US judge finds Israel's NSO Group liable for hacking journalists via WhatsApp

Re:US judge finds Israel's NSO Group liable for hacking jour... by upofadown on Saturday December 21, 2024 @06:40PM (#42483231)

It was a buffer overflow in a VOIP stack:

* https://www.theverge.com/2019/5/14/18622744/whatsapp-spyware...

Interestingly enough, Signal (and others) had the same sort of vulnerability on Android from a WebRTC stack:

* https://googleprojectzero.blogspot.com/2020/08/exploiting-an...

The big issue in both cases is that the exploit was triggered before the user answered the call.

I think the moral here is that a secure messenger should not execute inherently insecure code (i.e.complex code) on behalf of entities that are not really well trusted by the user. The default should be always plain text.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by xvector on Saturday December 21, 2024 @07:57PM (#42483619)

The other moral here is to stop using memory unsafe languages. It's just so incredibly dumb that we keep making excuses for this.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by mountainmonk on Saturday December 21, 2024 @10:13PM (#42484143)

Does Rust make RCE impossible?, I don't think it does.

There is the option of not having data and code sharing the same stack, that seems like a better solution to me but that's such an option is not usually talked about.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by saagarjha on Saturday December 21, 2024 @11:07PM (#42484330)

It makes this kind easy pivot to RCE impossible. Attacks these days are generally more sophisticated than simple buffer overflows, fwiw. Targeting function pointers from a heap overwrite gives the same capabilities.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by hulitu on Friday December 27, 2024 @06:14AM (#42521370)

> Does Rust make RCE impossible?, I don't think it does.

Well, RCE (cargo) is built into it. /s

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by hi41 on Sunday December 22, 2024 @10:56AM (#42487099)

I think most influential companies such as Microsoft snd Google have said that c and c++ need to be deprecated. I think replacing old code with memory safe languages takes time, effort and money. Hopefully in a decade we can this can be fully done.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by hulitu on Friday December 27, 2024 @06:13AM (#42521367)

> The other moral here is to stop using memory unsafe languages. It's just so incredibly dumb that we keep making excuses for this

Has your "memory safe" language been audited for security ?

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by 3eb7988a1663 on Saturday December 21, 2024 @10:12PM (#42484140)

Was the spyware persistent? That is, would a reboot clear it? Not that it matters. Presumably, the attackers were so motivated they would re-infect the device the moment they saw it go dark.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by saagarjha on Saturday December 21, 2024 @10:59PM (#42484303)

No and you've provided a good reason why it doesn't have to.

[ Parent | on HN ]

Re:US judge finds Israel's NSO Group liable for hacking jour... by hulitu on Friday December 27, 2024 @06:12AM (#42521364)

> I think the moral here is that a secure messenger should not execute inherently insecure code (i.e.complex code) on behalf of entities that are not really well trusted by the user. The default should be always plain text.

Whattsup and co, are very happy to execute untrusted code: images displayed in messages, websites fetched and rendered. Basically a bad actor's wet dream.

[ Parent | on HN ]