161–170 of 464 posts
Apple may have a terrible bug bounty and response process ... but call a spade a spade
... I saw a bird this morning ... help theres dinosaurs on the loose!!!!
Isn't this why most researchers just sell their 0days to Zerodium or drop it publicly? I've heard of multiple companies doing this type of BS. There was a person called Polarbear/sandboxescaper who dropped a few Win10 LPE's on GitHub. They claimed that Zerodium also only pays out a small amount then resells the exploit.
Yes, that person did drop 0days publicly and then promptly faced an FBI investigation causing a tremendous level of stress and irreparable mental health damage.
0-day ... what they mean is .... I found an issue. Its hardly a 0-day, they've not posted any evidence of it actually being used in the wild, just that "it can be used". Why is a normal "ooh look a bug or two" all of a sudden hair on fire world is burning news.... oh yeh ... I get more attention this way by exaggerating Apple may have a terrible bug bounty and response process ... but call a spade a spade ... I saw a…
I'll refer you to https://en.wikipedia.org/wiki/Zero-day_(computing) to make up your own mind.
Earlier quoted context omitted.
Don’t update your apps till after Apple releases a patch. The first two are API calls that apps can make. An exploit wishing to exploit these vulnerabilities has to be coded to make these calls. Most apps don’t dynamically construct arbitrary API calls. In fact, you can’t do that in Swift AFAIK. You have to drop to Objective-C or C to do that. So most apps need to be updated to exploit the vulnerability. The only exc…
> I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps. On a side note, this is one more reason Apple can cite for their App Store exclusivity. If there is a vulnerability in the OS exploitable by apps, and they can’t get a patch out in time, they can screen and prevent the download of such dangerous apps. Not a popular position here I know. But I’m correc…
Earlier quoted context omitted.
Bug bounty programs are the antithesis of Apple's internal methodology, culture, and way of doing business. They keep everything close to the chest, they shun "outsiders", etc.. The idea that someone outside of Apple, from the unwashed masses, could find a flaw in Apple's own software is a pretty big pill for them to swallow. Thus it doesn't surprise me there are problems with their bug bounty program. I think if the…
That makes apple (the org, not the fanboys) sound a bit cultish... Can't say I'm surprised though...
0-day ... what they mean is .... I found an issue. Its hardly a 0-day, they've not posted any evidence of it actually being used in the wild, just that "it can be used". Why is a normal "ooh look a bug or two" all of a sudden hair on fire world is burning news.... oh yeh ... I get more attention this way by exaggerating Apple may have a terrible bug bounty and response process ... but call a spade a spade ... I saw a…
Earlier quoted context omitted.
It's hardly 'perfect historical proof', not to diminish the seriousness of the vulnerability. But more importantly, the mechanism matters a great deal. This particular vulnerability requires the install of a malicious app, a much higher bar than a 'drive by' exploitation. This leaves a trace and exposes the attacker to consequences. No (statistically speaking) app producer with any interest in continuing to use the p…
> This particular vulnerability requires the install of a malicious app, a much higher bar than a 'drive by' exploitation. It's a much higher bar when it's a targeted attack but not necessarily if it's a dragnet like when a malicious party buys a browser extension from the creator to harvest user data. The only real difference between the two scenarios is iOS's significantly stricter review process and sandbox - if t…
After the disclosure of the last critical 0-day, I went to update the OS is my four iDevices. I upgraded three of them to iOS 14.8 with no trouble, but when I went to update the fourth it wouldn't let me update to 14.8 but rather only offered me the option of upgrading to 15.0. I didn't want to upgrade to 15.0, so I called Apple support and the first-line tech said, "Oh, I can definitely help you with that." I though…
> Apple used to be the company that made devices that were secure and "just worked". This is a complete myth. In fact, not only did Apple devices break all the time, but they were near-impossible for regular users to repair on their own. A simple proof: how many broken iPods did people used to have lying around?
The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.
Security is challenging, but there are lots of things we know how to do better that many software developers still aren't doing. For example, if you're still writing application-level software in an inherently dangerous programming language in 2021 and that application handles important data in a connected device, you're part of the problem. If you ship a networked hardware product with a standard password for all devices or forget to disable the backdoor access used during development, if you use encryption or hashing methods that are known to be weak, etc. These things obviously won't solve all security problems, but they are low-hanging fruit that is still being left on the tree far too often.