Hacker News Reader

Comment by badkitty99 | Hacker News Reader

[flagged]

It is worse than that. Mobile, and iOS in particular, is a second class operating system platform. Your device and data can be taken over by a text message that someone sends you, and you don't even need to open it. That's bad. Look at some of the Black Hat presentations about the number of zero day vulns for imessage in the previous two years.

You Shall Not PASS - Analysing a NSO iOS Spyware Sample https://www.youtube.com/watch?v=wAmGU2YUa9Y

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

https://www.darkreading.com/vulnerabilities-threats/apple-ze...

https://www.infosecurity-magazine.com/news/apple-update-extr...

I don't see how this is meaningfully different than a desktop operating system.

No amount of sysadminning was going to save you from state-sponsored zero-day attacks.

I know we'll all get infected, but at least we could try to detect it afterwards is my point

Competent people regularly discover state-sponsored zero-day attacks. Maybe it's a higher level than 'sysadmining', but I suspect there are people who are called sysadmins who do discover these kinds of things.

"State-sponsored" covers a broad range from sending phishing links to zero-click exploit chains. It takes specialized talent to find the latter. Most of those people would not call themselves sysadmins.

Isn't it the sysadmin's job to set up honeypots etc., with the intent of actually getting the zero-day exploit chains?

So they do need that competence if they are to be sysadmins.

Honeypots to catch this kind of thing are very hard to set up. People throwing exploits are generally really careful about targeting.

Yes, of course, but it is possible.

For a phone though, there is an external homogeneity that could make setting it up as a honeypot easier. I'm not incredibly familiar with phone OSs, but I see it as an interesting opportunity.

I have worked on this professionally; it's quite hard. Even getting exploits off of non-honeypot devices is hard. Setting up a honeypot adds even more complexity, especially because of how much fingerprinting attackers do. Before sending the initial payload it's likely that your phone OS, hardware model is already known–they're critical to deploying the exploit. Rough geographical location, who you've been around, which one of your devices is being targeted–all of these are not that hard to get. Once you're on the device and have elevated privileges you can run even more checks!

Yes, but surely getting exploits off non-honeypot devices shouldn't possible in general?

Surely it should only be generally possible if you have special monitoring.

Exploit authors are not perfect and sometimes they leave traces behind in accessible places that can be found if you know where to look.

Did Citizen Lab's sysadminning contribute to the outcome of this legal case to impose financial penalty on a vendor of state-purchased spyware? Or is the penalty considered insignificant to future deterrence?

That's not what Citizen Lab did.

Didn't Citizen Lab perform forensic analysis of victim devices?

Geez, you're really tilting at windmills here. What makes you think if you had your choice of 100 different security products (as is the ecosystem on Windows and Mac) that you'd be any more secure than "just" relying on Apple's security team (which is surely world-class)? Remember that Windows exploits abound, despite the antiviral/antirootkit ecosystem that grew up around it. If you want to "check your filesystem", I have an OS for you: Linux, BSD, maybe Solaris or something exotic. But I think you'll find that Torvalds gives less than two shits about Linux desktop/mobile security, so the first time you install a Pip or NPM package you risk getting rooted, and there are no serious (desktop or mobile) antivirus products for Linux.

> Geez, you're really tilting at windmills here. What makes you think if you had your choice of 100 different security products (as is the ecosystem on Windows and Mac) that you'd be any more secure than "just" relying on Apple's security team (which is surely world-class)?

Why shouldn't I have a choice? I could then depend on more than just Apple's security team.

> Remember that Windows exploits abound, despite the antiviral/antirootkit ecosystem that grew up around it.

Many exploits for iOS and Android, too. Seems that locking down the phone doesnt't help with that... (different security model for apps/userland does, but that's unrelated to my point)

> I have an OS for you: Linux, BSD, maybe Solaris or something exotic.

No, I want what works on phones now, with more user control.

> Apple's security team (which is surely world-class)

Hahaha, do you read HN much? There are stories on here all the time of security holes in Apples products which they refuse to fix.

Heres a recent example of their M series CPUs having similar exploits in them to SPECTRE and MELTDOWN in Intel CPUs. The difference is Intel fixed it and took the 20% performance hit. Apple refuses to fix it because it would make their processors slower.

https://arstechnica.com/security/2024/03/hackers-can-extract...

What about deciding not to "fix" an issue that is extremely hard to exploit in practice (especially on consumer-grade machines) negates my assertion that their engineers are "world-class"?

Doesnt matter about the skill of the engineers. If the boss is telling them not to fix security holes to protect performance, the apple core is rotten.

Sure, just downvote me. Those who can't think for themselves, downvote.

There is only two mobile OSes and it wasn't the market that decided that state of affairs.

Markets tend toward monopolies, with a stop at duopolies along the way.

I do agree that Apple and Google both played the game with moves below the table, but that’s what “the market” gets you (amoral profit seeking that has no qualms with cheating and taking measures to ensure that one isn’t somehow suddenly operating under a political regime that cares about the morality of its market participants).

My brother this has nothing to do with you and ads spying on you or whatever. This is about a war occuring in Israel.

Also in this case "daddy's regular updates" are indeed protecting millions of non technical users that can't "take charge" of their own security, because they are not programmers.

Reply on news.ycombinator.com