Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to unc0ver a 0-day in 4 hours or less

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

81–90 of 120 posts

Re: How to unc0ver a 0-day in 4 hours or less

#81

Post by jodrellblank »

httpsterio wrote: post #75
p1necone wrote: post #65

Earlier quoted context omitted.

You need to do a bit more research because of the sheer number of options, but there's absolutely manufacturers that have none of those issues (battery exploding was one samsung model, I haven't heard of boot loop issues. Poor security update lifetime is absolutely a common issue though, although fixable by rooting as pointed out in another comment). See: Android One^. ^ https://en.wikipedia.org/wiki/Android_One

Also iPhone lifetime is a bit of a joke. I mean, Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models. I haven't gotten as much mileage on my Android phones as compared to my 4S, but the 4S cost about 3 times as much as the android phones I usually buy and 3 lower end-ish Android phones serves me easily for 10 years with no issues.

> "Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models."

"Apple denied wrongdoing and settled the nationwide case to avoid the burdens and costs of litigation, court papers show." - https://www.reuters.com/article/us-apple-iphones-settlement-...

They haven't been "caught" doing that; they have been accused of that. Why is it the stupid conspiracy theory which wins the popularity contest, instead of the much more annoying true story - Apple cheaped out on batteries which couldn't provide enough current to run the phone as they aged? Or, just as factual, Apple slowed down the phone to keep it working longer on the same hardware thus making people avoid having to buy new phones.

Re: How to unc0ver a 0-day in 4 hours or less

#82

Post by Jaxkr »

akersten wrote: post #44

> So, to summarize: the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue. And this security regression could have been found trivially by running the ori…

What’s wrong with Apple? Why is modern iOS so buggy?

Re: How to unc0ver a 0-day in 4 hours or less

#83

Post by tptacek »

realusername wrote: post #77
lilyball wrote: post #68

Earlier quoted context omitted.

The existence of jailbreaking fundamentally breaks the security of the device. It means any malicious app that manages to get on your device can turn into a full system compromise. It means any RCE can as well.

It always depends on which side of "security" we're talking about. You could argue that not having access to security tweaks & not being able to see what's going on because the OS is so locked down is a security issue in itself which can be solved by jailbreaking. Currently, sharing security issues with Apple is a guaranteed that the tooling you are using to get access to your device won't work anymore, there's defin…

That's right, which is why we called it "jailbreaking" in the 1990s when someone got mad at you on IRC and jailbroke your machine and stole your mail spool. I mean, jailbroke your mail spool.

I take your point, which is that jailbreaking is good if what you want is to run random unapproved code on your machine. But you didn't seriously engage with the comment you rebutted, because it is also true that jailbreak prevention prevents persistent kernel compromise --- is in fact a predicate for preventing persistent kernel compromise --- which is a thing that really does happen; in fact, it's far more relevant to the overwhelming majority of Apple users than running unapproved code is.

Re: How to unc0ver a 0-day in 4 hours or less

#84

Post by cookiengineer »

BEEdwards wrote: post #59
aSockPuppeteer wrote: post #17

Earlier quoted context omitted.

It’s always a snake eating it’s tail scenario with jailbreaking. Apple takes popular tweaks and integrates them with the next IOS. Side-loading isn’t that bad but the method keeps changing...Usually for the better. Jail breaking cuts into their profit a small amount because the community is small. https://www.reddit.com/r/jailbreak The benefits are very much worth it though. Most have had iOS 13 features since iOS 11…

Or you could just buy an android and not worry about it. Not even to fan boy, but half of those are things that android did from the go and the rest have been added or are generally easy to do.

> buy an android

> not worry about it.

I’m sorry, but this feels like a lie. I’m not trying to troll here, but most Android IT-level users I know flashed a custom ROM already and actually buy their devices based on whether or not LineageOS has support for it.

Almost all Android devices are non-Google devices, which makes their OEM state bloated with custom sync crap nobody even wants to use but have no choice.

Xiaomi, Motorola, Lenovo, Huawei, HTC ... all force their own shitty half-working synchronization platforms up their users’ phones. And I bet that this happens with major GDPR violations.

As an Android “user” I do not recommend using Android for people that do not want to “worry about it”. And product wise I think that’s a huge quality issue.

Re: How to unc0ver a 0-day in 4 hours or less

#85

Post by cookiengineer »

strombofulous wrote: post #64
megablast wrote: post #63

Earlier quoted context omitted.

And worry about something else, like it exploding, or not getting security updates after the first year, or boot loop, etc.

> Like it exploding That was an issue with one phone, once, and it was a problem with the battery, not Android > Not getting security updates after the first year That's actually solved by rooting since you can update from any source instead of just signed packages > Boot loop I guess that could be a problem but I've never had that issue and I've rooted all but one phone that I've had

Your definition of “solved” is pretty identical to OpenBSD user recommending to “just patch your BIOS”. Demographically this is not a solution, as 99.9999% of the potential audience will never be able to even understand the requirements of that skillset.

Re: How to unc0ver a 0-day in 4 hours or less

#86

Post by realusername »

tptacek wrote: post #83
realusername wrote: post #77

Earlier quoted context omitted.

It always depends on which side of "security" we're talking about. You could argue that not having access to security tweaks & not being able to see what's going on because the OS is so locked down is a security issue in itself which can be solved by jailbreaking. Currently, sharing security issues with Apple is a guaranteed that the tooling you are using to get access to your device won't work anymore, there's defin…

That's right, which is why we called it "jailbreaking" in the 1990s when someone got mad at you on IRC and jailbroke your machine and stole your mail spool. I mean, jailbroke your mail spool. I take your point, which is that jailbreaking is good if what you want is to run random unapproved code on your machine. But you didn't seriously engage with the comment you rebutted, because it is also true that jailbreak preve…

I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine.

To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter control on apps you also need to be jailbroken. I mean, you get the point. Any action you could do regarding security requires you to be jailbroken first.

Re: How to unc0ver a 0-day in 4 hours or less

#87

Post by tptacek »

realusername wrote: post #86
tptacek wrote: post #83

Earlier quoted context omitted.

That's right, which is why we called it "jailbreaking" in the 1990s when someone got mad at you on IRC and jailbroke your machine and stole your mail spool. I mean, jailbroke your mail spool. I take your point, which is that jailbreaking is good if what you want is to run random unapproved code on your machine. But you didn't seriously engage with the comment you rebutted, because it is also true that jailbreak preve…

I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine. To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter contr…

We're discussing this on a story about an untethered jailbreak --- a kernel RCE.

Re: How to unc0ver a 0-day in 4 hours or less

#88

Post by [deleted] »

ehsankia wrote: post #43
staycoolboy wrote: post #31

FTA: "...the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue..." Ooof. Talk about running in circles. Either this was someone who is swamped with work a…

Reguardless of how bad the original fix was, this is why testing is important. The original person should've added tests to make sure that specific issue doesn't come up again, and it would've caught the regression. > Thus, this is another case of a reintroduced bug that could have been identified by simple regression tests.

[deleted]

Re: How to unc0ver a 0-day in 4 hours or less

#90

Post by realusername »

tptacek wrote: post #87
realusername wrote: post #86

Earlier quoted context omitted.

I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine. To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter contr…

We're discussing this on a story about an untethered jailbreak --- a kernel RCE.

Yes that's true indeed, I was talking in general. Maybe having a more opened device would help getting security fixes faster? One of the main reason this exploit was heavily obfuscated was to avoid Apple to patch it.
Post reply on HN