Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to unc0ver a 0-day in 4 hours or less

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

71–80 of 120 posts

Re: How to unc0ver a 0-day in 4 hours or less

#71

Post by ueouieodue »

stefan_ wrote: post #57
ehsankia wrote: post #42

Earlier quoted context omitted.

The second paragraph of the article covers this: > I wanted to find the vulnerability used in unc0ver and report it to Apple quickly in order to demonstrate that obfuscating an exploit does little to prevent the bug from winding up in the hands of bad actors.

Maybe this should read "that obfuscating an exploit does little to prevent the bug from winding up in the hands of a talented full time security researcher ". Of course if he was this talented, surely he would routinely diff new kernel versions and realize the old bug had been reintroduced before having to rediscover it in a jailbreak?

I'd make sure I had a solid foundational basis before calling anyone on the PZ team untalented ;)

He abused the jailbreak to cause a crash. A talented researcher would try that before diffing kernel binaries.

Re: How to unc0ver a 0-day in 4 hours or less

#72

Post by muppetman »

strombofulous wrote: post #64
megablast wrote: post #63

Earlier quoted context omitted.

And worry about something else, like it exploding, or not getting security updates after the first year, or boot loop, etc.

> Like it exploding That was an issue with one phone, once, and it was a problem with the battery, not Android > Not getting security updates after the first year That's actually solved by rooting since you can update from any source instead of just signed packages > Boot loop I guess that could be a problem but I've never had that issue and I've rooted all but one phone that I've had

That's NOT solved by rooting - I wish people would stop saying this.

There's two parts to Android patching - the kernel/Android OS itself - yes, this gets patched with a rooted/custom ROM.

Part two is the hardware drivers themselves, the modem driver etc etc. None of that is patched with a custom ROM. You still have to use the same binary blob/drivers that came with the latest official phone firmware.

When security updates stop for you phone, all the updates for the underlying hardware drivers stop too. So yea, you can slap some bandaids on it, but you're not really up to date even though you might be on a later/more recent version of Android.

Re: How to unc0ver a 0-day in 4 hours or less

#73

Post by muppetman »

ueouieodue wrote: post #70
strombofulous wrote: post #64

Earlier quoted context omitted.

> Like it exploding That was an issue with one phone, once, and it was a problem with the battery, not Android > Not getting security updates after the first year That's actually solved by rooting since you can update from any source instead of just signed packages > Boot loop I guess that could be a problem but I've never had that issue and I've rooted all but one phone that I've had

> That was an issue with one phone, once, and it was a problem with the battery, not Android If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own. > That's actually solved by rooting since you can update from any source instead of just signed packages Installing software downloaded from xda-developers is, what I lik…

Can you link me to a custom ROM on XDA that was shown to have Malware?

Re: How to unc0ver a 0-day in 4 hours or less

#74

Post by httpsterio »

ueouieodue wrote: post #70
strombofulous wrote: post #64

Earlier quoted context omitted.

> Like it exploding That was an issue with one phone, once, and it was a problem with the battery, not Android > Not getting security updates after the first year That's actually solved by rooting since you can update from any source instead of just signed packages > Boot loop I guess that could be a problem but I've never had that issue and I've rooted all but one phone that I've had

> That was an issue with one phone, once, and it was a problem with the battery, not Android If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own. > That's actually solved by rooting since you can update from any source instead of just signed packages Installing software downloaded from xda-developers is, what I lik…

That's like saying that all Apple products suck because they bend, antenna doesn't work, keys stop working and screens start to stain.

Like the person said, it was literally one Samsung model that had issues and it could've just as well have been an iOS device. Looking at how many recalls and repair programs they have for design flaws, I don't think anyone should paint Apple as the better side here.

Re: How to unc0ver a 0-day in 4 hours or less

#75

Post by httpsterio »

p1necone wrote: post #65
megablast wrote: post #63

Earlier quoted context omitted.

And worry about something else, like it exploding, or not getting security updates after the first year, or boot loop, etc.

You need to do a bit more research because of the sheer number of options, but there's absolutely manufacturers that have none of those issues (battery exploding was one samsung model, I haven't heard of boot loop issues. Poor security update lifetime is absolutely a common issue though, although fixable by rooting as pointed out in another comment). See: Android One^. ^ https://en.wikipedia.org/wiki/Android_One

Also iPhone lifetime is a bit of a joke. I mean, Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models.

I haven't gotten as much mileage on my Android phones as compared to my 4S, but the 4S cost about 3 times as much as the android phones I usually buy and 3 lower end-ish Android phones serves me easily for 10 years with no issues.

Re: How to unc0ver a 0-day in 4 hours or less

#76

Post by Wingman4l7 »

zaptrem wrote: post #62
BEEdwards wrote: post #59

Earlier quoted context omitted.

Or you could just buy an android and not worry about it. Not even to fan boy, but half of those are things that android did from the go and the rest have been added or are generally easy to do.

But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, and (for the most part) rock solid and extremely efficient OS.

You better hope they don't ever bring their premium-priced laptop "hardware quality" to their phones -- failing GPUs, failing monitor ribbon cables, failing keyboards...

Re: How to unc0ver a 0-day in 4 hours or less

#77

Post by realusername »

lilyball wrote: post #68
devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

The existence of jailbreaking fundamentally breaks the security of the device. It means any malicious app that manages to get on your device can turn into a full system compromise. It means any RCE can as well.

It always depends on which side of "security" we're talking about. You could argue that not having access to security tweaks & not being able to see what's going on because the OS is so locked down is a security issue in itself which can be solved by jailbreaking.

Currently, sharing security issues with Apple is a guaranteed that the tooling you are using to get access to your device won't work anymore, there's definitely an bad incentive to not report security flaws at the moment.

Re: How to unc0ver a 0-day in 4 hours or less

#78

Post by macintux »

httpsterio wrote: post #75
p1necone wrote: post #65

Earlier quoted context omitted.

You need to do a bit more research because of the sheer number of options, but there's absolutely manufacturers that have none of those issues (battery exploding was one samsung model, I haven't heard of boot loop issues. Poor security update lifetime is absolutely a common issue though, although fixable by rooting as pointed out in another comment). See: Android One^. ^ https://en.wikipedia.org/wiki/Android_One

Also iPhone lifetime is a bit of a joke. I mean, Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models. I haven't gotten as much mileage on my Android phones as compared to my 4S, but the 4S cost about 3 times as much as the android phones I usually buy and 3 lower end-ish Android phones serves me easily for 10 years with no issues.

> 3 lower end-ish Android phones serves me easily for 10 years with no issues

Are there any lower-end phones that get security updates for 3 years?

Re: How to unc0ver a 0-day in 4 hours or less

#79

Post by fomine3 »

djrogers wrote: post #29
saagarjha wrote: post #24

Earlier quoted context omitted.

Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…

If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.

Bootloader unlock is the way that works on Android. It forces user to erase data when unlock it and unlocked status is shown in boot screen.

Re: How to unc0ver a 0-day in 4 hours or less

#80

Post by xuki »

curiousgal wrote: post #4

TL;DR: reverse engineer a jailbreak exploit. > By 7 PM, I had identified the vulnerability and informed Apple I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

The exploit was public, but obfuscated to make it harder for bad actors to make use of. Apple likely didn't need help to identify the vulnerability, but I'm sure they welcomed it.
Post reply on HN