Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.
Now, we've gotten a bit smarter about this sort of thing since. Both at a high level architecturally (don't process image files in the kernel) and at a lower level (use a language that takes measures to constrain its buffers). But the basic scenario hasn't been entirely eliminated. There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process.
It was layer upon layer upon layer of protocols and software.
Because it wasn't possible to remove old layers (because some satellites or wormholes or whatever would stop working.)
So, it was super easy to hack...and sending spam. Well you will get killed for that though.
I guess that the politics here are the real barrier.
https://en.wikipedia.org/wiki/Planck%27s_principle
As a general principle in life, it's quite frightening considering ever increasing life spans.
Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off).
Chromium distributes its logic over multiple processes per tab, so that even if you eg find a zero-day in V8, you still can't use it to get arbitrary file access without a sandbox escape. Last I checked, Firefox was getting there. Also, Firefox compiles some parsing and image processing libraries to WebAssembly for another layer of sandboxing (and to protect against ROP exploits), and increasingly uses Rust for sensitive tasks.
That's not to say they're safe, but I don't think they're the biggest source of exploits.
There is a certain irony in the idea that people should rely on a Google product to avoid having their privacy compromised.
Google tracks you and adds things to your profile when you explicitly choose incognito mode to avoid the privacy invasion. This doesn't seem like informed consent to me.
0: https://news.ycombinator.com/item?id=30322715
1: https://www.seattletimes.com/business/rights-group-verifies-...
^2: For instance, the Coinbase Super bowl ad that was only a bouncing QR code would have been a very interesting way to start WW3 if it were Russia hacking millions upon millions of americans' phones, exfiltrating any potentially sensitive information (company emails, etc) in an instant, and/or destroying the device via some exploit chain that destroys the OS and requires a full firmware factory reset to recover.
In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
You do know that is a terible attitude for a real-world security posture meant to protect non-theoretical people's property and information against actual exploits?
> In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore.
While you may wish for patches to always take care of exploits before any phones are compromised, that's not much more than wishful thinking. You assume that all 0day exploits are both known and fixed immediately. That is 100% false.
That stuff isn't burned on mass hacks on random phone users, it's way too valuable.
BUT. There is a small sliver of time between the exploit being used on a high value target and Apple patching the hole. That's the spot where Joe Schmoe should be cautious.
If it can be used on one random person then it can be used on the hundreds of millions of random persons who use iPhone and Android.
And getting even 1% of those massive user bases to click on a link and steal their money or private information, would be incredibly lucrative even for the short period until the patch rolls out, especially for the wealthier iOS userbase as a target.
In my EU country, I'm still getting regular spam SMS with links to what I presume is some older Android malware that wrecked havock last year. So, if attackers are still at it, months after a patch was rolled out, it means they must be still getting returns on their "investment".
https://en.wikipedia.org/wiki/JailbreakMe#JailbreakMe_1.0_(i...
Then modders somehow managed to update the batteries' firmware (cf "Pandora battery") and use that. Sony couldn’t patch it, and it was basically game over for them until they released a new generation of hardware, with motherboards immune to the trick.
Fun times.
Rich multimedia parsing display systems in messaging apps are a very tempting attack surface for entities such as NSO.
A picture is worth a thousand words.
One is fly-by attacks by random viruses and ransomware. For those cases, I would not worry about pictures.
Other is when you are targeted by regimes with essentially unlimited budget. In that case yes, the picture can be a spyware.
But nobody is going to burn zero days on mass surveillance. It’s just for specifically targeted people.
Negotiate big contracts? Work in aerospace or defense? Have access to inside information about a public company? Have access or are a high level political official?
If the most they could get out of you was a few thousand bucks from your bank account and maybe your email password, you're probably in the first category.
On the other hand, if you have access to highly confidential information (think classified government info or you're literally working on the next iPhone) or are the type of person who makes enemies of spoiled rich oligarchs in despotic nations then you're probably in the second.
Xiaomi, Huawei, Oppo, Honor... there are quite a few Chinese phone brands that would benefit from knowing what Apple are working on.
Think about Ukraine today, the Russian government would probably love to have a way to compromise millions of Ukrainian citizens’ phones.
These people all use iPhones.
A quick research tells me that pretty much all stats show Android use to be around 80% in Ukraine. Or did you mean Hong Kong? For the latter I see a 50/50 divide.
Just curious about that sentence. I don't think the stats take anything away from your general argument.
If this was the case, exploits would never be published or abused, and jailbreaks wouldn't exist because this logic says that those who find exploits will either disclose them "responsibly" or sell them to a nation-state.
If the idea of non-state hackers doesn't bother you, recognize that organized crime is a billion dollar industry and fraud rings would love root access on tons of normal people's devices, including your own.
https://en.wikipedia.org/wiki/Goodtimes_virus
I remember telling lots of people at the time that this was impossible, because images weren't executable code, and viruses spread through running programs, not through viewing images.
Unfortunately, this elegant, straightforward distinction didn't hold up over time. :-(
I think it was more that it was never true, rather than not holding up in time. ;)
The earliest I can find is a vulnerability in Netscape 3.0 (1996), not found until four years later:
https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerabil...
Thus the distinction has never existed. There has never been such thing as a “safe” format.
I believe that is what the creators of this virus must be relying on. All I hope is that creating this image virus doesn't become common knowledge (cause that we will fundamentally reshape how we interact on social media).
All I hope is that devs start replacing parsers with ones written in a safe language.
I'm amazed at the tech giants with all their funding and they still cant build secure operating systems or have the resources to reduce attack vectors within their own OS'es.
Its abit like saying, would you expect some instructions for virtualisation to run if you load a jpg to display on screen? I wouldnt expect instructions for virtualisation functionality to be running in this example.
Or would I expect some instructions for encryption to run if I were to load a sound file to play over speakers? No I wouldnt expect that to happen, but thats the sort of thing thats happening here, some instructions not normally associated with a task are occurring, so how do you detect and alert and maybe halt those instructions?
There isnt anything in the CPU AFAIK that would pick this up, it would need the OS to act as a co-party to perhaps halt this, and I dont know if the OS or even AV software goes to this extent? At best, you'd have something like a dmesg feed or the Intel Processor Trace (https://news.ycombinator.com/item?id=30110088) to get the output of instructions being called (possibly independent of the OS), but like I say I dont know of any OS or AV product that goes to this level of monitoring.
Thats where I am coming from.