Hacker News new | ask | show | jobs
by 13 3973 days ago
It's likely too late for panic, everyone is probably owned already. It has the best infection vector ever, unauthenticated, unsolicited messaging with an easily discoverable addressing method. What more could a worm want?
7 comments

>It's likely too late for panic, everyone is probably owned already

That seems unlikely given that the researcher hasn't publicly released the details of the hack, and he says that "he does not believe that hackers out in the wild are exploiting it".

There are tens of thousands of extremely skilled hackers selling exploits on the order of $10K to $100K. I'm fairly certain someone has been exploiting it. Not everyone is a good guy in the world.
If you're taking advantage of the law of large numbers, then it's only fair to use it in reverse: There's literally tens of thousands of iphones used by security researchers. One of them would have received a version if this if it was used on such a wide scale..
That's absolutely not true, your certainty is based on a fundamental misunderstanding of exploits and the amount of time and energy required to find them.
I don't see what's "not true" about it. A worm vector of this scale is certainly worth the R&D investment to find exploits, and it is indeed correct to assume that the vulnerability has been found before.

Whether it has actually been used, given the value of the bug, is a different story. But it should absolutely be treated as "in active use" already, especially by state or state-sanctioned actors (like Hacking Team).

What's not true is that this isn't in the wild. Period. You can make all the points about urgency you want and I will agree completely, but this is not currently in the wild, as far as anyone knows. Saying it actually is being actively used would be factually inaccurate based on the information known right now.
But that's the point: as far as anyone knows - more specifically, as far as anyone has admitted.

We do not have a 100% reliable way to determine whether an exploit is known by others (and likely never will have), and as such there is only one reasonable assumption left to make: assume that it is out in the wild and known by others.

This isn't a new concept - threat modelling requires that you assume every worst-case possibility is reality, so that you can guard against it. This was formalized in the 19th century as Kerckhoff's Principle[1], and undoubtedly existed before that in military circles. This applies equally to software security.

So given that we simply don't and can't know whether it is out in the wild, the most 'correct' assumption is that it is - because that lets us protect ourselves against that worst-case scenario, which may or may not be the case.

[1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Wouldn't you know if you'd received a sketchy MMS from a number you didn't recognize?
The most standout part of this attack (to me) is that it can be 100% silent. The fact that the bug hits before the text notification is fired means that an exploit could potentially stop the notification, delete the message, and go on tramping throughout your phone doing whatever it wants leaving absolutely no indication to you the user that you've been hacked.
Not if the attacker deletes the message post-pwnage.
But wouldn't there be a trail of notifications, or something?
If malware has root access it can alter everything on the phone without you ever seeing it. Any information falsified, all detection tools subverted.
Possibly, if Google is logging everything on their servers. It should be relatively easy for them to find out who got infected.
Proper pwnage would erase the MMS as soon as the exploit was complete. The only record of receipt would be on you itemized carrier bill.
Except if the MMS went to an iPhone or other device not affected. Unless you can determine Android/iPhone from just a #, apple/blackberry/MS phones would be full of corrupted MMS messages.
Why would it be corrupted? Just because it contains a malicious payload doesn't mean it has to be unviewable normally. Could even just tack onto all outgoing MMS by default and never raise anybodies suspicions.
Even worse, if it's a worm, it's likely it would come from somebody you know.
Is there a way to see if one is "owned"? Could we run a command or view a menu that would list an extra binary? Could we try to exploit ourselves in some way, like visiting a special website?
We know about the vulnerability, not the payload delivered through it. There could be thousands of them with wildly varying characteristics. There could be none.

Some of them could be rootkits, and have patched filesystem and process explorers to hide themselves. Some could be called virus.exe.

But no, you will never know that you haven't been compromised. In the coming weeks, we may learn about some of the specific malware that spreads this way, and you may be able to test your phone for it, but finding nothing does not mean you haven't been owned by something more exotic.

> none there's at lest one. see: team hacking android source code leak

very convenient timing for all that.

I don't see where superuser2 said what you attributed to them.

Did they edit their comment between the time you quoted it and the time I posted this comment? Or did HN's quirky rules regarding newlines (gotta put two if you want to display one) change the meaning of your comment?

I think gcb0 meant to quote "none" and then reply on the next line, but commentary ended up on the same line as the quote.
I also suspect this, but was asking a primary source for the Official Dirt. :)
I occasionally get picture or video messages from iPhones on my Android phone which just crash the default Messaging app. When this happens, it's not possible to even delete them as the app crashes immediately upon displaying that message. The only recovery I've found is to delete ALL messages. Interestingly this has never occurred when using Hangouts as the messaging app, but the fact that a presumably legit (these were received from known senders) MMS message could crash the app indicates that there are flaws in the programming.
Independent of the question if "everyone" is owned is the interesting (and scary) possibility that specific people have been (or will be) targeted.
There would be a lot of side-effects being noticed if it were being exploited as widely as you suggest. For example, carriers would notice lots of unusual activity; MMS step-change at a minimum.
Why infected? Is there any indication that the exploit can give root access and be used to install things?