4 ms·

Any significantly complex attack leverages multiple vulnerabilities.

by dexwiz 3y ago

solardev 3y ago
Yes, but the article is confusing targeted advertising (not really a vulnerability) with actual zero day vulnerabilities. They are not really related, but both can be part of a targeted campaign I guess.
hn_throwaway_99 3y ago
No shit, but the article is making the unreasonable claims that: 1. This hack is not a result of a device vulnerability. 2. That whatever technique is being used to install spyware cannot be defended against (i.e. with an OS patch). That is simply impossible if an actual executable is installed on the device.
- superjan 3y ago
  The article is really vague. Extraordinary claims should come with extraordinary evidence. That said, could it be that the ad has its own JavaScript that does its spying for the time it is visible on the page? Can adds do that?
  - hn_throwaway_99 3y ago
    Even then, that would be a vulnerability in the browser. JavaScript in ads is loaded in its own context and doesn't have permission to access things outside of that context.
    - beebeepka 3y ago
      That would depend on how the ad is being served, no?
      - hn_throwaway_99 3y ago
        Not really. Ads are basically always served in an iframe precisely so it can't access content in the parent page. Even if worse came to worst and there was a bug on the parent page that let the ad JS access its parent page context, it should still be sandboxed to just that page.
- flangola7 3y ago
  > That is simply impossible if an actual executable is installed on the device. There's one exception, if there's a vulnerability in the hard-coded ROM or the silicon itself. One was found not long ago and enabled newer iPhones to be jailbroken. It lacks persistence and requires lightning port access, but it can't be patched. A no-click remote ACE at the unpatchable physical level would be the mother of all zero days, and too valuable to use for all but the highest of targets.
  - k9unit 3y ago
    If such a no click ACE is the mother of all exploits, it could be a little harder to patch, especially for your average end user. If that's not the case, then maybe the advantage to it might be that it can run on the hardware you need it to for a specific use case, but that itself is a big disadvantage for most other use cases. If neither are true, then are they worth the same amount? What makes one ACE better than another? Let's say this exploit did exist, and it was better for some reason. Then maybe I shouldn't use it, instead I use a cheap one time use exploit on a target that would cause it to be patched anyway.

Any significantly complex attack leverages multiple vulnerabilities.

by dexwiz 3y ago

Any significantly complex attack leverages multiple vulnerabilities.

Yes, but the article is confusing targeted advertising (not really a vulnerability) with actual zero day vulnerabilities. They are not really related, but both can be part of a targeted campaign I guess.

hn_throwaway_99 3y ago

No shit, but the article is making the unreasonable claims that: 1. This hack is not a result of a device vulnerability. 2. That whatever technique is being used to install spyware cannot be defended against (i.e. with an OS patch). That is simply impossible if an actual executable is installed on the device.

superjan 3y ago
The article is really vague. Extraordinary claims should come with extraordinary evidence. That said, could it be that the ad has its own JavaScript that does its spying for the time it is visible on the page? Can adds do that?
- hn_throwaway_99 3y ago
  Even then, that would be a vulnerability in the browser. JavaScript in ads is loaded in its own context and doesn't have permission to access things outside of that context.
  - beebeepka 3y ago
    That would depend on how the ad is being served, no?
    - hn_throwaway_99 3y ago
      Not really. Ads are basically always served in an iframe precisely so it can't access content in the parent page. Even if worse came to worst and there was a bug on the parent page that let the ad JS access its parent page context, it should still be sandboxed to just that page.
flangola7 3y ago
> That is simply impossible if an actual executable is installed on the device. There's one exception, if there's a vulnerability in the hard-coded ROM or the silicon itself. One was found not long ago and enabled newer iPhones to be jailbroken. It lacks persistence and requires lightning port access, but it can't be patched. A no-click remote ACE at the unpatchable physical level would be the mother of all zero days, and too valuable to use for all but the highest of targets.
- k9unit 3y ago
  If such a no click ACE is the mother of all exploits, it could be a little harder to patch, especially for your average end user. If that's not the case, then maybe the advantage to it might be that it can run on the hardware you need it to for a specific use case, but that itself is a big disadvantage for most other use cases. If neither are true, then are they worth the same amount? What makes one ACE better than another? Let's say this exploit did exist, and it was better for some reason. Then maybe I shouldn't use it, instead I use a cheap one time use exploit on a target that would cause it to be patched anyway.