Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to unc0ver a 0-day in 4 hours or less

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

41–50 of 120 posts

Re: How to unc0ver a 0-day in 4 hours or less

#41

Post by saagarjha »

pcwalton wrote: post #36
djrogers wrote: post #29

Earlier quoted context omitted.

If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.

To be more specific, the problem is that malware is a separate category from useful and harmless application code that people want to run but that Apple doesn't want to allow for a variety of reasons, but Apple forbids both types of software. (Focusing on user consent obscures the actual problem; people often consent to running malware. What matters is whether the software to be run is useful and harmless.)

> people often consent to running malware

Ah, but not in an informed way–users don't typically run software they know to be harmful/useless :P (And no, telling them that it is harmful isn't apparently enough to inform them…) But I agree with the first part.

Re: How to unc0ver a 0-day in 4 hours or less

#42

Post by ehsankia »

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

The second paragraph of the article covers this:

> I wanted to find the vulnerability used in unc0ver and report it to Apple quickly in order to demonstrate that obfuscating an exploit does little to prevent the bug from winding up in the hands of bad actors.

Re: How to unc0ver a 0-day in 4 hours or less

#43

Post by ehsankia »

staycoolboy wrote: post #31

FTA: "...the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue..." Ooof. Talk about running in circles. Either this was someone who is swamped with work a…

Reguardless of how bad the original fix was, this is why testing is important. The original person should've added tests to make sure that specific issue doesn't come up again, and it would've caught the regression.

> Thus, this is another case of a reintroduced bug that could have been identified by simple regression tests.

Re: How to unc0ver a 0-day in 4 hours or less

#44

Post by akersten »

> So, to summarize: the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue. And this security regression could have been found trivially by running the original POC from the blog post.

Yikes. Especially looking at the diff of the original problematic fix, it seems like they slapped a quick patch on there and called it a day, instead of investigating to find the underlying architectural issue. Doesn't really inspire a lot of confidence that the resolution for unc0ver is any more thought-through. I wonder if they've identified the root-cause? That'd be the real interesting piece to me.

Re: How to unc0ver a 0-day in 4 hours or less

#45

Post by londons_explore »

albntomat0 wrote: post #2

Since this always comes up, here's an overview I made several weeks ago about where Project Zero focuses their efforts: All counts are rough numbers. Project zero posts: Google: 24 Apple: 28 Microsoft: 36 I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=And…

Most experts have expertise on only one or two different OS's or bits of software.

The found issues will strongly depend who happens to be on the Google Project Zero team at the moment.

Re: How to unc0ver a 0-day in 4 hours or less

#47

Post by draw_down »

devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

Well, either you think security vulns are bad or you don’t. I think they’re bad, just kinda crazy like that I suppose.

Re: How to unc0ver a 0-day in 4 hours or less

#48

Post by Avamander »

londons_explore wrote: post #35
albntomat0 wrote: post #2

Since this always comes up, here's an overview I made several weeks ago about where Project Zero focuses their efforts: All counts are rough numbers. Project zero posts: Google: 24 Apple: 28 Microsoft: 36 I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=And…

Project Zero has uncovered 2033 issues... The majority of those could be used alone to ruin your life. The rest might require 2 (Eg. one for the sandbox, one for the kernel). Thats a team of ~10 security researchers over many years... Considering how many are being discovered each day/month/year, chances are that there are at least hundreds undiscovered... If it only takes one to ruin your life, and a good security r…

> good security researcher can find one in a few weeks

s/good/extremely good/

This doesn't change the fact that someone evil will still probably find one.

Re: How to unc0ver a 0-day in 4 hours or less

#49

Post by wolco »

yunruse wrote: post #25
saagarjha wrote: post #13

Earlier quoted context omitted.

I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.

It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.

It would probably kill snapchat and force many groups to other platforms.

Re: How to unc0ver a 0-day in 4 hours or less

#50

Post by secondraft »

staycoolboy wrote: post #31

FTA: "...the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue..." Ooof. Talk about running in circles. Either this was someone who is swamped with work a…

> Talk about running in circles.

So maybe writing and reading useful commit logs is not such a bad idea after all :)

Reminds me of this quote: "Those who don't know their history are doomed to repeat it."

Post reply on HN