A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
googleprojectzero.blogspot.com
googleprojectzero.blogspot.com
> We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis.
This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR (https://www.johnscottrailton.com) and make him say controversial things, which could be later used to malign Citizen Lab. Darknet Diaries covered this incident recently: https://darknetdiaries.com/episode/99/
hopefully this company is on the way out...
I only listen to 2 podcasts, I don't really and have never really liked the format. I prefer reading with music or silence, and have always loved weblogs for that. However, it's worth a shot to find a podcast app that "clicks" with your style of input.
With podcasting 2.0, the new features should allow producers that don't want to be part of an ecosystem to still make some income, plus you get streaming album art where supported, and liner notes and all sorts of other goodies.
I think podcastindex has a list of compatible 2.0 podcasting apps, but I'm unable to check.
"Now I just have to embed a 64-bit computer architecture into my compression algorithm and... boom. We're in."
https://www.youtube.com/watch?v=Vxq9yj2pVWk
Joking aside, this does illustrate the "magical" properties of technology to the layperson. As a corollary, failure modes end up quite suprising and hard to reason about without a certain amount of proficiency in these technologies.
Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure
Kyle Rittenhouse was possibly almost convicted due to "enhance with AI".
I've also seen it "enhance" an image of a resistor into a human face.
I don't care how much AI you have, you can't add back data that wasn't in the original image. The best you can hope to do is get a vague approximation, and you must have a very, very good (comprehensive) training dataset for that to be remotely viable.
TBF the Beatles look amazing in the Peter Jackson documentary, though the original material was shot on 16mm.
Upscaling something digital, does require creating information out of thin air, on the other hand.
"I found a popular chat app that after install leaves a tool with full sudo privileages behind for us to take advantage of located clickityclickity... here. We're in."
Sometimes, it can be even more pedestrian sounding. Hackers don't always have to be clever if other people are absolutely dumbasses before their arrival.
The article does a very good job of describing the relevant parts of the image format. They built a VM inside of an images single pass decompression route. I'd highly recommend reading the article.
This is just one of the exploits in a very large chain.
To quote some of the nations top security researchers:
> Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.
This has nothing in relationship to eval().
Historically the jump from overflow to RCE was much much shorter.
Still the iMessage attack surface is just massive and running in an unsafe language kind of crazy?
Not really. I am about to read the article, but it sounds like return-oriented programming[1] chaining "gadgets" that are small bits of existing code that you can re-purpose into executing arbitrary code by manipulating the stack. Extremely common exploitation technique, even if not trivial. Who said an exploit or RCE was trivial to exploit?
Edit: I was a bit quick to dismiss. The technique is certainly interesting, although the article doesn't go into the details of how the control flow is handled and where that register is stored. However, I'd like to point out that ROP is quite complex on its own, as it's kind of like using a computer with an arbitrary instruction set that you have to combine to create higher-level functions, hence my original confusion.
[1] https://en.wikipedia.org/wiki/Return-oriented_programming
My initial assumption was that they would compile a program, take the binary output as an image and JBIG2-compress it, as I don't really get how they would use the result of the binary operations to branch to different code. Reading the article a bit more, I think they can loop multiple times over the area, by changing w, h and line dynamically over each pass, which would give them some kind of basic computer. That part is still unclear to me, but that would indeed be a lot more impressive.
There are no details on how control flow is handed over to the program either, so it's possible that they loop multiple time over the scratchpad (1 loop = 1 clock cycle roughly), especially if the memory area is non-executable, and they have one shot at computing a jump pointer.
In any case, they can probably copy arbitrary memory addresses into the new "scratchpad" area to defeat ASLR (we'll see in part 2).
My own suggestion. Ascii only messages if contact is not in address book or is a contact you've communicated with in your message history (however long you keep that) up to 1 year. Once you reply these untrusted saudi contacts can send you the gif meme's.
Never interacted, maybe ascii only. Interacted, allow unicode and some other features (basic emojies? / photos?). Full contact? Allow the app integrations, heart sensor, animated images, videos etc.
The analysis calls this out specifically:
> Conveniently since JBIG2Bitmap inherits from JBIG2Segment the seg->getType() virtual call succeed even on devices where Pointer Authentication is enabled
Which is disturbing. Was the code compiled for the arch64e architecture in the first place, or it is a bug in the LLVM compiler toolchain? The armv8.3 authenticated pointers have been invented to preclude this from happening, but that is not the case with the exploit.
That said, my own view is that messages from untrusted contacts should be straight ascii, parsed in a memory safe language with no further features until you interact (ie, write back etc).
The fact that you force EVERY user you interact with to have them same treatment is the problem. Some people, I left into my house unsupervised. Some as guests. Some I don't let in at all.
We need to start modeling this approach online more.
I don't think you understand how far users will go to work around safeguards if they interfere with their daily life.
I want all of those things. I use them every day. I don't trust any of my contacts to not have an infection.
It sounds like their first step in remediation was to move the GIF copy operation into the BlastDoor sandbox, which is written in Swift.
theoretically I guess you don't need that, but you'd have to send a payload linear in size to the number of cycles expected to run the shellcode, and that wouldn't lend itself to a processor-like design - it'd just be too big.
I was confused about how they got the thing to run for an unbounded amount of time, but I guess they probably have the final operation at the end of a "processor cycle" be to overwrite the next SegRef so that it loops back to the current SegRef.
I'd love to see the thing in more detail - what the shellcode looks like, how the CPU was designed, everything.
a scummy company but such transcendental brilliance..
Sometimes I feel like it's hopeless but my brain cannot help but work on creating solutions to this sort of problem.
I wonder how much time it took to develop, I assume the whole general programming language from NAND gates is not something they had to come up with from scratch.
Putting the pieces together though, that's a work of art
All the steps are things you cover in a computer engineering degree (I think), but putting them all together in a tightly constrained environment (or even recognizing that the exploit can happen in the first place) takes a ton of skill, resources, and dedication.
If you are Wrangling Untrusted File Formats, you should be doing so Safely, using WUFFS.
You can't make this mistake in WUFFS. Your WUFFS image decoder might decode the image incorrectly, maybe Rudolph has a green or blue nose, maybe he's upside down or just a sea of noise, but it can't have a buffer overflow even if you screwed up really badly.
For example, any equivalent of the repeated addition numSyms += ((JBIG2SymbolDict *)seg)->getSize(); in WUFFS will get flagged, it clearly could overflow and WUFFS wants you to write code explaining how you're going to prevent that because overflows aren't allowed in WUFFS.
This leaves outfits like NSO with nothing much to attack. Sending me pictures of Rudolph with a green nose by "exploiting" a bug in my image decoder isn't very useful, unlike taking over my phone...
so they just took an open source parser and slapped it in there
it’s hard to rewrite PDF parsing to a new language so that everything still works. Especially those weird features that people forgot about.
I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.
This is a bit beyond my ken :)
Not really. They depend on guessing being slow. P, just P, can do slow. P can be bigger than the universe even with low values of n.
If P=NP, then those previously thought to be intractable problems, are actually tractable. And the foundation of a lot of security-related engineering collapses.
While that means most protocols used for cryptography would need to be replaced (hashing, digital signatures, etc) it also means other combinatorics algorithms (traveling salesman, protein structure prediction) would become solvable which may been boon for logistics and/or computational science.
(I think this is correct) If P=NP there will still be intractable problems; they would be ones where the solutions can't be verified in polynomial time... along the lines of verifying the solution is correct is as complicated as brute forcing the solution.
Note: it's been a while since my computation theory class. ;) I am reading over https://en.wikipedia.org/wiki/P_versus_NP_problem and relearning the fine house of cards theoreticians have divided this problem into. There is a "consequences of P=NP" towards the bottom that sums it up better than I can.
"A proof that P = NP could have stunning practical consequences if the proof leads to efficient methods for solving some of the important problems in NP."
Note the "if". It is extremely important to the meaning. It's very possible for P to equal NP, but for that "if" to be false.
Which would make the btc blockchain an incredibly expensive and valuable data set, for someone armed with the right mathematical theory.
This wouldn't be faster than ASICs. The coefficients would be too big for it to be practical.
The equality of P and NP would not itself mean there are fast solutions.
In fact, many are literally mercenary soldiers!
Responsible disclosure is for the gullible.
The market keeps saying “this is what its worth”
Here you have a list of decade of performance of experts/top competitors in:
security, reverse engineering, crypto, low lvl, malware analysis, OS internals, memory corruption
some of them even work at Google Project Zero :)
~ Jeff Hammerbacher, fmr. Manager of Facebook Data Team, founder of Cloudera
This quote isn't just about people working directly on ad tech and ad targeting algorithms, but any product that is "free" and ad supported.
After selecting "Reject all" in the cookie dialog, the cookie was literally spinning (they have a spinning wheel animation for processing your cookie response!) for >5s on "We are processing your cookie settings request". If this is what the best minds of our generation are achieving then help us god!
The thing is, it's usually much easier making money off these things then making money from solving impactful problems.
If you're a regular joe and you could spend your next 5 years with a 100% chance of making millions for finding exploits, or a 0.01% chance of solving P=NP, I think the irrational decision would be picking the latter.
The problem is that they don't realize that they can stop once they have it.
I do know of several founders whose first company was a nasty ad-tech company (spyware), and after making their millions, their second company is a much more honorable digital health company.
You probably can find examples where such people can keep on creating nasty companies, so it would be interesting to see if there was a research about whether or not people pursue more honorable goals after they get lots of cash.
* a shiny UI for customers
* a bank of 0-days
Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased.
Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres really no way to stop a 0day from leaking from a researcher like that
This exploit has been closed, but we haven't heard anything about Pegasus not working anymore, so i'm just assuming they moved on to the next exploit. Previously there was a big Whatsapp exploit FB closed that had them hurting. I'm sure they always have multiple backups for when this happens
There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. NSO is just "in your face" which makes people angry
NSO was caught, and thats why Google is crediting them. But this same exploit could have been heavily used by 8200/NSA/who knows who else
Of course they can, it is just illegal and might be classed as treason or similar.
Remember we are talking about getting exploits for nation states here rather than just some regular company - hiring spies is part of standard operations for the intelligence community and would be a valid zero-day acquisition strategy (depending on the protection offered for NSO by Israel).
popular social media account handles go for 4 figures.
people have wallets on their phones with 6+ figures in crypto
OSINT'ing a billionaires' phone number, leveraging a 0-click, and you are looking at 8+ figure trade, personal, and national secrets.
Yeah, billionaires and Trillion-dollar company CxOs have to step up their electronic security
The Saudi's wanted leverage, gotten via Bezo's affair, but the US cannot let (national security) leverage escape our borders - and leaked his affair.
Shit is just lulz to me.
But it's super stupid he had just one phone combining personal, business, more private business. At least from the reporting that's what it sounds like happened.
Even the dumb ass Jan 6th coordinators and Meadows used burner phones. IIRC standard practice for political 'execs'/important leg committee staff.
Trying to trivialize the threat they pose only helps NSO
Plus, "willing to sell to nations with bad human rights records" should be on that list
I mean the whole “nation state” or “nation state backed” hackers thing was always a liiiiitle (very) ambiguous right?
Does the evidence really even move the goal post or mitigate the convenient scapegoating?
Politicians and CEOs and certified IT professionals are all incentivized to say “it was a nation state there’s nothing we could have done!” and rely on their sycophants to never question it, instead of “we’re incompetent and powerless towards random teenagers who rented a rootkit before renting a compromised windows machine that happened to be located in russia”
One can't really arrange the funding of computer scientists/mathematicians working full-time on the thankless job of finding vulnerabilities without nation-state kind of money, as opposed to employing known vulnerabilities which carry lesser chance of success and greater chance of blowback in their execution.
Aftercall NSO is itself an IDF unit 8200 outfit.
But ultimately I’m not sure the distinction matters if the main result is that hackers get away unscathed and the victims just deflect attention to the wrong targets
The resources required to develop these exploits (and mitigate against them), were at least an order of magnitude above the next tier, because there was very little sharing and reuse (except among allies). Now, thanks to NSO, any backwater tinpot dictatorship that can't provide reliable electricity or offer a coherent policy for longer than a few months at a time qualifies as a "nation-state" (i.e. hack anyone in the world), if they can spare a 6 or 7 digit budget to hire exploits.
What NSO/HackingTeam and similar offensive security companies did was to lower the bar on nation-state capabilities by removing the need to develop a local program over many years, and allowing the reuse of infrastructure, personnel and exploits by countries that aren't allies. Call it a SpaceX for hacking as opposed to space launches.
> Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
They create an emulated computer by decompressing an old image format inside a PDF file which has a .gif extension! That is top notch!
This negligence is killing journalists and activists.
Not sure how Apple dev machines look like, but usually I can find stuff like this with a well written grep or a shell script and my API definition, if I'm not sure that I caught everything while refactoring. The codebase might be massive but the team should be sizeable enough to handle it.
Parsing any untrusted data should always be sandboxed.
Sandboxes don't reduce the need in having programmers with straight hands. They just trade less safe APIs, for ones deemed more so. You will have as much holes in the sandbox, as much APIs you add to it.
Any chat or message software you want to be REALLY secure should not have support for rich media of any type. I am even suspicious and skeptical that Signal supports embedding animated images.
I can name exploits of this type on desktop PC operating systems going back probably 22-23 years...
I do realize that lack of rich media inline in messages is a non starter for most non-technical consumer end users.
Besides, its also totally impractical.
what you can't do is implement variable-size compression like Huffman trees. if you think about implementing Huffman as a circuit, you have a fixed length output - the worst-case length. you can't read the output any more than you can read the input, so you don't know how much padding you can throw away. therefore it's useless.
the same principle applies to running any algorithm that has a dynamic computational complexity. so you can run a Turing machine in FHE, but you won't know when it halts.
• Compressing to a file size limit is actually difficult/expensive. Tools usually target some good-enough quality level, and then the file size depends on remaining entropy in the image. The limit would need to be conservatively high.
• Exploits aren't necessarily larger than an average image. Adversaries in this case are quite skilled, and may be able to codegolf it if necessary.
It's done clientside, and you can't remove it (on iOS) because only official Signal-published builds will receive push notifications of new messages from Signal servers (via APNS).
This doesn't apply to a sender of an exploit, but does apply to normal people who wish to send full res images or patch out the DRM in the Signal app.
I believe they wont use Signal's own client to send their exploit. Client side TX restrictions make no sense.
Does anyone have a sense of who they sold this to and who used this particular 0-click exploit?
They are actively making this world a much worse place long term, and why - pure greed for money and power. They don't even try to act like there is some moral / law filter when choosing their customers.
NSO as company is a highly amoral business too, kind of goes hand in hand.
How nazis organized jewish extermination of millions in concentration camps might be also amazing from bureaucratic & organizational point of view, yet I completely fail to marvel at such an achievement in efficiency.
This isn't a one-time thing. They're a funnel.
> Does anyone have a sense of who they sold this to and who used this particular 0-click exploit?
From the article:
> Earlier this year, Citizen Lab managed to capture an NSO iMessage-based zero-click exploit being used to target a Saudi activist.
Might as well praise German logistics circa 1940-1945.
(Note on the above off-repeated cliche: they did not, in fact, make the trains run on time.)
https://theprint.in/opinion/only-15-indians-know-about-pegas...
Yes.
"The Wire has confirmed the numbers of at least 40 journalists who were either targets or potential targets for surveillance. Forensic analysis was conducted on the phones of seven journalists, of which five showed traces of a successful infection by Pegasus." https://thewire.in/rights/project-pegasus-list-of-names-unco...
The forensic analysis was conducted by Amnesty International's Security Lab and was peer-reviewed by Citizen Lab 1. https://www.amnesty.org/en/latest/research/2021/07/forensic-... 2. https://citizenlab.ca/2021/07/amnesty-peer-review/
Also, "In the midst of the heated West Bengal assembly election, the phone of poll strategist Prashant Kishor was broken into using NSO Group’s Pegasus spyware, according to digital forensics conducted by Amnesty International’s Security Lab and shared with The Wire." https://thewire.in/government/prashant-kishor-mamata-banerje...
Govt of India in parliament on NSO group (Dec 3, 2012): "There is no proposal for banning any group named NSO group" https://twitter.com/A2D2_/status/1466700684573642752
Having multiple parsers for security-sensitive data that isn't just outright signed at an external layer is always a recipe for disaster.
Still hate NSO though.
Eventually though you get into one of those annoying simulation vs emulation style arguments so I’m happy to accept either definition of VM, just as long as both sides agree on what it is that they’re discussing :)
For example, imagine if you are counting money and because of the overlow millions turn into several cents.
Another evil thing is indirect jumps. They should be implemented using an index into a jump table.
In practice for the last 30+ years the default behaviour has been non-trapping. So much so that making it trapping would break vast amounts of software that depend on it, so you can't change the general case behaviour in C, C++, etc, or "safe" languages like Java, C#, etc.
Newer languages do recognize this and make trapping the default behaviour, but "rewrite everything at once" is simply not a tractable problem.
You can change it in C and C++, since the current behaviour is undefined i.e. give control of your computer to hackers.
GCC and Clang should make -ftrapv the default. They won't, because whichever one does it first will then perform worse on benchmarks than the other, and that's the only thing the devs care about. But they should.
Because too much code is completely broken if you do.
The only things that make use of overflow being UB are optimizing compilers, and they have reliably broken code for because of this for 20 years. This means most developers have realized that pretending non-twos-complement architectures still exist is nonsense, and both C and C++ have significant pressure to actually define overflow as being 2c.
Any code that gets broken by that already has a security bug.
> The only things that make use of overflow being UB are optimizing compilers, and they have reliably broken code for because of this for 20 years.
Exactly! Code that can be broken by this is already broken. Using -fwrapv won't make it any more broken, it just makes the way it breaks safer.
Saying "it is UB therefore is a security bug" is nonsense.
Saying it shouldn't be UB is useful, and is being addressed by the C and C++ standardization committees, and that work will not change the behavior, it will simply remove the "it's UB" nonsense that optimizers occasionally use. At that point the defined behavior will be a twos complement overflow.
Saying it's UB and therefore can be arbitrarily broken is equally nonsense, breaking code that is correct, within the confines of actual real machines, for no reason other than "it's UB" is not anymore helpful than saying "why don't you just rewrite it all in X".
It's actually incredibly difficult given your definition of what is allowed, to write anything in C that is not UB.
It doesn't though, because gcc et al don't care how the hardware work, they can and do happily miscompile that kind of code into security vulnerabilities instead. If you're talking about embedded code that's compiled with a specific vendor's non-optimizing compiler then yes (but changing GCC and Clang's defaults will have no effect on that kind of code), but if you're talking about code for mainstream desktop/server systems then no, it already doesn't and can't rely on wrapping overflow.
> Saying it's UB and therefore can be arbitrarily broken is equally nonsense, breaking code that is correct, within the confines of actual real machines, for no reason other than "it's UB" is not anymore helpful than saying "why don't you just rewrite it all in X".
But it's not correct, not just in theory but in practice. In real life, code that does this and gets compiled with a modern optimizing compiler like GCC or Clang is already an RCE unless proven otherwise. Yes wrapping is what a naive assembly translation would do. But the compilers don't do naive assembly translation and haven't for decades.
> It's actually incredibly difficult given your definition of what is allowed, to write anything in C that is not UB.
Yes, which is why we keep getting security vulnerabilities like this one.
The overflow that starts this exploit chain is an unsigned overflow. Unsigned overflow in C and C++ has defined behavior. That behavior is wrapping.
Unfortunately (IMO), C and C++ has a sizable community that is unwilling to accept pessimizing behavior for various atypical architectures. This is not unreasonable, but it hugely limits the ability of the language to make decisions that work great for the 99%ile case.
Same applies to the Algol linage.
The NSA not to mention the entirety of the US defense industry could’ve easily found a way to break the encryption on a single device especially since they only had to break a relatively simple password / passcode it’s just a question of how much would it cost and how long would it take.
I'd rather be blown up.
Like with any complicated tech things are a bit more involved since their exports are controlled under the same regime as weapon exports do in Israel they likely have some oversight to ensure that their tech does not leak out and isn’t used outside of the bounds of what was agreed on at levels that go beyond NSO as a company itself.
These exports were very much part of the Israeli and quite likely the US foreign policy.
Some deals like the one with KSA probably should never been greenlit but many others unfortunately have had the outrage steered away from the main culprits.
Amongst their exports they’ve also exported it to European nations such as Poland.
Poland an EU and NATO member had used this software to have one of its government agencies spy on a prosecutor in charge of an investigation into some of the leading party’s members, however it didn’t seem to generate as much outrage and what little it had was directed as the NSO or Israel which is laughable.
Poland isn’t a state that normally could fall under any arms embargoes or export restrictions.
This software had likely very little to do with Khashoggi‘s fate, they didn’t use it to lure him into a trap or to track him for an assassination he was killed in an embassy after being invited to come in, and he came in out of his own free will.
I’m far more interested in how some of their western clients have used this software and unfortunately so far no one seems to want to pick or steer the story that way.
The collapse of that argument in the Facebook case is why Apple are now suing as well.
It's only illegal if you get caught. And then find someone to prosecute you.
Apart from Rust, Wuffs is also a good candidate for codecs: https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang...
Too bad that Swift isn't that good for low-level codecs, so a Swift rewrite of Messages couldn't remove C dependencies.
Sandboxing using wasm has around 10% overhead, so a full rewrite might end up running faster. But recompiling the code takes less time and effort and will not introduce new bugs, so it's a useful option too.
https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
Rust in release mode does not check for overflow on addition. Only debug mode Rust does that.
Naturally this could eventually be used in another way.
There are no invicible fortesses, but some have enough defenses in place to keep almost everyone away or die trying, except the very resourceful ones.
Does it matter if it's a buffer overflow or a rusty pan, if the end result is someone reading your device's memory?
Sure there are other ways to then take advantage from killing a critical process, but it would be one attack vector less.
C doesn't do the latter. Blaming the human programmer for stupid accounting mistakes is misplaced. The human's mistake was in choosing a bad language.
Containers and move/by-value semantics in C++ inherently avoid a lot of stuff, it's sad seeing so many C++ developers do not actually know the language and instead stick with a "C with classes" that doesn't provide any extra security compared with C.
“JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.”
I also keep thinking "The Cylons would totally write an exploit like this."
Reminder that the Cylon attack was an insider job in the rebooted series (from a model Number Six).
This shows how un-theoretical that question is.
An invisible nuke that destroys access to clean water overnight across the nation, that’s the future!
Like they just HAVE to have the source code right?
That said, the particular component this targets is open source. It’s the JBIG2 decoder that is part of XPDF.
People without reverse engineering experience often think there's a massive difference between white-box and black-box auditing, but there really isn't. Yes, it takes longer, but not ridiculously so.
NSO aren't interested in being an overtly criminal operation; breaking into Apple and stealing source would be a giant liability they don't need to have. Their game is feigning ignorance as to what their customers do with their software. They can't afford to be caught commiting crimes directly.
Having iMessage disabled and no SIM card in the phone (use an external wifi vpn router with a sim) is a mitigation, and is one that I use.
Why use a library to support every format ever made? To inline image previews? Just show a thumbnail.
Why do anything with PDF? Just show a thumbnail.
I'm pretty sure iMessage already down samples the puppy pictures I send to my mom, and doing some kind of conversion to tunnel across MMS for non iMessage recipients (eg Android phones).
The vault7 was mind-blowing and somehow reinforced what was de facto knew but until then no solid proof was there[merely that quite everything is compromised directly, and when that's not the case, your output is mined],available to the large public.Again, if the Media was more keen on that issue (Privacy, 3-letter agencies being abusive,etc) then people would remember the issues that exist in most computing systems today.
For people who at least skimmed through those vulnerabilities,tools, and leaked documents, it's not surprising at all that these kind of exploits are still out there.It's actually disappointing and frankly pathetic that people don't pay attention to some things because they disagree with the source of information(By the way WL revealed things from the entire spectrum: right/left, Russia/western countries/Asia/etc).These 'NSO leaks' are not eye-opening exploits/techniques, but don't let me spark the bubble of "modern infosec journalism".
They (loosely) created a virtual machine out of a (very) abstract vuln in the JBIG2 library to create their own logical Turing machine / computer that they then built their own simple architecture for...and then could allow for the computation of any arbitrary function within arbitrary memory. Brilliant; bravo. I salute the ingenuity of this one.
When I worked at Apple, we encountered a Jailbreak exploit that relied on some poor code in one of the open-source type fonts. It appeared that someone committed a mod to the project that neglected to do an array bounds check, waited ONE YEAR!!! and then exploited the vulnerability to create a PDF document that would jailbreak a phone if the PDF was viewed.
I guess it is possible that something similar was done here.
>The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.
I bet even the Project Zero authors were profoundly amazed how NSO hackers managed to do that. Maybe they can hire them when NSO goes bust.
90% of zero-days could be stopped at the front door by file format checkers doing static analysis on popular file formats (like ZIP, MS-CFB, Office, image, PDF) exchanged via message/email to reduce semantic gaps in the file format and weird-machine ambiguities that will inevitably be abused by attackers.
The problem is simple. Most codecs (and even vulnerable anti-virus software) were written in a time when Postel's law was the norm. It's much easier to write a file format checker as defense-in-depth for the vulnerable codec than to rewrite the codec, especially since a codec's interface typically can't expose policy decisions like a checker's interface can.
As a community, we could solve this problem tomorrow.
However, the file format checkers to defend don't exist, because the major email/message providers don't want to invest in them, because nobody would see this work. Even if we build them, they don't want to invest in tuning the false positive rate, because people want lax security not strict security on all message/email attachments they open.
Although there’s clearly bugs in the open source JBIG2 impl so someone probably made fixes there as well?
https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1
Don’t think of these folks as “google” employees. Think of them as “really good hackers with corporate sponsorship”. They look for flaws in everything - windows, apple, Linux, and google software. You should read some earlier blog posts, they’re really high quality.
Either their security or PR is great (or both?)
It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.
1. Google will do costly things to be secure.
2. At the time I did not hear of any other organisation following Google’s lead.
3. They did not reverse the ban later.
They've been completely breached by Chinese agencies in the past, and IIRC the revelations in the Snowden leaks prompted them to redo their entire internal networking layout because of concerns about state-level spying.
On the Android front they keep tightening up access (removing more power from root, more use of SELinux and other controls) because of breaches in one form or another.
And the browser's job is to be constantly online the whole time and download and execute JavaScript that gets dynamically optimized for your CPU architecture using one of the fastest runtime compilers ever made (aNd WhiCh MiGhT HaVe BuGs iN iT), and then your CPU directly, blindly executes the result, with as little bounds-checking as the runtime compiler thinks it can get away with so it runs as fast as possible.
Zooming out somewhat, the new OS paradigm is the continuous download and execution of absolutely arbitrary code, all day, every day, from sources including hacked ad servers, successful social engineering campaigns and your blog.
And Chrome has like ~70% market share.
Because public company and "legally bound to create value for shareholders" and all that, it is very much in Google's interest that they maintain that market share because that lets them serve more ads.
So that's ultimately the reason. Google wants the world's most secure platform so they can guarantee their ads business.
google is incentivized by ad space, not hardware sales. a large portion of the users of google apps and search engine are using apple hardware.
In this case, this was already fixed by Apple's engineers. And like the article says, Citizen Lab (people who captured the exploit in the wild) and Apple have shared the exploit with Project Zero who analyzed it as well and wrote up that blog post.
Project Zero people have found numerous bugs in Apple's software in the past. They look at all kinds of software that's written by all vendors.
Do they just have access to the whole process memory of the iMessage process?
Or does it go beyond that?
The BlastDoor sandbox was added since then (which project zero also has a post on), but this exploit happened outside the blastdoor sandbox, so that doesn't change anything.
If previous iMessage exploits are anything to go on, it's likely this gives unsandboxed root access to all memory on the device.
How does anyone be so good with this kind of things?
It is a well known method to make a spy operation more elaborate to worry adversaries.
This isn't like goto fail, and even that one could be explained by developer oversight.
On top of this, why should a link containing a malicious payload be able to speak to other parts of the system? Doesn't Android do a basic security measure called sandboxing and `principle of least privilege'[0]?
I am highly suspicious of every URL in my SMS messages app now thanks to these NSO revelations. I'm not especially interesting, so I doubt I had NSO-grade malware on my phone, but we need to protect the masses, not just those with a high profile threat model (Journalists, Dissidents, Activists, etc).
[0] https://en.wikipedia.org/wiki/Principle_of_least_privilege
"(...) iMessage calls the following method in the IMTranscoderAgent process (outside the "BlastDoor" sandbox), (...)"
Looks like they have been decoding GIFs outside of the sandbox, which has been addressed later:
"Apple inform us that they have restricted the available ImageIO formats reachable from IMTranscoderAgent starting in iOS 14.8.1 (26 October 2021), and completely removed the GIF code path from IMTranscoderAgent starting in iOS 15.0 (20 September 2021), with GIF decoding taking place entirely within BlastDoor."
The reason they create a virtual machine out of image operations is because they have not even got direct code execution at that point.