Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by cehrlich on Tuesday August 24, 2021 @09:11AM (#28288367)

I certainly don’t want to suggest that Apple couldn’t do more in terms of security, but 0-days are inevitable. Every OS has them, and will continue to have them. Throwing money at this can make it better, but I don’t think it’s possible to “fix” it without creating some sort of new paradigm for how software is made.

[ Parent | on HN ]

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by albntomat0 on Tuesday August 24, 2021 @09:30AM (#28288586)

True, but there's a wide range of things that can be done to change how difficult it is to find those 0-days, while also provide good incentives to those capable of finding said O-days.

Writing the iMessage parser in a memory safe language is a step towards a "new paradigm" [0], but more can and should be done by a company Apple's size.

[0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

[ Parent | on HN ]

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by simion314 on Tuesday August 24, 2021 @09:41AM (#28288721)

Apple has the money and influence to buy this exploits and analyze them, probably NSA are using them too so Apple won't attempt to upset NSA so they do nothing because the "good guys" are using it too.

Also Apple is notorious on their bad bounties and on have a bad history on providing researchers with unlocked devices for testing, probably Google found more security bugs in iOS then Apple.

[ Parent | on HN ]

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by hvis on Tuesday August 24, 2021 @02:59PM (#28293306)

Some 0-days - sure. But we're talking about a major corporation continuing their business uninhibited.

If the NSO Group has been active for a number of years, couldn't Apple make an effort to purchase their products (through some third party, perhaps) and then reverse-engineer the vulnerabilities?

[ Parent | on HN ]

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by sumedh on Tuesday August 24, 2021 @10:13AM (#28289099)

How about Apple gives more money(in millions) to people who report legit security vulnerabilities?

[ Parent | on HN ]

Re:Bahraini Government Hacks Activists with NSO Group Zero-C... by cehrlich on Tuesday August 24, 2021 @10:59AM (#28289719)

I agree that Apple should do more to improve their relationship with security researchers, including paying better.

However I also don't think that this can fully solve the problem - if a government creates a sufficiently funded black hat operation (or outsources it to someone like NSO, which is effectively the same thing), it's inevitable that they will find a 0-day sooner or later.

This is going off topic a bit, but I honestly don't know what the solution to this is. The pragmatic truth is that anyone who is a big enough target that it would be worth for a hostile entity to spend a couple million to intercept their communication should assume at all times that their devices are compromised.

[ Parent | on HN ]