5 ms·
So the exploiters have deprecated that version of spyware and moved on I see. This has been the case every other time. The state actors realize that there's too
by dudeinhawaii 8mo ago
So the exploiters have deprecated that version of spyware and moved on I see. This has been the case every other time. The state actors realize that there's too many fingers in the pie (every other nation has caught on), the exploit is leaked and patched. Meanwhile, all actors have moved on to something even better.
Remember when Apple touted the security platform all-up and a short-time later we learned that an adversary could SMS you and pwn your phone without so much as a link to be clicked.
KSIMET: 2020, FORCEDENTRY: 2021, PWNYOURHOME, FINDMYPWN: 2022, BLASTPASS: 2023
Each time NSO had the next chain ready prior to patch.
I recall working at a lab a decade ago where we were touting full end-to-end exploit chain on the same day that the target product was announcing full end-to-end encryption -- that we could bypass with a click.
It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary.
- mmmlinux 8mo agoThanks for contributing to our increasing lack of security and anonymity.
- avazhi 8mo agoMeh. It’s up to Apple to write secure software in the first place. Maybe if they spent more time on that instead of fucking over their UI in the name of something different, and less time virtue signalling, their shit would be more secure.
- x0x0 8mo agoI totally agree, and it's basically theft that Apple simply doesn't have a standing offer to outbid anyone else for a security hole. That said, we all get the same time on this earth. Spending your time helping various governments hurt or kill people fighting for democracy or similar is... a choice.
- avazhi 8mo agoI don't think democracy is the panacea you seem to think it is, but that's another issue. Certainly, cracking software for governments and the police is no less legitimate an existence and occupation as, say, working for an NGO.
- raw_anon_1111 8mo agoYes because other operating systems never have a decade old vulnerability? https://www.sysdig.com/blog/detecting-cve-2024-1086-the-decade-old-linux-kernel-vulnerability-thats-being-actively-exploited-in-ransomware-campaigns https://www.sysdig.com/blog/detecting-cve-2024-1086-the-deca... And yes because their UI folks should be spending time on the kernel. What next? If Apple didn’t have so many people working at the Genius Bar they could use some of those people to fix security vulnerabilities?
- avazhi 8mo agoAre you suggesting that money spent on marketing - to the extent that it doesn't actually increase market share/sales - couldn't be spent on hardening or vulnerability payouts, etc? Apple doesn't have unlimited money. It all gets allocated somewhere. Allocating it in places that don't improve security or usability or increase sales is, in this sense, a wasted opportunity that could be more efficiently allocated elsewhere.
- raw_anon_1111 8mo agoWell Apple kind of does have unlimited money for all intents and purposes. It’s net income last year was $112 billion.
- avazhi 8mo agoIf Apple had unlimited money they’d just buy the exploit makers at whatever asking price. Or they’d set exploit bounties at a price guaranteed to outbid others etc. No, just like any other company they don’t have unlimited money and my point stands.
- raw_anon_1111 8mo agoReally? You don’t think Apple could “afford” to set aside $500 million dollars for instance to pay off exploit makers? Less than 0.5% of their profit? Or even $1 billion? Less than 1% of their profit?
- saagarjha 8mo agoIs it not up to you to not write software that leads to people being killed?
- avazhi 8mo agoOk? Welcome to earth. We are a violent species. Sometimes people die violently. What’s your point? Lawful killing is, by definition, legal. It’s also justified in certain situations. Disagree? Cool, so don’t work for the police or Cellebrite lol, but don’t try to impose your idiosyncrasies on others.
- saagarjha 8mo agoIf your ethics are “people die so I might as well partake in killing them” I suspect you haven’t really thought this through very thoroughly
- avazhi 8mo agoMy ethics are that certain people will die in certain circumstances and I’m okay with that. I also have no issues working on something that may result in a person’s death at a later stage. One example might be that if I worked on an automobile assembly line it might occur to me that the car I’m working on would at some point crash and the occupants be killed. But why would I care? There’s a chain of causation that you can surely understand, one that in this case would be broken many times before then (assuming I wasn’t negligent in assembling the car). But again, your condescending tone proves my point. You and I don’t have the same values. That’s okay. But keep yours to yourself and I’ll keep mine to myself, right? That’s my point.
- vonneumannstan 8mo ago>It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary. I hate these lines. Like yes NSA or Mossad could easily pwn you if they want. Canelo Alvarez could also easily beat your ass. Is he worth spending time to defend against also?
- high_na_euv 8mo agoYes, because Apple can do it at scale.
- Eridrus 8mo agoYes. If vendors do not take this seriously, these capabilities trickle down to less sophisticated adversaries.
- UqWBcuFx6NV4r 8mo agoYou’re missing the point. If they don’t believe that they’re targeted, how are they going to be able to LARP online?
- whitepoplar 8mo agoHow much do you think Lockdown Mode + MIE/eMTE helps? Do you believe state actors work with manufacturers to find/introduce new attack vectors?
- walterbell 8mo agoMy iOS devices have been repeatedly breached over the last few years, even with Lockdown mode and restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator. Since moving to 2025 iPad Pro with MIE/eMTE and Apple (not Broadcom & Qualcomm) radio basebands, it has been relatively peaceful. Until the last couple of weeks, maybe due to leakage of this zero day and PoC as iOS 26.3 was being tested.
- drnick1 8mo agoSounds like it is time to drop Apple devices and move to Graphene.
- walterbell 8mo agoFrom another comment - I switched phone to Pixel and it has worked well, with a separate profile for apps that require Google Play Services. > GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. iPad Pro with Magic Keyboard and 4:3 screen is an engineering marvel. The UX overhead of Pixel Tablet and inconsistency of Android apps made workflows slow or even impractical, so I eventually went back to iPad and accepted the cost/pain of re-imaging periodically, plus having a hot-spare device,
- drnick1 8mo agoGraphene does not use the Pixel UI by default, it's very barebones. IMO, it's much better than the bloated Google UI.
- whitepoplar 8mo agoAre you a person of high interest? I was under the impression that these sorts of breaches only happen to journalists, state officials, etc.
- varispeed 8mo agoand if you point out that Apple's approach is security by obscurity with a dollop of PR, you get downvoted by fan bois. Apple really need to open up so at very least 3rd parties can verify integrity of the system.
- wat10000 8mo agoThey shipped MTE on hundreds of millions of devices. Is that security by obscurity or PR?
- varispeed 8mo agoMemory Tagging Extension is an Arm architectural feature, not an Apple invention. Apple integrated and productised it, which is good engineering. But citing MTE as proof that Apple’s model is inherently superior misses the point. It doesn’t address the closed trust model or lack of independent system verification.
- wat10000 8mo agoYour claim wasn't about inherent superiority or who invented what, your claim was "that Apple's approach is security by obscurity with a dollop of PR." The fact that they deployed MTE on a wide scale, along with many other security technologies, shows that not to be true.
- varispeed 8mo agoShipping MTE doesn’t refute my point. MTE is an Arm architectural feature. Apple integrated it, fine. That’s engineering work. But the implementation in Apple silicon and the allocator integration are closed and non-auditable. We have blog posts and marketing language, not independently verifiable source or hardware transparency. So yes, they deploy mitigations. That doesn’t negate the fact that the trust model is opaque. Hardening a class of memory bugs is not the same thing as opening the platform to scrutiny. Users still cannot independently verify kernel integrity, inspect enforcement logic, or audit allocator behaviour. Disclosure and validation remain vendor-controlled. You’re treating ‘we shipped a mitigation’ as proof against ‘the system is closed and PR-heavy.’ Those are different axes.
- blackoil 8mo agoTheoretical question. How much more secure will be a Linux device which uses phone as a dumb Internet provider.
- baq 8mo agoLinux is swiss cheese and your dumb phone is probably full of zero days which will happily mitm you.
- fsflover 8mo agoIf you care about security, you should try Qubes OS.
- digiown 8mo agoLinux has few defenses against the compromise of individual programs leading to the whole system being compromised. If you stick to basic tools (command line) that you can fully trust, it might be somewhat resistant to these types of attacks. The kernel might be reasonably secure but in typical setups, any RCE in any program is a complete compromise. Things like QubesOS can help, but it's quite high-effort to use and isn't compatible with any phone I know of.
- octoberfranklin 8mo agoIt would at least be diverse.
- fweimer 8mo agoThere is one non-technical countermeasure that Apple seems unwilling to try: Apple could totally de-legitimize the secondary access market if they established a legal process for access their phones. If only shady governments require exploits, selling access to exploits could be criminalized.
- 9cb14c1ec0 8mo agoIt would not completely de-legitimize it. Maybe a government doesn't want anyone to know they are surveilling a suspect. But it definitely would reduce cash flow at commercial spyware companies, which could put some out of business.
- ikmckenz 8mo agoYour opinion is that Apple should have just handed over Jamal Khashoggi‘s information to the Saudi Arabian agents who were trying to kill him, because then Saudi Arabia wouldn’t have been incentivized to hack his phone? I think you’ll find most people’s priorities differ from yours.
- saagarjha 8mo agoAs many people in this space have found out recently, there is no real thing as a non-shady government.
- digiown 8mo agoWe have a word for this: a backdoor. It wouldn't de-legitimize the secondary access market. It would just delegitimize Apple itself to the same level. Apple seems to care about its reputation as the defender of privacy, regardless of how true it is in practice, and providing that mechanism destroys it completely.
- renato_shira 8mo ago[flagged]
- octoberfranklin 8mo ago"trust the platform" yeah stop doing that.