-apc3fa917cb49/1/web/1.0 https://support.apple.com/guide/certifications/ios-security-... [2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11238-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... [3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page14 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 14 [4] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page16 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 16 [5] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20

deleted 3y ago
[deleted]
vuln 3y ago
Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?
- alephnerd 3y ago
  You as a private consumer wouldn't be able to buy one of these EAL4+ products without a relationship with a defense and security oriented reseller.
- selectodude 3y ago
  https://www.commoncriteriaportal.org/products/index.cfm https://www.commoncriteriaportal.org/products/index.cfm? Generally only components are EAL certified. For example, the iPhone is not on there, but the security protecting access to Apple Pay on the iPhone 13 with A15 Bionic running iOS 15.4.1 (19E258) is EAL2+.
- Veserv 3y ago
  Sure. The Common Criteria for Information Technology Security Evaluation [1] is the foremost internationally recognized standard (ISO 15408) for software security that most large companies certify against for at least some of their product portfolio. I believe there are US government procurement requirements to that effect, so many systems will have certifications of some form. For many companies you just search: "{Product} Common Criteria" and they will usually have a page for it on their website somewhere. You can also go directly to the certified products page: https://www.commoncriteriaportal.org/products/ https://www.commoncriteriaportal.org/products/ For smartphones you can see them there under "Mobility". Unfortunately, it is fairly hard to parse if you are not familiar with the terminology. The general structure of Common Criteria certifications is Security Functional Requirements (SFR) which are basically the specification of what the product is supposed to do and the Security Assurance Requirements (SAR) which are basically how you certify the SFRs are met (and what level of assurance you can have that the SFRs are met). SARs can be bundled into Evaluation Assurance Levels (EAL) which define collections that reasonably map to levels of confidence. You can add SARs beyond the current EAL which is how you get a EAL level with a +, but it is important to keep in mind that just cherry picking certain SARs does not necessarily give you a holistic assurance improvement. SARs and SFRs can be further pre-bundled into Protection Profiles (PP) which basically exist to provide pre-defined requirements and testing methodologies instead of doing it one-off every time. Some Protection Profiles support variable EAL/SAR levels, but these days people generally just certify against a Protection Profile with a fixed SAR bundle. This is what PP Compliant means. If you want to see what they certified against, you would need to look at the Protection Profile itself. For smartphones, the standard Protection Profile for the phone itself is Mobile Device Fundamentals. If you look at the SAR bundle there you will see that they correspond to EAL1 + a small number of EAL2, resulting in a overall level of EAL1+. As they are in-between EAL1 and EAL2 I just classified it as EAL1 for my earlier post. If you peruse further you will see that basically every Protection Profile that companies certify to as PP Compliant are basically the same EAL1+ or thereabouts. So, if you see PP Compliant, it probably means EAL1+ or so. Hope that helps. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/
alephnerd 3y ago
> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA levels (EAL4+) for Common Criteria. You just gotta pay more and purchase via the relevant Systems Integrators. A consumer product line like the Apple iPhone isn't targeting DoD buyers. That's always been Blackberry Ltd's bread and butter
- Veserv 3y ago
  I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in products that failed a EAL5 certification without a total rewrite. It used to say that in the standard somewhere, but the standard revisions have moved it so I can not quote it directly. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20
  - alephnerd 3y ago
    Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification. Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4. Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside). Least Priviliged Access, Entitelement Management, Identity Enforcement, etc are all much easier wins and concepts that haven't been tackled yet. Companies will provide EAL5+ if the opportunity is large enough, but it won't be publicized. Iykyk. If not, chat with your SI.
    - 3y ago
manuelabeledo 3y ago
> Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. So, OK I guess? It's worth noting that CC evaluation does not score the actual practical security of a device or system, but the level of testing it was submitted to, which is consistent with pretty much every single governmental certification out there.
- Veserv 3y ago
  Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack potential". You are complaining that the 40 cm high jump test does not score actual jumping ability. You are right, it is a low bar that they should all be able to pass. You can not use the 40 cm high jump test to distinguish them. What you need to do is use the 100 cm high jump test. Some can pass it, but none of the large commercial vendors can. Sure, it would be nice if we had more gradations like the 60 cm and 80 cm tests, but we do not really know how to do that, so the best we can do is the 100 cm test.
  - manuelabeledo 3y ago
    I'm not really complaining, though. I'm just saying that security certifications are more about compliance than actual proof that a system cannot be easily compromised. In other words, they are more about legal requirements than guarantees. It is also misleading to assert that a device or a system are less secure because they haven't been certified. Vendors submit requests to validate against specific levels or certifications, and it is not the goal of the certification authority to determine "how high" they score.
    - Veserv 3y ago
      They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. I am judging them by their maximum ability ever demonstrated under the most favorable circumstances and they still can certify resistance against moderate attackers. They have never developed systems that can protect against the prevailing threat landscape and they can not develop such systems. Their best is not good enough.
insanitybit 3y ago
I mean, it occurs to me that maybe all of these companies aren't doing this for a reason - because common criteria and compliance are often stupid and don't represent real security. Perhaps these policies are the exception? But I've managed SOC2 for example and I can definitely say that there are plenty of ways to get your SOC2 without giving a shit about actual security.
- Veserv 3y ago
  They failed. Repeatedly. For decades. They spent billions trying. The failed so much that the standard writers determined the only logical conclusion is that it must be practically impossible to retrofit a system that failed EAL5 certification to achieve EAL5 or higher certification without a complete rewrite and redesign. It says so right there in the standard [1]: "EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line". That was added due to the decades of experience where everybody who ever tried to do that failed no matter how much time or money they spent. We also have plenty of evidence that it does matter, they just can not do it. Here is Google touting their Common Criteria certification for the Titan M2 security chip hardware which is EAL4 + AVA_VAN.5 (resistance against penetration attackers with a high attack potential) [2]. Note that this is only the hardware (software was not certified; a critical severity vulnerability was actually disclosed in the software allowing complete takeover if I remember correctly) and only cherry picks AVA_VAN.5 so is still only EAL4, not a holistic EAL6 certification. Getting that certification was a deliberate effort and cost. If they literally did not care about the Common Criteria then they would just certify to the checkbox level like everybody else. It is because they could certify it to a higher level than most other can achieve that they chose to do it because then they could tout their unique advantage. Basically everybody gets a certification and basically everybody displays their certification on their page. There is something to be said about them opting for a EAL1 over a EAL4. It is basically assumed that any serious vendor could probably get a EAL4 with some effort. So, there is no differential advantage to displaying a EAL4 since everybody could get it. It is just a zero-sum game to pay for certification if everybody knows nobody has a true advantage. However, if you can achieve EAL5 or higher, then you do have a unique advantage because basically nobody else can do it. The fact that none of the major vendors attempts EAL5, shows that they can not do it. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 18 [2] https://security.googleblog.com/2022/10/google-pixel-7-and-pixel-7-pro-next.html https://security.googleblog.com/2022/10/google-pixel-7-and-p...
kramerger 3y ago
Isn't EAL1 what you get for just showing up? Basically, here is the product. Here are some design documents. We don't have anything more. Can we get our EAL1 please?
- Veserv 3y ago
  Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed in: "ios vulnerabilities" into Google and then typed in "ios iphone" into the NVD and verified that all of the search results were fixed. AVA_VAN.1 certification please. To explain why, AVA_VAN.1 does not require a independent security analysis, it only requires a survey of the public domain for known vulnerabilities [2]. You need AVA_VAN.2 (which is only required in EAL2 and EAL3) before they actually attempt to look at for vulnerabilities themselves. [1] https://www.commoncriteriaportal.org/files/epfiles/st_vid11237-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid112... [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154
wepple 3y ago
There is a near zero chance that being EAL4 or higher certified would’ve prevented these attacks. CC might be better than PCI-DSS, but not by much.
dang 3y ago
Please don't post "regular reminder" style comments - they're too generic, and generic discussion is consistently less interesting. Good threads require being unpredictable. The best way to get that is to respond to specific new information in an article. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 3y ago
  [deleted]
tptacek 3y ago
Common Criteria EALs have nothing whatsoever to do with practical security. I'd be surprised to hear anybody on this site who has managed a CCTL security review for a product saying anything positive about the program. A fun exercise: find a list of commercial mainstream products with "high" EAL audits, and then look at their vulnerability histories.
- Veserv 3y ago
  Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?
  - tptacek 3y ago
    The archetypical EAL5 product is a smartcard or cryptographic coprocessor (same thing, different package). They're certifiable because they don't do much. But if you'd like an example from the EAL4 list: start with FortiOS.
    - Veserv 3y ago
      EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect against “casual and inadvertent attacks”. The general crappiness of EAL4 goes all the way back to the Orange Book where EAL4 maps approximately to Level C2 (contemporaneous projects got certified to those levels simultaneously). That level was intentionally meant for toys before they put on their big person pants and release a grown up product with actual security [1]. It is a mystery why anybody thinks EAL4 and security belong in the same sentence. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an...
      - tptacek 3y ago
        If you're saying "EAL4 and below is junk" (I'd say EAL* is junk, but whatever), all you're really saying is that minimal-function cryptographic coprocessors are safer than operating systems and applications. Well, yeah, sure. I don't think you needed the farce of Common Criteria to tell you that, though. But upthread, you knocked Apple for not achieving an adequate assurance level. As you can see now, and from your own last comment, that doesn't make any sense. It's possible (though deeply silly) that there's some iPhone configuration that could "achieve" EAL4, but you yourself don't believe that has any meaning. I don't either. I don't think EAL5 or EAL6 do, either, except that if you tell me your product is EAL5, I'll assume it's a small fixed-function device.

Macha 3y ago

It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability. Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels there's nothing preventing someone putting this in an ad campaign or sms/discord/matrix/whatever spam and spraying it everywhere to build a botnet or steal user credentials or whatever.

waihtis 3y ago
Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?
- Macha 3y ago
  There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing, implies there should be an exploit chain but we've only been told of the first.
  - waihtis 3y ago
    Gotcha, thank you.
  - insanitybit 3y ago
    There's also SELinux on Android.
  - tester756 3y ago
    that sounds like terrible joke sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox and stuff still manages to escape

deleted 3y ago

[deleted]

deleted 3y ago
[deleted]

shmatt 3y ago

Another company founded by ex-Israeli intelligence. The funny thing about exploits is, once hundreds of employees or soldiers have access to the exploit, they don't need to physically copy the code. They just need to understand how it works, to then open 10 other companies that use the same exploit, or sell it to 20 other companies on the dark web. Although the IDF is great at stopping people from copying files outside of their networks, it can't stop people from remembering what they did during their service

alephnerd 3y ago
For every 1 zero day, there are around 10-20 others that haven't been publicized. You can make plenty of money by trying to find a niche and concentrating on that (eg. android exploitation, iOS exploitation, Windows exploitation, APAC buyers, US Defense buyers, Middle Eastern buyers, EU buyers, etc).
deleted 3y ago
[deleted]
KirillPanov 3y ago
One of these days people will wake up and realize that carrying a networked gps tracker with a microphone in their pocket is a really dumb idea.

alephnerd 3y ago

Slighty related, but Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military [0]. Gotta say, the Egyptian intelligence services are definitely punching above their weight by regional power standards. [0] - https://www.politico.com/news/2023/09/22/egypt-guns-money-menendez-indictment-00117627 https://www.politico.com/news/2023/09/22/egypt-guns-money-me...

lainga 3y ago
Hey, they nearly destroyed the Ottoman Empire in the 1840s...
deleted 3y ago
[deleted]
KoftaBob 3y ago
Probably part of the long running (now peaceful) rivalry they have with Israel.
- alephnerd 3y ago
  Yep! Totally forgot about that!
WarOnPrivacy 3y ago
> Senator Bob Menendez was just indicted for taking bribes from people connected with the Egyptian military At a federal level law/power is continually traded for cash/favors. Heck, DoJ itself gets deployed in response to lobbyist demands (eg:copyright enforcement). From what I see this case was egregious and involved a non-favored foreign state. Maybe that's the bar at which DoJ begins to care about political ethics.
- calgarymicro 3y ago
  > involved a non-favored foreign state Egypt is not 'non-favored'. The US has very close ties with Egypt's dictatorial regime[0], despite its awful domestic human rights record[1]. [0]https://thehill.com/blogs/congress-blog/foreign-policy/585521-egypt-us-relations-at-100-years-a-partnership-that-is-more/ https://thehill.com/blogs/congress-blog/foreign-policy/58552... [1]https://www.amnesty.org/en/latest/news/2022/09/egypt-human-rights-crisis-deepens-one-year-after-national-human-rights-strategy-launched/ https://www.amnesty.org/en/latest/news/2022/09/egypt-human-r...

hedora 3y ago

Though HTTPS is better than nothing, and this attack relies on HTTP to inject the initial payload, state sponsored attackers in some countries can likely just subvert CA or CDN infrastructure instead.

pipo234 3y ago
Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me
- jefftk 3y ago
  > certified by our beloved LetsEncrypt Are you saying that CAs should be refusing to issue certs for potentially spoofed domains?
  - pipo234 3y ago
    ...or Digicert, Globalsign, the Hongkong post office, whichever CA is in your truststore. I just mentioned LetsEncrypt because it's free and exceptionally easy to use. I'm not implying in any way they aren't providing a great service, it's just that that service also gets misused because it's cheap and easy.
    - xcdzvyn 3y ago
      It really sounds that way, FYI. I interpreted it as a dig at LetsEncrypt in particular.
      - pipo234 3y ago
        Please accept my apologies :-)
        xcdzvyn 3y ago

cotillion 3y ago

Ouch. Apparently Firefox has "Https First" also but requires the pref dom.security.https_first to be set. "HTTPS-Only Mode" is obviously best if you can do that.

rany_ 3y ago
You'd still need to resist the urge to not press "allow me anyway" and to be honest, even I'd click it knowing the risk (I just want to visit the damn site!). This doesn't solve anything unless the prompt is extremely suspicious (like the prompt showing for Google.com or some other site I know supports HTTPS).
- rany_ 3y ago
  Replying to myself but also, they could easily trick you into clicking some link and exploiting you that way. HTTP isn't the issue here, it's just being exploited so they don't have to get you to click some link. In all likelihood they'd do that if the less direct/obvious method of transmission didn't work.

AtNightWeCode 3y ago

I don't get it. If it is over http then you can play around with anything in a proxy. You have no TLS tunnel so it is not encrypted. It is by design.

vngzs 3y ago
That's just the delivery method, not the exploit.
d3w4s9 3y ago
Yes it is not encrypted and the response returned from server can be modified to anything and ask for password etc, but that is far from an exploit that runs native code.

aborsy 3y ago

I’m not an expert, but would’t a VPN (commercial or to a server with known exit IP) prevent such attacks? It will kick out the MITM. Also I wonder if the lock down mode could block it.

fullspectrumdev 3y ago
Yes and also yes. These attacks when launched by government entities pretty much always rely on placing a box at the ISP that does the targeted interception/MiTM against a subset of subscribers. So using a VPN would ensure your traffic is tunnelled “beyond” their reach. Lockdown mode also would have prevented the iOS exploit chain, apparently.

toasterblender 3y ago

Here is what I do not understand: Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff? I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?

entuno 3y ago
Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle.
- cco 3y ago
  > Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. For moral reasons do you mean? I would be surprised to learn there are a lot of people that are open to selling 0 day exploits to "bad actors" (granted that this term is doing a lot of heavy lifting here), but wouldn't want to work for Google or Apple. > ...it'll just be a never-ending cycle I think the idea is you pay them so well that they can work for a handful of years and remove any cash incentive reason for them to continue selling 0 days to bad actors.
  - eastbound 3y ago
    > “bad actors", but wouldn't want to work for Google or Apple - Everyone who doesn’t like US hegemony. Which happens about everywhere but US, in varied proportion, but even in Europe, and even worse in Middle-East, - Everyone who doesn’t like monopolies. Capitalism of competition (as opposed to state capitalism, when the state borrows a trillion per semester, ahem) requires that monopolies be broken down to avoid distortion of competition. Helping bad actors can be, under their viewpoint, less bad than the damage done to a billion consumers consumers at a time. Plus monopolies impose a monoculture of occidentalism, with certain values that a firm in Egypt might consider worse than sponsoring bad actors.

arkj 3y ago

Google search to intellexa results in an http site which got redirected. I am now installing the update.

deleted 3y ago

[deleted]

mtu9001 3y ago

Some men just want to watch the world burn.

fh9302 3y ago

The article doesn't mention it but Lockdown Mode on iOS blocked this exploit chain.

adm_ 3y ago

Related recent episode of Darknet Diaries about the Predator spyware: https://darknetdiaries.com/episode/137/ https://darknetdiaries.com/episode/137/.

boothemoo 3y ago

This vulnerability was most probably used by the Egyptian authorities to hack the mobile phone of the presidential candidate Ahmed El Tantawy who is competing with the current president Abdel Fatah El Sisi over presidency. https://x.com/jsrailton/status/1705271600868692416?s=46&t=KqcSzL3cJ9pV2lTJaJhL5g https://x.com/jsrailton/status/1705271600868692416?s=46&t=Kq...

account-5 3y ago

I've a question. This 0-day is a 0-click that didn't require any document download or anything. Simply visiting a http site would do it. What if you have JavaScript disabled be default. Would this exploit still work?

bananapub 3y ago
it's http interception so no, I doubt javascript matters at all
- lucb1e 3y ago
  Without knowing more, that's a bit of an assumption. The vulnerability could be in image decoding, in which case an <img> tag is enough and no scripting is needed, but it could also very well require doing something funky with JavaScript.
  - bananapub 3y ago
    if it required javascript then it was already an exploit without the mitm
saagarjha 3y ago
Needing to visit a website makes it a 1-click attack, unless you can do passive redirection.

swordbeta 3y ago

Is the commit containing the fix for the v8 bug 1473247 CVE-2023-4762 available anywhere?

bingobongodude 3y ago

I am pretty sure I was hit with this. I had some REALLY weird redirects coming from text msgs. NOT from Egypt. Maybe paranoid. Offline / on new Linux devices for now.

deleted 3y ago
[deleted]
saagarjha 3y ago
Text messages with links that do weird redirects aren’t too unusual. What makes you think you were a target?

qingcharles 3y ago

I can't help but think Google cheekily outed the domains the vendor was using as a way to target some vigilante justice upon them.

1letterunixname 3y ago

If I were a government security regulator or intelligence agency, I would monitor bank accounts associated with Zerodium and similar 0day and payload marketplaces and offensive sec tools to issue a secret, internal threat forecast that marks the beginning potential of increasing, directed, high-value attacks. Probably already exists in various forms, but taking it semi-public to sensitive industries might be useful.

saagarjha 3y ago
This is basically “can the government prosecute money laundering and tax evasion”.

deleted 3y ago

[deleted]

crumpled 3y ago

The Citizen Lab post linked from this article has the details of the MITM attack. It's almost not even an attack, the network is designed to do content injection on demand.

sylware 3y ago

Ofc, the "services" have enough CA certificates private keys to legitimate any "man-in-the-middle" attack for any browsers. Worst case scenario they have root-kits they can easily inject on user systems in order to intercept some trafic before encryption. They have probably a significantly sized "library" at their disposal to work from, depending on the "targets", and it could even be kind of automated (up to a certain point) with proper finger-printing of user system/components. Presuming the other way around would be unreasonable.

vinay_ys 3y ago

What these 0days teach us is that if you are a person in the crosshairs of powerful adversaries you have to be super-paranoid and reduce your target surface to as small as possible. If you are James Bond and you want to have secure communications with M, you are better off using a custom appliance type mobile device meant only to do that one function and nothing else. You will have to rely on anonymous 3rd-party burner devices to leave messages encoded in pre-agreed sequence of rotating geo-locked codebooks on random message boards. Any less opsec and you are toast! If you are a normal human-being using connected digital devices normally, then you should assume anything you put on those devices is already stolen. If you want to keep things truly private, keep it off digital (paper, old-school analog tape etc). Then, at least they will have to physically steal it from you – which, depending on the situation, might be much harder for them, but not necessarily much safer for you. So, you lose either way. Only real way out is to have well-functioning democratic governments with strong transparency and checks and balances with strongly enforced privacy laws to protect its constituents from both domestic and foreign adversaries and strong support for initiatives like Citizen Labs.