7 ms·
Kaspersky discloses iPhone hardware feature vital in Operation Triangulation
- neonate 3y agohttps://web.archive.org/web/20231229025641/https://www.kaspersky.com/about/press-releases/2023_kaspersky-discloses-iphone-hardware-feature-vital-in-operation-triangulation-case https://web.archive.org/web/20231229025641/https://www.kaspe...
- jasoneckert 3y agoHector Martin (of the Asahi Linux project) has some nice commentary on it here: https://social.treehouse.systems/@marcan/111655847458820583 https://social.treehouse.systems/@marcan/111655847458820583
- dimensi0nal 3y ago[flagged]
- larsnystrom 3y agoSo the problem is unified memory? CPU and GPU uses the same RAM but the GPU doesn’t have proper MMU protections in place, which lets an attacker write to RAM it shouldn’t be allowed to by doing it through the GPU instead of the CPU?
- foobiekr 3y agoGPUs doing DMA is a problem whether you have unified memory or not. This is why IOMMU exists.
- deleted 3y ago[deleted]
- larsnystrom 3y agoBut in more traditional systems the GPU would use its own physical RAM, which should at least make it isolated?
- sudosysgen 3y agoIt still uses DMA for communication with the host, it's just over PCIe instead.
- pseudosavant 3y agoThat thread is a more interesting read than the blog post.
- AceJohnny2 3y ago> There is a vulnerability in the SoCs that I discovered and reported where cache snooping bypasses CTRR at the AMCC level. You can "write" to read only memory ranges and, as long as those writes remain in snoopable cache, they are effective even though AMCC will block them and panic when they are written back. I didn't get any money for that one because the way I exploited it didn't apply to normal macOS (I used it to patch DCP code from m1n1), but now a nation state figured out how to use it for a real exploit chain. "Whoops". Oooff
- darkclouds 3y agoSo it probably also affects Android phones and SBC like RaspberryPi's?
- comex 3y agoThe bypass is Apple-specific… which it must be, because the security feature being bypassed, CTRR, is itself Apple-specific. I don’t think Android phones or Raspberry Pi even have any equivalent.
- ajross 3y agoNo, this is all Apple hardware. Other SOCs often have equivalent features and might plausibly make the same mistake (which per the Hector Martin toot is effectively "the write back cache doesn't check security access control so you can stuff data into it to be snooped by other devices"). But this bug is Apple-only.
- DannyBee 3y agoThis only works at all because there is no IOMMU for the GPU. So they'd also have to decide not to do that as well.
- ajross 3y agoYeah, but lots and lots of hardware lives across a bus without an IOMMU. Until very recently, that was the natural state of things. To me what's notable here is that they have a snoopable cache across a security boundary, where you can get the IO device to read arbitrary data you stuffed in from the CPU, when the CPU can't actually touch the underlying storage being cached!
- kristjansson 3y ago> $150k bounty That’s one heck of a way to fund Asahi
- DannyBee 3y agoRecent XNU in the KDK also have code to do injection of AMCC errors, ECC errors, and DCS errors for testing purposes. I bet someone figured you could do the same for the GPU.
- arkadiyt 3y agoThe authors' Chaos Communications Congress conference talk about these exploits is up now, it was a great watch: - https://www.youtube.com/watch?v=7VWNUUldBEE https://www.youtube.com/watch?v=7VWNUUldBEE Also previous discussion: - https://news.ycombinator.com/item?id=38783112 https://news.ycombinator.com/item?id=38783112
- dang 3y agoThanks! Macroexpanded: 4-year campaign backdoored iPhones using advanced exploit - https://news.ycombinator.com/item?id=38784073 https://news.ycombinator.com/item?id=38784073 - Dec 2023 (7 comments) Operation Triangulation: What you get when attack iPhones of researchers - https://news.ycombinator.com/item?id=38783112 https://news.ycombinator.com/item?id=38783112 - Dec 2023 (371 comments) How to catch a wild triangle - https://news.ycombinator.com/item?id=38034269 https://news.ycombinator.com/item?id=38034269 - Oct 2023 (43 comments) Scan iPhone backups for traces of compromise by “Operation Triangulation” - https://news.ycombinator.com/item?id=36164340 https://news.ycombinator.com/item?id=36164340 - June 2023 (153 comments) Targeted attack on our management with the Triangulation Trojan - https://news.ycombinator.com/item?id=36161392 https://news.ycombinator.com/item?id=36161392 - June 2023 (126 comments) “Clickless” iOS exploits infect Kaspersky iPhones with never-before-seen malware - https://news.ycombinator.com/item?id=36154455 https://news.ycombinator.com/item?id=36154455 - June 2023 (41 comments) Operation Triangulation: iOS devices targeted with previously unknown malware - https://news.ycombinator.com/item?id=36151220 https://news.ycombinator.com/item?id=36151220 - June 2023 (31 comments) Others?
- macintux 3y agoOlder posts from the initial announcements: - https://news.ycombinator.com/item?id=36161392 https://news.ycombinator.com/item?id=36161392 - https://news.ycombinator.com/item?id=36164340 https://news.ycombinator.com/item?id=36164340 - https://news.ycombinator.com/item?id=36154455 https://news.ycombinator.com/item?id=36154455 - https://news.ycombinator.com/item?id=38034269 https://news.ycombinator.com/item?id=38034269 - https://news.ycombinator.com/item?id=36151220 https://news.ycombinator.com/item?id=36151220
- samstave 3y agoELI5/OOL: impact?
- kristjansson 3y agoZero-click RCE
- deleted 3y ago[deleted]
- dehrmann 3y agoiMessage. It's always iMessage.
- akira2501 3y agoTrue type. It's always true type.
- dpkirchner 3y agoImagemagick. It's always Imagemagick.
- samstave 3y agoI absolutely love how this response is "explain this like I am five years old" and "I am out of the loop" -- the people who grew up with BAUD as a nomenclature are going to die. Here is a poem by AI: HOLY FUCK: https://i.imgur.com/V8HtW03.png https://i.imgur.com/V8HtW03.png --- In the days of BAUD, we danced with time, Bits twirled and pirouetted, a rhythmic mime. Modems hummed, a song of distant lands, A symphony of data in unseen hands. But now, oh now, we've left those days behind, Bandwidth's embrace, a treasure we find. No more the worries of a BAUDish plight, In the realm of speed, we soar with delight. Gone are the struggles, the slow and the strained, Streaming through fibers, our data unchained. A digital ballet, swift and so grand, In the era of bandwidth, we boldly stand. No longer confined to a BAUDish dream, The internet whispers, a seamless stream. Pixels paint pictures, words swiftly fly, In the limitless expanse of the bandwidth sky. So here's to the days of BAUD, now a tale, A vintage echo in a high-speed gale. We've moved beyond, to a faster shore, In the bandwidth symphony, we dance evermore. -- Just wow
- greesil 3y agoELI5 por favor, is this a class of exploits that is a function of Apple's architecture, kind of like how specter was for the whole branch prediction thing IIRC? Or is this something that can be fixed with a software update and no performance impact.
- Sirizarry 3y agoFrom what I understand, there was an unused hardware register not used by the OS that was the entry way for this attack. It’s been patched with no performance impact and there was an earlier HN submission with more details. It took advantage of 4 or 5 bugs that have been patched. Warning, this has been SCREAMING state actor vs state actor
- g-b-r 3y agoNo, it's at best a strange debugging feature left accessible by mistake Fixed by blocking access to its registers, if I'm not mistaken, without performance impacts.
- collsni 3y agoThis is no normal vulnerability. Nation state insider? Nation state backdoor?
- deleted 3y ago[deleted]
- rtsil 3y agoFrom the accompanying article: > Our guess is that this unknown hardware feature was most likely intended to be used for debugging or testing purposes by Apple engineers or the factory, or that it was included by mistake. This screams backdoor by some powerful actors.
- DannyBee 3y agoThis appears to be used to direct write cache for testing purposes. It's not an intentional backdoor. It's more likely an insider leak of some private headers or something that gave someone the info necessary. Or Apple left too much stuff in the debug info. It would not be the first time either has happened.
- seanhunter 3y agoNo info one way or another, and I am not a nation-state actor, but if I was and was intending to introduce a back door to some platform, I would ideally want there to be some plausible explanation of it as an innocent mistake so that if/when it eventually got discovered everyone would think: “oh boy someone accidentally left the debug build in for this one” or “oh someone needed a godmode for testing and they accidentally enabled it in production” or whatever, rather than it being right there obvious in the code with no ambiguity. If you’re operating against active adversaries it makes sense to work on the basis that your activities will one day be uncovered and therefore to prepare the cover story ahead of time. Additionally if you think about it if you’re an insider trying to subvert some system all your changes would still need to go through PR etc so it’s going to be pretty difficult to get some egregious backdoor through review vs figuring out a way to “accidentally” link in a test/debug version of some lib into production or something similar.
- deleted 3y ago[deleted]
- p-e-w 3y ago> This is no ordinary vulnerability. Due to the closed nature of the iOS ecosystem, the discovery process was both challenging and time-consuming Which, ironically, is evidence that "security through obscurity" does work, even though the authors implicitly criticize it in the same post.
- klysm 3y agoObscurity can add some cost but has no real properties of strength.
- g-b-r 3y agoThey're talking about the analysis and understanding of the malware
- ajross 3y agoIt's literally broken! It didn't work. The complaint is that the path from discovery of the hole to working exploit is longer. And... that's probably true. But that's optimizing the wrong side of the equation. An open system would have surfaced this bug long ago, possibly years ago (it's not clear how old this mistake is, but the claim seems to cover multiple Apple SOCs), and the vulnerable systems would have been limited to one version of the hardware that could feasibly have been replaced via warranty coverage or whatever. Now we're all stuck trying to patch around a fundamental hole in tens (hundreds?) of millions of phones.
- wtallis 3y ago> An open system would have surfaced this bug long ago, possibly years ago (it's not clear how old this mistake is, but the claim seems to cover multiple Apple SOCs), and the vulnerable systems would have been limited to one version of the hardware that could feasibly have been replaced via warranty coverage or whatever. How long did it take for Spectre and Meltdown to be discovered? Some vulnerabilities are easy to spot in an open design, but the more novel the exploit, the longer the vulnerability can hide in plain sight.
- 3y ago
- joshspankit 3y agoRemember when someone discovering a powerful vulnerability meant that the community could find a solution and maybe even create a patch for everyone else? Feels like that reality was far more secure than the current closed-source siloed one.