How to unc0ver a 0-day in 4 hours or less • Hacker News Board

Re: How to unc0ver a 0-day in 4 hours or less

#11

Post by saagarjha » Thu, Jul 09, 2020, 6:58 PM UTC

umvi wrote: post #9

curiousgal wrote: post #4

TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

All this has taught me is that if I find an exploit to unlock I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.

I don't think anyone is getting a bug bounty, especially from this one.

Re: How to unc0ver a 0-day in 4 hours or less

#12

Post by kevin_nisbet » Thu, Jul 09, 2020, 7:02 PM UTC

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

> Apple's probably not going to let an app exploiting this zeroday into its App Store...

Are you sure about this?

I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application??

Sorry, I could be missing something, just curious why this couldn't occur in the app store.

Re: How to unc0ver a 0-day in 4 hours or less

#13

Post by saagarjha » Thu, Jul 09, 2020, 7:03 PM UTC

kevin_nisbet wrote: post #12

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

> Apple's probably not going to let an app exploiting this zeroday into its App Store... Are you sure about this? I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application?? Sorry, I could be missing something, just curious why this couldn…

I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.

Re: How to unc0ver a 0-day in 4 hours or less

#14

Post by Jyaif » Thu, Jul 09, 2020, 7:03 PM UTC

Why is he doing that work? Does Apple not fix every jailbreak exploits by themselves?

Re: How to unc0ver a 0-day in 4 hours or less

#15

Post by snazz » Thu, Jul 09, 2020, 7:06 PM UTC

umvi wrote: post #9

curiousgal wrote: post #4

TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

All this has taught me is that if I find an exploit to unlock I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.

Project Zero researchers don’t take bounties, to my knowledge.

Re: How to unc0ver a 0-day in 4 hours or less

#16

Post by CountHackulus » Thu, Jul 09, 2020, 7:08 PM UTC

curiousgal wrote: post #4

TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

They did, the article points out that this was caused by a regression. Fixing a memory leak made it such that it reenabled an old bug.

Re: How to unc0ver a 0-day in 4 hours or less

#17

Post by aSockPuppeteer » Thu, Jul 09, 2020, 7:09 PM UTC

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

It’s always a snake eating it’s tail scenario with jailbreaking. Apple takes popular tweaks and integrates them with the next IOS. Side-loading isn’t that bad but the method keeps changing...Usually for the better.

Jail breaking cuts into their profit a small amount because the community is small.

https://www.reddit.com/r/jailbreak

The benefits are very much worth it though. Most have had iOS 13 features since iOS 11/12. They have iOS 14 features now. Then there are other features that may not be released ever but people find them invaluable.

Ex: Per app specific Firewall per website. (Block tracking/ads)

-Disable apps ability to spy on your clipboard.

-Disable apps from accessing things you do not want them to but still launch.

-Themes, so many options: remove your status bar or put new things there.

-Custom widgets

-Detailed wifi, phone information

-Download old versions of apps because the company broke something.

-Detailed phone/memory/cpu info

-Terminal access.

Those are just a few off the top of my head.

Re: How to unc0ver a 0-day in 4 hours or less

#18

Post by saagarjha » Thu, Jul 09, 2020, 7:09 PM UTC

TL;DR background for this one: there existed a zero day bug in iOS 11 related to how the kernel processed the lio_listio call. Apple fixed it then but introduced a memory leak. In iOS 13 Apple fixed the memory leak but reintroduced the vulnerability. The regression was found and packaged in a obfuscated jailbreaking tool (unc0ver); this post explains how the tool was deobfuscated. This resulted in an "emergency" iOS 13.5.1 update to fix the issue. Interestingly this fix still does not fully fix the memory leak: https://www.synacktiv.com/posts/exploit/the-fix-for-cve-2020...

Re: How to unc0ver a 0-day in 4 hours or less

#19

Post by saagarjha » Thu, Jul 09, 2020, 7:11 PM UTC

snazz wrote: post #15

umvi wrote: post #9

Earlier quoted context omitted.

All this has taught me is that if I find an exploit to unlock I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.

Project Zero researchers don’t take bounties, to my knowledge.

Nor have they been ever offered one, to my knowledge: https://twitter.com/i41nbeer/status/1027339893335154688. I'm actually not sure Apple has ever paid a bounty for anything that wasn't a web issue…

Re: How to unc0ver a 0-day in 4 hours or less

#20

Post by saagarjha » Thu, Jul 09, 2020, 7:12 PM UTC

Jyaif wrote: post #14

Why is he doing that work? Does Apple not fix every jailbreak exploits by themselves?

Project Zero makes it their job to find things even if manufacturers don't (I'm sure they were in this case, though). In this case I would assume it was just curiosity.