How to unc0ver a 0-day in 4 hours or less • Hacker News Board

Re: How to unc0ver a 0-day in 4 hours or less

#21

Post by PragmaticPulp » Thu, Jul 09, 2020, 7:21 PM UTC

Fantastic write-up. It's great to see this level of information sharing, complete with a walkthrough of the author's thought process and strategy for confirming the exploit. It's also interesting that this was a regression of a previously-fixed bug rather than a new exploit.

As a side note, it's disappointing to see so much unfounded criticism here in the comments. Apple was going to find and fix this bug quickly, regardless of the author's efforts. In this case we get a peek into the inner workings of the exploit discovery process that would otherwise remain secret. The author and Apple both clearly noted that unc0ver was the source of the exploit, and the author made no attempts to hide that fact. Calling the author of this blog post "lazy" or an "informant" is out of touch and uncalled for.

Re: How to unc0ver a 0-day in 4 hours or less

#22

Post by olliej » Thu, Jul 09, 2020, 7:28 PM UTC

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use.

Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

Re: How to unc0ver a 0-day in 4 hours or less

#23

Post by texasbigdata » Thu, Jul 09, 2020, 7:31 PM UTC

aarong11 wrote: post #7

curiousgal wrote: post #4

TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

But they didn't report it did they? Playing devil's advocate a bit here, but they could have reported it for a bug bounty but they instead chose to use it to create a jailbreak.

Maybe reworded, the value accrues to the explainer of the issue to the code writer. Therefore, this dude did something valuable. Ecosystem works. Perhaps.

Re: How to unc0ver a 0-day in 4 hours or less

#24

Post by saagarjha » Thu, Jul 09, 2020, 7:33 PM UTC

olliej wrote: post #22

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…

Re: How to unc0ver a 0-day in 4 hours or less

#25

Post by yunruse » Thu, Jul 09, 2020, 7:36 PM UTC

saagarjha wrote: post #13

kevin_nisbet wrote: post #12

Earlier quoted context omitted.

> Apple's probably not going to let an app exploiting this zeroday into its App Store... Are you sure about this? I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application?? Sorry, I could be missing something, just curious why this couldn…

I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.

It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.

Re: How to unc0ver a 0-day in 4 hours or less

#26

Post by londons_explore » Thu, Jul 09, 2020, 7:38 PM UTC

olliej wrote: post #22

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

> Look at the attacks on various human rights activists

I believe all these begin with browser or existing-app based exploits.

None of them seem to rely on tricking the user into installing a new app. That would be too suspicious for the user, and would entail the attacker uploading their exploit code to apple, and giving apple a full list of users who they exploited...

Re: How to unc0ver a 0-day in 4 hours or less

#27

Post by jchw » Thu, Jul 09, 2020, 7:40 PM UTC

Jyaif wrote: post #14

Why is he doing that work? Does Apple not fix every jailbreak exploits by themselves?

In this case, it looks like there is a point to it:

> My goal in trying to identify the bug used by unc0ver was to demonstrate that obfuscation does not block attackers from quickly weaponizing the exploited vulnerability.

Re: How to unc0ver a 0-day in 4 hours or less

#28

Post by saagarjha » Thu, Jul 09, 2020, 7:41 PM UTC

yunruse wrote: post #25

saagarjha wrote: post #13

Earlier quoted context omitted.

I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.

It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.

That is likely true, but slipping in a call to list_lio would be really easy to do. Even if they had a check for the syscall instruction in this case, you could just ROP your way to libc…

Re: How to unc0ver a 0-day in 4 hours or less

#29

Post by djrogers » Thu, Jul 09, 2020, 7:41 PM UTC

saagarjha wrote: post #24

olliej wrote: post #22

Earlier quoted context omitted.

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…

If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.

Re: How to unc0ver a 0-day in 4 hours or less

#30

Post by thierryzoller » Thu, Jul 09, 2020, 7:43 PM UTC

So proud to have reverse engineered an 0day. Ok, move on. Nothing to see.