How to unc0ver a 0-day in 4 hours or less
googleprojectzero.blogspot.com
How to unc0ver a 0-day in 4 hours or less
1–10 of 120 posts
Re: How to unc0ver a 0-day in 4 hours or less
#2Since this always comes up, here's an overview I made several weeks ago about where Project Zero focuses their efforts:
All counts are rough numbers. Project zero posts:
Google: 24
Apple: 28
Microsoft: 36
I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed:
product=Android returns 81 results
product=iOS returns 58
vendor=Apple returns 380
vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately)
vendor=Linux return 54
To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.
Re: How to unc0ver a 0-day in 4 hours or less
#3> By 1 AM, I had sent Apple a POC and my analysis.
> Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public.
Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue? Apple's probably not going to let an app exploiting this zeroday into its App Store and sideloading is difficult; it's very unlikely someone malicious is going to trick people into installing malware that uses this exploit. It sounds to me like Apple is purposefully limiting consumer freedom by actively trying to prevent jailbreaking.
Re: How to unc0ver a 0-day in 4 hours or less
#4TL;DR: reverse engineer a jailbreak exploit.
> By 7 PM, I had identified the vulnerability and informed Apple
I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.
Re: How to unc0ver a 0-day in 4 hours or less
#5> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…
I 100% agree but then again, people choose to buy those products so..
Re: How to unc0ver a 0-day in 4 hours or less
#6TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.
To me, seems like informant territory.
Re: How to unc0ver a 0-day in 4 hours or less
#7TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.
But they didn't report it did they? Playing devil's advocate a bit here, but they could have reported it for a bug bounty but they instead chose to use it to create a jailbreak.
Re: How to unc0ver a 0-day in 4 hours or less
#8> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…
There are lots of ways apps can run arbitrary code, so stopping them via the app store is not feasible. Myself I'm happy my phone is safer.
Re: How to unc0ver a 0-day in 4 hours or less
#9TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.
All this has taught me is that if I find an exploit to unlock I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.
Re: How to unc0ver a 0-day in 4 hours or less
#10TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.
> If anything, the exploit writer should get the credit.
They did: https://support.apple.com/en-us/HT211214