TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

NSO group iPhone zero-click, zero-day exploit captured in the wild

1446 点作者 ericzawo超过 1 年前

58 条评论

black_puppydog超过 1 年前
Wow, so much discussion of Apple and their software, and so little of NSO group and why they&#x27;re even a thing.<p>I just want to add this: these people operate pretty much in the open. They&#x27;re not ashamed of it either, or else they wouldn&#x27;t put it on their CV:<p><a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;company&#x2F;nso-group&#x2F;people&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.linkedin.com&#x2F;company&#x2F;nso-group&#x2F;people&#x2F;</a><p>That right there tells me that we as &quot;the tech community&quot; are <i>way</i> too okay with this sort of application of the tech. The tech we&#x27;re all so convinced will &quot;make the world a better place.&quot; &#x2F;s
评论 #37430572 未加载
评论 #37430508 未加载
评论 #37430670 未加载
评论 #37430510 未加载
评论 #37431782 未加载
评论 #37432154 未加载
评论 #37432217 未加载
评论 #37430745 未加载
评论 #37475643 未加载
评论 #37435596 未加载
评论 #37435685 未加载
评论 #37433193 未加载
评论 #37440731 未加载
评论 #37437100 未加载
评论 #37430606 未加载
评论 #37508717 未加载
评论 #37431235 未加载
评论 #37430891 未加载
评论 #37432761 未加载
评论 #37430518 未加载
评论 #37432526 未加载
评论 #37430628 未加载
评论 #37430810 未加载
评论 #37431451 未加载
Obscurity4340超过 1 年前
Its super interesting to me how much its emphasized that you shouldn&#x27;t use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there&#x27;s very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface.<p>And everybody parrots the nonsense caveat that everyone shouldn&#x27;t use it, only those special enough should like it was a zero-sum game or scarce resource. Everyone should use it because it disables a lot of nonsense that doesn&#x27;t serve you and probably even saves battery power. Also, the more people use it, the less it can be used to fingerprint specific users.
评论 #37427137 未加载
评论 #37429583 未加载
评论 #37429273 未加载
评论 #37428257 未加载
评论 #37429266 未加载
评论 #37428795 未加载
评论 #37429483 未加载
评论 #37441398 未加载
评论 #37428355 未加载
评论 #37428236 未加载
londons_explore超过 1 年前
How many exploits has iMessage had now?<p>Isn&#x27;t it time we made first messages from all new contacts plain text only, and all other messages some very restricted subset rather than some crazy extensible system that isn&#x27;t so different from ActiveX?<p>And on top of that, maybe the whole app should run in a sandbox.<p>And on top of that, perhaps it should all be a webview to give one more layer of protection.
评论 #37428156 未加载
评论 #37431080 未加载
评论 #37429345 未加载
评论 #37427464 未加载
评论 #37429654 未加载
评论 #37437712 未加载
评论 #37452685 未加载
评论 #37429578 未加载
ruuda超过 1 年前
Again a buffer overflow in image decoding, that sounds similar to the one from 2021 [1]. That one was wild, building a CPU out of primitives offered by an arcane image compression format embedded in pdf, to be able to do enough arithmetic to further escalate to arbitrary code execution!<p>[1]: <a href="https:&#x2F;&#x2F;googleprojectzero.blogspot.com&#x2F;2021&#x2F;12&#x2F;a-deep-dive-into-nso-zero-click.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;googleprojectzero.blogspot.com&#x2F;2021&#x2F;12&#x2F;a-deep-dive-i...</a>
评论 #37425709 未加载
评论 #37426140 未加载
评论 #37426115 未加载
评论 #37426628 未加载
评论 #37426793 未加载
评论 #37426908 未加载
评论 #37426618 未加载
评论 #37426975 未加载
评论 #37426809 未加载
评论 #37427596 未加载
MiguelHudnandez超过 1 年前
These fixes came out today, apparently timed with the announcement, make sure updates are applied for you and yours.<p><a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT201222" rel="nofollow noreferrer">https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT201222</a>
评论 #37425214 未加载
评论 #37428452 未加载
ch4s3超过 1 年前
Clearly putting the NSO group on the Commerce Department blacklist didn&#x27;t go far enough. These scumbags belong in the Hague(metaphorically at least).
评论 #37428393 未加载
nickaflip超过 1 年前
If you are curious about NSO Group, Pegasus, or Citizen Lab - Darknet Diaries podcast (Episode 100) does a good job diving into the history.
评论 #37428689 未加载
kmos17超过 1 年前
There needs to be a more fine tuned lockdown mode, for example to disable automations and risks in imessage and safari but leave device accessories working. Losing bluetooth accessories to protect yourself from zero click imessage exploits is just bad. imessage is the major wide open attack surface.
评论 #37429183 未加载
评论 #37429316 未加载
aborsy超过 1 年前
I wonder if the lockdown mode would have prevented this attack?<p>Has an iPhone in the lockdown mode been hacked so far, using a zero day vulnerability (not tricking the user to install a malicious program)?
评论 #37425267 未加载
评论 #37425236 未加载
评论 #37428086 未加载
dang超过 1 年前
Related ongoing thread:<p><i>iOS 16.6.1 fixes two vulnerabilities known to be actively exploited in the wild</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37423506">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37423506</a> - Sept 2023 (7 comments)
goldinfra超过 1 年前
I don&#x27;t need to be able to accept iMessage messages from random numbers. I&#x27;d be happy to enable &quot;Prevent messages from unknown numbers&quot; for example. Is this possible?
评论 #37434560 未加载
评论 #37428371 未加载
评论 #37429057 未加载
KernelPanic超过 1 年前
Here are several comments regarding rewriting everything in safer languages like Rust, among others. However, before such a transition can potentially take place, I believe it&#x27;s more realistic to achieve another important goal: enabling robust logging capabilities, akin to the Endpoint Security Framework on MacOS or System Events on Windows, for iOS. With the implementation of such tooling, enterprises could potentially integrate mobile endpoints into their SIEM systems, making it easier to detect attacks of this nature.<p>I&#x27;ve personally utilized the mvt-ios tool to investigate iPhone backups. Within these backups, there is a SQLite file that mvt-ios scans for potentially malicious process names. (I&#x27;ve examined all publicly available STIX2 IOCs and having tooling that simply reports the names of processes from mobile phone to a central SIEM would be adequate for identifying these attacks.) Unfortunately, this method cannot be used in real-time across all devices. To employ it, one must first create a complete backup of the phone and then scrutinize that backup. If we had a tool similar to the Endpoint Security Framework available for mobile devices, we could activate enterprise-level security monitoring systems and potentially establish secure communications in the current era, rather than waiting for everything to be rewritten in Rust (a bit of irony).
nevi-me超过 1 年前
I appreciate that a solution is for people to update immediately. It really makes me wonder if my Android phones over the years have had 1-days exploited by the sheer incompetence of the ecosystem in updating phones.<p>Not much confidence when you get an update with security patches from 2-3 months ago.
评论 #37426157 未加载
评论 #37426797 未加载
kbos87超过 1 年前
Naive question, does apple have any way of detecting and informing users who are current victims of these types of exploits when security fixes are issued?
评论 #37428230 未加载
评论 #37427520 未加载
envy2超过 1 年前
Would be nice if either CitizenLab or Apple had published some IOCs...
评论 #37425548 未加载
sebstefan超过 1 年前
An exploit like that is apparently worth $2 000 000 on Zerodium. <a href="https:&#x2F;&#x2F;zerodium.com&#x2F;program.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;zerodium.com&#x2F;program.html</a><p>Kind of insane, the only higher you can get is finding the same on Android
monkpit超过 1 年前
This kind of thing always confuses me. How can anyone assume any machine is NOT compromised already… Like… ever?<p>You really have no way of knowing that a box is not owned as soon as it has connectivity (and possibly even before that).<p>I feel like many people have the idea that security is “these machines are good until we detect some intrusion”.<p>But it seems like the more sane default is “every machine is compromised and I should never trust anything ever” if you take security seriously.<p>Maybe the latter is gaining popularity, but I still feel like the former ideology is pretty prominent.
评论 #37437515 未加载
eviks超过 1 年前
Again iMessage? Would be nice if you could expel insecure components like that from your walled apple paradise
评论 #37430047 未加载
评论 #37430035 未加载
parhamn超过 1 年前
&gt; The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.<p>Man, iMessage is a security disaster for Apple. No matter how much work they do in other areas, it seems like they&#x27;ll paying for a while for their decisions around the iMessage architecture.
评论 #37425269 未加载
评论 #37425219 未加载
评论 #37425147 未加载
评论 #37425871 未加载
评论 #37425562 未加载
spacebacon超过 1 年前
In addition to lockdown mode, pair with a vpn and security researcher Jeff Johnsons &quot;stop the madness&quot;, and &quot;stop the script&quot;. Both are paid safari plugins for ios. Stop the script is the best way to stop inline javascript on ios. Disabling JS on iphone can&#x27;t do that.
nnx超过 1 年前
It’s interesting that latest Safari TP (r178) somehow crashes on macOS Ventura, with or without the patch, when reading HN comments on this specific article.<p>Is there a honeypot in a comment on this page? &#x2F;paranoid
javajosh超过 1 年前
I&#x27;m confused why they waited to patch this vulnerability until it was found in the wild. Or am I misunderstanding? Is this not the same NSO zero click exploit from like a year ago?
评论 #37430299 未加载
arecurrence超过 1 年前
We&#x27;re all very lucky that CitizenLab exists as they are often the first discovery point of numerous similar exploits. They proactively scan the phones of internationally sensitive people and publish their findings. I&#x27;m not aware of any other public service that has had this much success exposing mobile device attacks. Attacks which have completely and utterly compromised the entire device that someone keeps with them all day every day.<p>I tip my hat to CitizenLab and the good work they do.
评论 #37427261 未加载
评论 #37425580 未加载
10g1k超过 1 年前
Question.<p>Back in the dark ages, a &quot;zero day exploit&quot; was a piece of malware which would lay in wait, doing nothing, counting down the days, until it hit day zero, and then it would trigger and do naughty things. Some folks also referred to this as a time bomb, but that was a less `|33+ term for it. We used to see a lot of these available on sites such as asta... never mind.<p>Fast forward to the era of &quot;cyber&quot; being hugely popular, and the massive flood of people doing short Kali or &quot;Ethical Hacking&quot; courses and getting into IT security jobs, and I see various formal IT security publications describing a zero day exploit as &quot;ANYTHING which is known and not yet patched&quot;. To me, there is absolutely nothing about that description which relates to the &quot;zero&quot; or the &quot;day&quot; or the &quot;zero day&quot;. I suspect this new terminology is the result of that influx of people with no background in either computer science or hacking, latching on to a cool sounding term and misunderstanding it completely.<p>What is your take on this? Do you go with the ye olde terminology, or the currently accepted terminology in fancy publications? Do you believe the meaning changed, and if so, when and how and why?
评论 #37440445 未加载
评论 #37430022 未加载
bjornsing超过 1 年前
Good to see NSO loosing a valuable exploit chain. If this becomes common enough they’ll think twice about (enabling) targeting legitimate civil society organizations, for purely economic reasons: the risk of detection and reporting of vulnerabilities is much higher than when targeting terrorists and criminals.
mariojv超过 1 年前
I wonder if Apple has a mechanism for notifying people who were affected by the exploit after they update.
评论 #37425408 未加载
cowthulhu超过 1 年前
Does anyone know to what extent this compromises the device? I might have missed it, but didn’t see it explained in the article. Does the attacker get full access to the device, or do they only compromise a subset of the devices functionality?
评论 #37427242 未加载
redbell超过 1 年前
&gt; The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) <i>without any interaction from the victim.</i><p>I’m, in no way, a security savvy but the above achievement must be a lot of work by the NSO group!
评论 #37427084 未加载
forcedmaddie超过 1 年前
I worked for NSO and later at a very similar company in Barcelona. AMA
评论 #37447105 未加载
评论 #37437964 未加载
tornato7超过 1 年前
I just received a random image of a champagne bottle via iMessage from an unknown number. Any way to tell if this is the attempted exploit? I had patched my phone prior to receiving the image.
评论 #37428315 未加载
评论 #37428113 未加载
rank0超过 1 年前
These dudes are insane. I wonder how much exploits like this are worth…
评论 #37427565 未加载
评论 #37426560 未加载
评论 #37426281 未加载
jononomo超过 1 年前
You can turn on lockdown mode on your iPhone and then specifically exclude certain apps and websites from being impacted by it -- this seems like a reasonable middle ground for most people.
kramerger超过 1 年前
&gt; &quot;Apple is aware of a report that this issue may have been actively exploited.&quot;<p>Wasn&#x27;t this captured in the wild?? Then why the &quot;may&quot;?
评论 #37433139 未加载
pt_PT_guy超过 1 年前
I always appreciate how NSO do incredible black hat security. Some of their exploits are true art. Props to their tech skills and creativity.
Obscurity4340超过 1 年前
This is why you don&#x27;t use your iPhone&#x27;s keychain or iCloud keychain. These exploits give access to everything.
theshrike79超过 1 年前
dupe of: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37423506">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37423506</a>
sylware超过 1 年前
Why there are still people who do not understand that when Big Tech talks &quot;security&quot;, it is theirs against you, not yours?
piuantiderp超过 1 年前
One can&#x27;t help wondering if this is kind of announcement is partly meant to cast lockdown mode in a positive light
fortran77超过 1 年前
How did the &quot;Citizen Lab&quot; connect this to the &quot;NSO Group?&quot; Is it just pure breathless speculation?
评论 #37430315 未加载
wyldfire超过 1 年前
Wow this sounds like stagefright was way back when.<p>So for those keeping score, is Android now ahead of iOS in this aspect of security?
评论 #37426012 未加载
评论 #37426914 未加载
评论 #37426006 未加载
评论 #37430953 未加载
评论 #37427887 未加载
评论 #37425875 未加载
评论 #37426593 未加载
trog超过 1 年前
Patches only out for Ventura - any word on whether other versions like Monterey, Sonoma or iOS 17 are vulnerable?
udev超过 1 年前
I don&#x27;t understand Apple here.<p>Just put an army of people on fuzzing the shit out of iMessage and all its possible file attachments.<p>You tried and failed? Fire the bozo who lead the effort. Try again.<p>You did not even try? Fire the c-level bozo who failed to see it coming and failed to approve such an effort.<p>But cynically, more and more it feels like some bugs have to stay unfixed, for NSA use, just that NSO is also getting on the game.
评论 #37428624 未加载
评论 #37428652 未加载
评论 #37428687 未加载
评论 #37428324 未加载
mem0r1超过 1 年前
I wonder why Apple does not include a hypervisor in iOS, and &quot;risky&quot; processes such as iMessage, Safari (maybe a Secure Safari version) could then be executed in a separate virtual machine. The hardware (CPU + RAM) in the iPhones these days should be able to sustain it. Or would there be serious drawbacks to this ?
评论 #37430351 未加载
abledon超过 1 年前
My IphoneSE feels like the old Battlestar Galactica around these new phones
评论 #37426398 未加载
RadixDLT超过 1 年前
the nso go their hands on the vault 7 tools <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;</a>
agnosticmantis超过 1 年前
I find it interesting that most comments here are blaming the victim (Apple’s iMessage and by transitivity its users) rather than the aggressor (NSO and its users).<p>How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing?
评论 #37427542 未加载
评论 #37427612 未加载
评论 #37428186 未加载
评论 #37427472 未加载
评论 #37428172 未加载
评论 #37428299 未加载
评论 #37430808 未加载
评论 #37428185 未加载
评论 #37427437 未加载
illiac786超过 1 年前
Does someone know why this isn’t a Rapid Security Response?
xyst超过 1 年前
for sensitive work, got to air gap that device(s). for any communication, use burners (pre-paid phones) or meet IRL
MuffinFlavored超过 1 年前
how compromised are you if you are affected? can you read token&#x2F;cookie data from other apps (like banking)?
victorbjorklund超过 1 年前
Was just wondering why my Mac wanted to update (since it felt I updated it very recently).
评论 #37425348 未加载
评论 #37426093 未加载
m3kw9超过 1 年前
I wonder if lockdown mode can block this exploit
评论 #37426544 未加载
aihkas超过 1 年前
Can&#x27;t believe the whole western world governments and companies can&#x27;t say or do anything to stop those murderous psychopaths.
pseudo0超过 1 年前
Here we go again... NSO Group has a long history of 0-click, 0-days against iMessage, and just a few months ago Kaspersky caught a different zero day iMessage exploit targeting their staff.<p>If Apple repeatedly fails at securing their devices from an attack vector that has been demonstrated over, and over, and over... no wonder China is banning government officials from using their devices.
评论 #37425458 未加载
评论 #37425985 未加载
评论 #37425822 未加载
评论 #37425405 未加载
评论 #37426308 未加载
评论 #37425394 未加载
评论 #37425563 未加载
评论 #37426700 未加载
评论 #37425857 未加载
评论 #37427597 未加载
fuddle超过 1 年前
For anyone interested in learning more about the NSO group, I&#x27;d recommend this podcast episode: <a href="https:&#x2F;&#x2F;darknetdiaries.com&#x2F;episode&#x2F;100&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;darknetdiaries.com&#x2F;episode&#x2F;100&#x2F;</a>
评论 #37425572 未加载
评论 #37425506 未加载
bastard_op超过 1 年前
So at what point does the world bring sanctions against Israel for allowing organizations like this to exist there? Everyone knows NSO is just a dubiously legal version of common APT groups, so how do they still exist after these years?
评论 #37426971 未加载
评论 #37426608 未加载
评论 #37426665 未加载
评论 #37430329 未加载
评论 #37425746 未加载
评论 #37425577 未加载
评论 #37426030 未加载
mathverse超过 1 年前
The only thing preventing this would be grsec for iOS.
评论 #37427268 未加载
animitronix超过 1 年前
Another day, another reason to be glad I don&#x27;t have a single fucking Apple product in my house.
评论 #37429652 未加载
vinay_ys超过 1 年前
I would expect them to get to iCloud via this attach chain even with advanced data protection on. Which means if you are targeted, they not only get data from your iPhone but also all the data you backed up to iCloud from your other apple devices. I suspect they would be able to compromise apps like 1Password through this. Which means all services whose password and 2FA is stored together in 1Password is compromised.<p>It is good to know lockdown mode stopped this attach chain.<p>Given this has happened so many times, new security posture for a normal&#x2F;regular security conscious person should be:<p>1. Disable iMessage.<p>2. Enable lockdown mode.<p>3. Disable iCloud. (If you choose to keep iCloud enabled, definitely enable Advanced Data Protection and disable iCloud Web, disable passcodes and keychain on iCloud. Disable iCloud mail – it uses 3rdparty proofpoint for scanning – more surface area for compromise).<p>4. Don&#x27;t store password and 2FA together in the same system like 1password. Always use FIDO2 physical key based 2FA, if available.
评论 #37440322 未加载