Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Wi-Fi Stack on Apple Devices

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: Exploiting the Wi-Fi Stack on Apple Devices

#41

Post by js2 »

williamscales wrote: post #30
hdra wrote: post #24

Earlier quoted context omitted.

I want to see the problem solved, but this feels like the wrong solution. Reminds me of the time where I couldn't trust what the UI says about the audio of my desktop computer running Linux circa 2005

Many apps will prompt before doing a large download over data. Spotify has separate settings for mobile data and Wi-Fi streaming quality. One could imagine a video app would prompt before streaming on mobile data. I'm pretty sure this is the solution—perhaps the Android or iPhone media framework itself could implement something that would warn people if app developers are often forgetting to add this feature?

You can disallow cellular data on a per-app basis on iOS, so you could for example disable it for just Netflix.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#42

Post by tr1ck5t3r »

xtacy wrote: post #6
js2 wrote: post #3

I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way. Just writing the blog post and generating all the images for it must've taken many days.

From the project-zero bug ( https://bugs.chromium.org/p/project-zero/issues/detail?id=13... ), it looks like the first discussion on the issue dates back to July 3, with a working exploit posted just yesterday.

Lets wait and see if a PC version of this exploit shows up considering the extensive use of PCIe on desktops.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#43

Post by mschuster91 »

planb wrote: post #39
Steko wrote: post #37

Earlier quoted context omitted.

The correct solution is "always turn on wi-fi when I get home". The phone knows when this happens, you can set reminders around it.

No, it does not if the Wifi Chipset is disabled, because it uses wifi for location services (GPS would use way too much battery). That's exactly the problem: The wifi chipset is used for much more than just connecting to the internet.

You can also use the GSM Cell ID for this purpose. Once the user marks his/her home, grab the IDs of the surrounding cell towers and use these as trigger.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#44

Post by mercer »

mikeash wrote: post #16
walterbell wrote: post #14

Why did Apple make it harder to turn off the WiFi radio in iOS11?

Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?

Isn't another reason that some of iOS features (hand-off? airdrop?) rely on WiFi or Bluetooth?

Re: Exploiting the Wi-Fi Stack on Apple Devices

#45

Post by veeti »

forapurpose wrote: post #31

What is the story with Project Zero? What is the strategy here? If you think about it, pointing out flaws in competitors' products is actually unusual for businesses, especially large ones. It raises questions of motives, of trust (are they drumming up business in a negative way? Can I trust what company X says about their chief rival? Are they exaggerating or spinning it?), and it looks unsavory: You don't win in th…

Project Zero doesn't discriminate:

https://googleprojectzero.blogspot.fi/2017/07/trust-issues-e...

https://googleprojectzero.blogspot.fi/2015/09/stagefrightene...

https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

Re: Exploiting the Wi-Fi Stack on Apple Devices

#46

Post by giovannibajo1 »

walterbell wrote: post #14

Why did Apple make it harder to turn off the WiFi radio in iOS11?

I think it’s safe to assume that most people turn off wifi when there is a wifi network that sucks and they want to switch to cellular. This is by far the most common reason, and it’s also what they think they accomplished.

What they instead achieved up to iOS 10 was:

* worse location data in maps * airdrop does not work * AirPlay might not work (doesn’t work across networks) * Handoff doesn’t work * phone call and sms forwarding doesn’t work * applications don’t auto update in background anymore * system updates are not downloaded in background anymore * might waste their data plan

I think it’s impossible to have people know and be aware of all these side effects. It’s much better to change the UI: have the common button do what people think of and know it does: get off a network. And have the more comprehensive shut down button a couple of taps deeper in settings.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#47

Post by pgeorgi »

planb wrote: post #39
Steko wrote: post #37

Earlier quoted context omitted.

The correct solution is "always turn on wi-fi when I get home". The phone knows when this happens, you can set reminders around it.

No, it does not if the Wifi Chipset is disabled, because it uses wifi for location services (GPS would use way too much battery). That's exactly the problem: The wifi chipset is used for much more than just connecting to the internet.

It's exactly what my phone does (Nexus 5X with Android 8), likely by listening to wifi passively ("which SSIDs are around?")

Re: Exploiting the Wi-Fi Stack on Apple Devices

#48

Post by Moter8 »

mankash666 wrote: post #4

Wonder if something like this was used to get into the San Bernardino shooter's phone by the FBI

Cellebrite got into that phone. A presenter from the firm told us so. Apparently 300 devs work fulltime on mobile devices in Isreal to develop iOS/Android exploits, mostly for Law Enforcement or despots.

He talked quite a bit about what you can get off the devices, but not much on the how to get into there. Apparently Android-encrypted phones are the safest though. They didn't have an exploit for them 2 months ago.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#49

Post by pgeorgi »

forapurpose wrote: post #31

What is the story with Project Zero? What is the strategy here? If you think about it, pointing out flaws in competitors' products is actually unusual for businesses, especially large ones. It raises questions of motives, of trust (are they drumming up business in a negative way? Can I trust what company X says about their chief rival? Are they exaggerating or spinning it?), and it looks unsavory: You don't win in th…

> It raises questions of motives

I don't think Project Zero ever analyzed something that isn't used at Google (for example with the Apple stuff: somebody at Google has to build the Google iOS apps). Wanting to know what's going on on the corporate network is the job of a corporation's IT security unit.

The publications serve to force vendors to fix their mess. Microsoft already complained that the 90 days limit by Project Zero is unfair (and got a 14 days-to-next-patchday extension). And there are other experiences from researchers adhering to "responsible disclosure" schemes where the vendor only became active once publication was a real threat.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#50

Post by KozmoNau7 »

giovannibajo1 wrote: post #46
walterbell wrote: post #14

Why did Apple make it harder to turn off the WiFi radio in iOS11?

I think it’s safe to assume that most people turn off wifi when there is a wifi network that sucks and they want to switch to cellular. This is by far the most common reason, and it’s also what they think they accomplished. What they instead achieved up to iOS 10 was: * worse location data in maps * airdrop does not work * AirPlay might not work (doesn’t work across networks) * Handoff doesn’t work * phone call and s…

No, what pressing the wifi icon button on every single wifi-capable phone ever made until iOS 11 is to turn off wifi. Not just temporarily, but specifically until the user decides to turn it on again.

This is how it was even before smartphones. Android keeps wifi location scanning and various other things running, even if you turn off wifi, so it actually accomplishes what people want: to turn off wifi networking until they turn it on again.

The change made in iOS 11 is a clear regression.

Post reply on HN