A deep dive into iOS Exploit chains found in the wild • Hacker News Board

Re: A deep dive into iOS Exploit chains found in the wild

#121

Post by saagarjha » Fri, Aug 30, 2019, 3:00 PM UTC

bscphil wrote: post #43

ikeboy wrote: post #18

Earlier quoted context omitted.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction. What's more, every time you download a banking app on your phone, you have to place a little bi…

> What's more, every time you download a banking app on your phone, you have to place a little bit of trust in the competence of whoever the bank outsourced the programming job to. At least with a laptop, a poorly designed website site is not (by itself) a threat to everything on your computer or other sites you visit.

Both would require a 0-day exploit to be a threat.

Re: A deep dive into iOS Exploit chains found in the wild

#122

Post by saagarjha » Fri, Aug 30, 2019, 3:03 PM UTC

sqldba wrote: post #100

I wonder what happens when Apple distribute the update and it detects this is on your phone. Do they even notify you?

The update would restart your device and wipe the malware.

Re: A deep dive into iOS Exploit chains found in the wild

#123

Post by saagarjha » Fri, Aug 30, 2019, 3:05 PM UTC

londons_explore wrote: post #69

Do you think theres a bank of iPhones at Google loading every webpage on the internet, and looking for unexpected background processes or network traffic?

I think it’s more likely that Google researchers were sent these exploits or stumbled upon them through manual research.

Re: A deep dive into iOS Exploit chains found in the wild

#124

Post by shadowtree » Fri, Aug 30, 2019, 3:05 PM UTC

toxik wrote: post #61

DavideNL wrote: post #57

Earlier quoted context omitted.

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

Absolutely. It is such a disgrace to open society that we have allowed our phones, computers and cars to be so taken over by corporate interest that we cannot even peek inside. NB I heard some infosec research companies actually get rooted phones from Apple with some big caveats.

That's why Android is far safer. No exploits there.

Re: A deep dive into iOS Exploit chains found in the wild

#125

Post by saagarjha » Fri, Aug 30, 2019, 3:12 PM UTC

ryacko wrote: post #52

Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

You don’t need PAC if you disable scripts in Safari. Besides, baseband/browser/iMessage vulnerabilities are in the same price range. [i] It also isn’t difficult to infer what a “code signing bypass” is, so I guess being arrested is a good excuse to buy a new phone? (Assuming we’re talking about a state based actor, in control of the territory you live in) i. https://zerodium.com/program.html

> You don’t need PAC if you disable scripts in Safari.

Safari has multiple JITs. For example, aside from the JavaScriptCore compiler, there’s also a CSS selector JIT.

Re: A deep dive into iOS Exploit chains found in the wild

#126

Post by tinus_hn » Fri, Aug 30, 2019, 3:16 PM UTC

DavideNL wrote: post #57

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

No, it has nothing to do with that. The only difference is that you can’t buy snake-oil virus scanners in the iOS App Store because they can’t even pretend to work.

Re: A deep dive into iOS Exploit chains found in the wild

#127

Post by plttn » Fri, Aug 30, 2019, 3:18 PM UTC

krn wrote: post #47

As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and how could they be fixed?

The compatibility definition document for Android gets it pretty secure, but realistically the only secure Android devices are Pixels in my opinion.

Re: A deep dive into iOS Exploit chains found in the wild

#128

Post by cryptozeus » Fri, Aug 30, 2019, 3:24 PM UTC

Ever worst part is this

“they really do POST everything via HTTP (not HTTPS) and there is no asymmetric (or even symmetric) encryption applied to the data which is uploaded. Everything is in the clear. If you're connected to an unencrypted WiFi network this information is being broadcast to everyone around you, to your network operator and any intermediate network hops to the command and control server.”

So not only your photos, contacts, msgs are stollen but then they are sent to attacker on http so the data is logged probably on every router, modem and wifi sniffers.

Re: A deep dive into iOS Exploit chains found in the wild

#129

Post by vadansky » Fri, Aug 30, 2019, 3:26 PM UTC

So as an iPhone user, is it time to go into my password manager and generate new passwords for all my logins?

Re: A deep dive into iOS Exploit chains found in the wild

#130

Post by cryptozeus » Fri, Aug 30, 2019, 3:26 PM UTC

What does this mean ? Should I reset all my passwords just incase ?

“Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.”