Hacker News Reader

Hacker News

Comment by dexwiz | Hacker News Reader

Parent Full thread

dexwiz

Any significantly complex attack leverages multiple vulnerabilities.

View on HN

No shit, but the article is making the unreasonable claims that:

1. This hack is not a result of a device vulnerability.

2. That whatever technique is being used to install spyware cannot be defended against (i.e. with an OS patch).

That is simply impossible if an actual executable is installed on the device.

The article is really vague. Extraordinary claims should come with extraordinary evidence. That said, could it be that the ad has its own JavaScript that does its spying for the time it is visible on the page? Can adds do that?

Even then, that would be a vulnerability in the browser. JavaScript in ads is loaded in its own context and doesn't have permission to access things outside of that context.

That would depend on how the ad is being served, no?

Not really. Ads are basically always served in an iframe precisely so it can't access content in the parent page.

Even if worse came to worst and there was a bug on the parent page that let the ad JS access its parent page context, it should still be sandboxed to just that page.

> That is simply impossible if an actual executable is installed on the device.

There's one exception, if there's a vulnerability in the hard-coded ROM or the silicon itself. One was found not long ago and enabled newer iPhones to be jailbroken. It lacks persistence and requires lightning port access, but it can't be patched.

A no-click remote ACE at the unpatchable physical level would be the mother of all zero days, and too valuable to use for all but the highest of targets.

If such a no click ACE is the mother of all exploits, it could be a little harder to patch, especially for your average end user. If that's not the case, then maybe the advantage to it might be that it can run on the hardware you need it to for a specific use case, but that itself is a big disadvantage for most other use cases. If neither are true, then are they worth the same amount? What makes one ACE better than another?

Let's say this exploit did exist, and it was better for some reason. Then maybe I shouldn't use it, instead I use a cheap one time use exploit on a target that would cause it to be patched anyway.

Yes, but the article is confusing targeted advertising (not really a vulnerability) with actual zero day vulnerabilities. They are not really related, but both can be part of a targeted campaign I guess.

Reply on news.ycombinator.com