Hacker News Reader

Comment by Thorncorona | Hacker News Reader

Since NSO is able to do these 0 click exploits on iphones does this mean they have have hacked apple engs as well and have copies of iOS lying around?

View on HN

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

I mean, you’re not going to fuzz your way to bit twiddling together a small virtual computer inside of a compression stream.

Of course – but you can definitely fuzz your way to the initial vulnerability. The VM stuff is done once you have that vulnerability and are writing the actual exploit, which is a manual process.

The blog says the PDF parsing was based on xpdf which is open source.

go ahead, fuzz your own iOS exploit. you make it sound like someone just cranks one out before lunch.

Entirely do-able by a team of experts with multimillion dollar budgets over the course of probably many months, doesn't sound at all similar to average hn commenter being able to do it before lunch.

That was my first guess reading this.

Like they just HAVE to have the source code right?

Source code doesn't help that much, and sometimes the assembly makes some bugs more obvious. They really don't need the source. They just decompile it.

People without reverse engineering experience often think there's a massive difference between white-box and black-box auditing, but there really isn't. Yes, it takes longer, but not ridiculously so.

NSO aren't interested in being an overtly criminal operation; breaking into Apple and stealing source would be a giant liability they don't need to have. Their game is feigning ignorance as to what their customers do with their software. They can't afford to be caught commiting crimes directly.

Nah that’s what tools like IDAPro and Ghidra are for. You don’t need source although it does help.

That said, the particular component this targets is open source. It’s the JBIG2 decoder that is part of XPDF.

I mean, it would just be a prudent business move once the first PoC comes out right? You know that Apple is going to patch it eventually. It totally makes sense to try to pop a dev box and exfiltrate the source code. The only question is if they can make it past Apple's network security - it's unlikely that devs are allowed to take their work MacBooks with iOS source code home.

Reply on news.ycombinator.com