3 ms·

NSO Group They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jam

NSO Group They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jamal Khashoggi. Their exploits, developed in-house as well as presumably partially bought on the black market, are some of the most sophisticated exploits found in the wild, e.g. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.

bawolff 3y ago
> that sell zero-click RCEs Exactly my point. They do not sell backdoors. Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"
- xvector 3y ago
  They implant backdoors and sell zero-click RCEs that exploit those backdoors.
  - bawolff 3y ago
    That's a pretty strong claim. Do you have any evidence they have done this? And i mean, i'm genuinely curious. I don't think they would be above doing so if they had the opportunity, i just haven't heard of any instances where they were caught doing so.
- db48x 3y ago
  I’m not sure why you’re making that point; the exploit we are talking about _is_ an RCE.
  - bawolff 3y ago
    The person i was replying to claimed that countries like usa rely on hardware modification while countries like israel rely on back-doors. This does not seem to be the case. Israel doesn't (or at least hasn't been caught) making backdoors, while the usa actually has (e.g. Dual_EG). RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.

bawolff 3y ago

> that sell zero-click RCEs Exactly my point. They do not sell backdoors. Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"

xvector 3y ago
They implant backdoors and sell zero-click RCEs that exploit those backdoors.
- bawolff 3y ago
  That's a pretty strong claim. Do you have any evidence they have done this? And i mean, i'm genuinely curious. I don't think they would be above doing so if they had the opportunity, i just haven't heard of any instances where they were caught doing so.
db48x 3y ago
I’m not sure why you’re making that point; the exploit we are talking about _is_ an RCE.
- bawolff 3y ago
  The person i was replying to claimed that countries like usa rely on hardware modification while countries like israel rely on back-doors. This does not seem to be the case. Israel doesn't (or at least hasn't been caught) making backdoors, while the usa actually has (e.g. Dual_EG). RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.