Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to unc0ver a 0-day in 4 hours or less

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

111–120 of 120 posts

Re: How to unc0ver a 0-day in 4 hours or less

#111

Post by devenblake »

eertami wrote: post #104
zaptrem wrote: post #62

Earlier quoted context omitted.

But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, and (for the most part) rock solid and extremely efficient OS.

>But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, To what end, my 5 year old midrange phone still loads everything instantly (Snapdragon 801). Is there actually any benefit of 'top of the line' mobile CPUs except for mobile gamers?

I was an Android fan for years, but as a kid I'd always wanted an iPhone 4 so I got one recently. At the time there were some weird blocks on everything (I still don't really know what was happening but everything works now) so eventually I just got an iPhone SE (the good one, with the headphone jack). It blew my mind. The animations actually run at high framerates, the keyboard has very little latency, and it just works. I've never tried out a high-end Android that could hold up to my SE based on keyboard latency alone. It makes a really big difference.

Re: How to unc0ver a 0-day in 4 hours or less

#112

Post by devenblake »

Bnshsysjab wrote: post #106
muppetman wrote: post #73

Earlier quoted context omitted.

Can you link me to a custom ROM on XDA that was shown to have Malware?

This seems like a pretty weak argument, are you sure you want to trust a bunch of hobbiest devs with the security of your (probably) most valuable computer? Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.

I trust hobbiests more than I trust Google or Apple to handle my security.

Re: How to unc0ver a 0-day in 4 hours or less

#113

Post by farisjarrah »

StavrosK wrote: post #60
aSockPuppeteer wrote: post #17

Earlier quoted context omitted.

It’s always a snake eating it’s tail scenario with jailbreaking. Apple takes popular tweaks and integrates them with the next IOS. Side-loading isn’t that bad but the method keeps changing...Usually for the better. Jail breaking cuts into their profit a small amount because the community is small. https://www.reddit.com/r/jailbreak The benefits are very much worth it though. Most have had iOS 13 features since iOS 11…

This raises the question, who will come up with Apple product features when all the 0days have been patched?

With a codebase as large as iOS its highly unlikely that all 0days will ever be fully patched. Apple is constantly iterating on their code and introducing new features(and bugs) and security engineers are always coming up with new methods to exploit code.

Re: How to unc0ver a 0-day in 4 hours or less

#114

Post by Hackbraten »

akersten wrote: post #53
TwoBit wrote: post #51

Earlier quoted context omitted.

Isn't the root cause that two entities can free the given memory and have no high level coordination of it? It basically states this in the article.

That's the category of bug (use after free), but that's not the root cause. The root cause would be found from an analysis of the kernel design to understand why it was possible to get into this scenario in the first place. Uncoordinated mechanisms accessing the same data structure (like you mention) might be the root cause, but it didn't feel like this article explored it (not that they need to, since P0 is focused…

(I’m trying to recall the Lightspeed bug from memory so I may have some of it wrong.)

It all boils down to poor state management in a single algorithm.

The algorithm allocates a kernel object, then sends off a subroutine to do some work. (The subroutine happens to run in another thread but that’s not really relevant to the bug.) As part of its job duty, the subroutine is supposed to free the object after its work is done, but only if condition A is true.

If A is false, the subroutine won’t free the memory, and it’s implied that the main routine is supposed to free the memory instead.

Now the issue is that there’s no common code that checks condition A. Instead, the main routine and the subroutine have slightly different ideas about whether condition A is true or not. The condition’s logic is pretty simple so it’s understandable that the kernel developer decided to write the same condition in two different places and two different forms (instead of e. g. factoring it out into a macro). Still, they managed to get it wrong.

The result is that in one particular case, the subroutine thinks A is true. So it frees the object. When the main routine gets back control, it thinks A is false (due to the duplicated, slightly wrong logic), and frees the object, too.

There’s only a small time window between those two frees. But the window is large enough that a userspace thread, if it tries often enough, can force its own object into the place where the kernel object used to be, just in time before the double free happens.

Re: How to unc0ver a 0-day in 4 hours or less

#115

Post by Hackbraten »

farisjarrah wrote: post #113
StavrosK wrote: post #60

Earlier quoted context omitted.

This raises the question, who will come up with Apple product features when all the 0days have been patched?

With a codebase as large as iOS its highly unlikely that all 0days will ever be fully patched. Apple is constantly iterating on their code and introducing new features(and bugs) and security engineers are always coming up with new methods to exploit code.

Also, given the age of XNU, kernel developers come and go, and chances are that typical mistakes (for example, improperly using the MIG) get repeated.

Re: How to unc0ver a 0-day in 4 hours or less

#116

Post by lilyball »

lawnchair_larry wrote: post #110
tptacek wrote: post #87

Earlier quoted context omitted.

We're discussing this on a story about an untethered jailbreak --- a kernel RCE.

This is neither untethered nor RCE.

Intentionally jailbreaking your phone isn't untethered or RCE. But this particular jailbreak could be combined with an RCE in any application running on the device in order to compromise the system.

Re: How to unc0ver a 0-day in 4 hours or less

#117

Post by lawnchair_larry »

lilyball wrote: post #116
lawnchair_larry wrote: post #110

Earlier quoted context omitted.

This is neither untethered nor RCE.

Intentionally jailbreaking your phone isn't untethered or RCE. But this particular jailbreak could be combined with an RCE in any application running on the device in order to compromise the system.

No disagreement that a separate, unrelated remote RCE would indeed be a remote RCE. This is still a tethered LPE.

Re: How to unc0ver a 0-day in 4 hours or less

#118

Post by Bnshsysjab »

devenblake wrote: post #112
Bnshsysjab wrote: post #106

Earlier quoted context omitted.

This seems like a pretty weak argument, are you sure you want to trust a bunch of hobbiest devs with the security of your (probably) most valuable computer? Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.

I trust hobbiests more than I trust Google or Apple to handle my security.

That really depends on your threat model, are Apple and google going to use marketing data against you? Probably.

Are they going to plant malware which steals your banking details? Probably less likely than a random binary package you found on some forum.

Re: How to unc0ver a 0-day in 4 hours or less

#119

Post by JetSpiegel »

jodrellblank wrote: post #81
httpsterio wrote: post #75

Earlier quoted context omitted.

Also iPhone lifetime is a bit of a joke. I mean, Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models. I haven't gotten as much mileage on my Android phones as compared to my 4S, but the 4S cost about 3 times as much as the android phones I usually buy and 3 lower end-ish Android phones serves me easily for 10 years with no issues.

> " Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models. " "Apple denied wrongdoing and settled the nationwide case to avoid the burdens and costs of litigation, court papers show." - https://www.reuters.com/article/us-apple-iphones-settlement-... They haven't been "caught" doing that; they have been accused of that. Why is it the stupid conspiracy th…

> They haven't been "caught" doing that

They settled out of court. Must have though the case against them was pretty strong. If that's not an admission of guilt...

Re: How to unc0ver a 0-day in 4 hours or less

#120

Post by sfink »

doublerabbit wrote: post #107
MaxLeiter wrote: post #39

Checkra1n, another iOS exploit (although it's more impressively a bootrom exploit), is mentioned. You can see slides on it from 2019 here: https://iokit.racing/oneweirdtrick.pdf (The One Weird Trick SecureROM Hates)

Interesting, from that slide I should always null my variables after I'm finished with them.

If they're globals, then yes you should. Having dangling pointers anywhere, even in supposedly unused areas, tends to come back and bite you.

For locals, why bother? The optimizer will probably discard the writes, and worrying about stack addresses being reused is a waste of mental space and clutters the code.

Post reply on HN