Hacker News Reader

Comment by mehrdadn | Hacker News Reader

> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android.

> Due to evidence of in the wild exploit, we are now de-restricting this bug 7 days after reporting to Android.

Why is this a good idea?

View on HN

Because the "bad guys" already know about the vulnerability, so there's no benefit from keeping it secret but a duty to the consumers to inform them as well - especially since the kernel patch already exists.

If the "bad guys" were one team it would make sense, but there's a whole world of guys who can turn "bad" when the opportunity is given. And it is given, when a new vuln is unmasked.

The precautions a cautious user will want to take when armed with this information don’t really change or become more burdensome whether there’s one group of attackers or many, so I don’t see how that changes the calculus at all.

It’s also probably not a terribly great assumption that no one else has independently discovered this vulnerability that’s already been independently discovered twice. Caution suggests we should assume this is in the wild and act accordingly.

How many consumers across the world would actually be at risk from NSO having details of the exploit vs. all the other "bad guys" though? Isn't there a significant distinction that's being brushed under the rug here?

> How many consumers across the world would actually be at risk…

We don't know, because we don't know who bought it and how widespread they deployed it.

Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?

When you say 'authorities' that includes countries that persecute civil right activists.

Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies.

Amnesty International have also complained that they have been targeted with NSO Group technology - specifically Pegasus. They're currently launching a legal case in Israel to restrict their export license.

A separate case claims that NSO Group used Pegasus to help the Saudis spy on Khashoggi, who was brutally murdered in the Saudi embassy.

I don't think we need to argue about the bad guys in this case.

Sources: https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-h...

https://www.amnesty.org/en/latest/news/2019/05/israel-amnest...

https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...

This is supposed to justify putting millions of more people at an even larger risk of getting hacked?

The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death. The downside is allowing other hackers to maybe produce an exploit in time (before this bug gets patched), and maybe hack some more people.

I'd say the upsides outweigh the downsides.

I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib.

It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix.

In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?

Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.

It's very hard to tell because we've observed NSOs using comparable vulnerabilities both very sparingly against select individual targets, and also observed exploits used in a mass fashion against whole populations such as the recent uncovering of exploits targeting Uyghur communities.

Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller:

https://twitter.com/dvyukov/status/1180195777680986113

That was apparently fixed?

> No longer occurring on linux-next, probably fixed by the following commit:

> #syz fix: ANDROID: binder: remove waitqueue when thread exits.

https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...

Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels.

See for example:

https://mobile.twitter.com/grsecurity/status/118005953923380...

Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".

The general reasoning is that since it's already being exploited, there's more value in warning people so they can decide to not use said affected devices, rather than being in the dark.

You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content."

I guess it informs us what not to do at the very least. Given the track record, I'm not very optimistic of the vendors pushing a patch very soon (if ever). This keeps us informed at least.

Or the attacked surface has to be exposed to the browser sandbox, which apparently this one is, per: https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

> You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content."

They can easily give that^ information without exposing details of the bug though?

Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.

I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.

Right, I realize they're the vendors, but isn't this just going to make even more people exploit the vulnerability before consumers get patches? Like actual hackers targeting random people in the wild, not merely law enforcement?

It may depend who are targeted by this exploits, if the targets are politicians and people with high positions is better to make it public and have this people not use their phones.

I feel like this goes against responsible disclosure. Google should give the manufacturers a month to push updates themselves, just like Google would expect a month to fix an issue someone reported to them.

It's being actively exploited, which changes the calculus.

"Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?

Not all law enforcements are working for the good of their people, probably.

That still doesn't counter my point.

> "Actively exploited" by... law enforcement

"Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.

The manufacturers don't need to fix anything though, they just need to push out the update. The entity that needs to fix (and has fixed) the bug is Google itself.

I don't know the reasons behind that policy, but I'd guess with the exploit already being used, there is less incentive to keep silent about the issue. The opposite is true: putting more pressure on the vendors to provide patches, and disclosing any malicious actions that are already underway as soon as possible

They could tell vendors about the issue earlier without telling the rest of the world earlier though, can't they?

Well, the longer that vulnerabilities are kept secret, the longer that users are unable to take any action to protect themselves, and the less incentive that vendors have to roll out fixes quickly and to prevent vulnerabilities in the first place. See the Project Zero disclosure FAQ: https://googleprojectzero.blogspot.com/p/vulnerability-discl...

Reply on news.ycombinator.com