Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

221–230 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#221

Post by fragmede »

derac wrote: post #152
Mtinie wrote: post #87

Earlier quoted context omitted.

In which case—if it’s a legitimate deficiency—that doesn’t bode well at all for any other commercial enterprise. This arms race is always tilted in favor of the attacker.

There are much smaller companies which handle security disclosures much better.

but there are many many many more that don't, which impeaches the few that don't. The fact that I can reach the CEO of my local small business on the phone is a great when they're sympathetic to my plight. it's actually to the company's detriment when it turns out they're a raging asshole.

Re: Disclosure of three 0-day iOS vulnerabilities

#223

Post by idoubtit »

Thorrez wrote: post #70

Props to the author. One small critique though: > I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7 It would have been clearer if in each of the 4 vulnerabilities the timeline was given. The article only gives a timeline for the last vuln (the fixed one).

The second sentence of the article gives a sufficient timeline.

> I've reported four 0-day vulnerabilities this year between March 10 and May 4

So the vulnerabilities were reported at least 140 days ago. He also mentions 3 upgrades of iOS were published after his reports.

Re: Disclosure of three 0-day iOS vulnerabilities

#224

Post by chewyfruitloop »

breakingcups wrote: post #164
chewyfruitloop wrote: post #161

0-day ... what they mean is .... I found an issue. Its hardly a 0-day, they've not posted any evidence of it actually being used in the wild, just that "it can be used". Why is a normal "ooh look a bug or two" all of a sudden hair on fire world is burning news.... oh yeh ... I get more attention this way by exaggerating Apple may have a terrible bug bounty and response process ... but call a spade a spade ... I saw a…

What is your definition of 0-day? Because they are exactly right, this is a 0-day. Whether it's already actively being exploited or not has no bearing on the definition. I'll refer you to https://en.wikipedia.org/wiki/Zero-day_(computing) to make up your own mind.

normally I'd define it as something found in the wild being exploited already ... not a bug thats been found, reported and "ignored"

this seems to be a zero day just because Apple haven't seen fit to respond the the reporter

Re: Disclosure of three 0-day iOS vulnerabilities

#225

Post by fragmede »

numpad0 wrote: post #126
emsy wrote: post #77

Earlier quoted context omitted.

The problem is not that cyber-security is hard, but that a trillion dollar company is incapable to handle security disclosures.

I remember some of early Android phones that ran manufacturer maintained Kernel turning out immune to then-undisclosed RCEs years before disclosure. I think it’s less about disclosure handling but more about being motivated to pay for or build a black magic code analysis tools.

got any links? that sounds like a fascinating story to read!

Re: Disclosure of three 0-day iOS vulnerabilities

#226

Post by maccard »

thatswrong0 wrote: post #63
cmeacham98 wrote: post #47

Earlier quoted context omitted.

GDPR cookie consent banners that make it more difficult to opt out than opt in are illegal, and only continue to exist because the GDPR is poorly and inconsistently enforced.

Most of the cookie consent banners I see are illegal in that case..

And how many have you reported to your local data commissioner?

Re: Disclosure of three 0-day iOS vulnerabilities

#227

Post by evercast »

WA wrote: post #208

I'm wondering how the health-data incident works with respect to the GDPR. Apple says it stores Health data in a protected way on the device. In reality, health data is leaked through logs and can be accessed by any other app. It is impossible to tell whether or not this data has been accessed in the wild. Since Apple failed to implement their claimed security features properly and you need to assume exploitation by…

According to my understanding of GDPR, the data would need to contain personal information i.e. something that allows you to link it to an identifiable person. Quick search on google gives the following definition of personal data [1]:

"Personal data are any information which are related to an identified or identifiable natural person."

So if there is no personal data in the logs, it should not be a GDPR breach.

[1] https://gdpr-info.eu/issues/personal-data/

Re: Disclosure of three 0-day iOS vulnerabilities

#228

Post by funcDropShadow »

rixed wrote: post #209
concinds wrote: post #131

Earlier quoted context omitted.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…

> my grandma doesn’t have WiFi Tech workers have difficulty taking into consideration lifestyles they don't know exist, which is understandable. At the end of the day this comes as another consequence of the lack of diversity in tech, I guess.

So, is this the lack of grandmas working at Apple in software development? This is nothing you can fix by following some diversity ideology. This is a question of respecting different requirements from different user groups. You cannot mirror every user group in the development teams. How do you represent people of old age, with illnesses, or certain disabilities in a development team? How do you represent people living at certain locations in the world in a development team? How do you represent poor people or people of low education? Or how do you represent people which live under oppressive regimes or are the continued victims of criminals?

All these groups have different needs and expectations to the products they buy or lease. And development teams and their business cannot expect to understand that by having a more diverse development team. They have to do better requirements engineering, they have to listen better to their customers and they have to decide and prioritize those needs and expectations. E.g. A/B testing has abysmal consequences for the needs and expectations of minorities.

Re: Disclosure of three 0-day iOS vulnerabilities

#229

Post by OJFord »

vincnetas wrote: post #119
jcims wrote: post #98

Earlier quoted context omitted.

I’ve worked on the bug bounty program for a large company. We did the whole thing. It’s hard. The part you’re talking about can be the hardest. Is probably less than believable to read because it sounds like it should be easy. I don’t have any good answers there. I’m also not suggesting that customers and researchers accept that, but saying it’s easy just diminishes the efforts of those that run good ones.

could you try litle bit harder to provide any example why it is "harder than it looks". you repeated multiple times that its hard, but what exactly(aproximately) makes it hard?

I think it's the phrases 'some coordination' and 'company the size of Apple'. It's rarely the case (well, hopefully?!) that a fix is as trivial as 'oh yeah, oops, let's delete that `leak_data()` line' - it's going to involve multiple teams and they're all going to think anything from 'nothing to do with us' to 'hm yes I can see how that happened, but what we're doing in our piece of the pie is correct/needs to be so, this will need to be handled by the [other] team'.

Not to say that people 'pass the buck' or are not taking responsibility exactly, just that teams can be insular, and they're all going to view it from the perspective of their side of the 'API', and not find a problem. (Of course with a strict actual API that couldn't be the case, but I use it here only loosely or analogously.) Someone has to coordinate them all, and ultimately probably work out (or decide somewhat arbitrarily - at least in technical terms, but perhaps on the basis of cost or complexity or politics or cetera) whose problem to make it.

Re: Disclosure of three 0-day iOS vulnerabilities

#230

Post by evercast »

speedgoose wrote: post #107

Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way? I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?

I have some doubt with respect to whether what author claims is "medical data" is indeed medical. Practically speaking, the data he mentions seems like the things collected by Apple Watch and stored in the Health app. There is indeed heart rate tracking, but can we really label this data as medical? IMHO "medical" would relate more to professional diagnosis, treatment etc. which according to Apple is stored in an encrypted form [1]. Garmin devices also collect heart rate, sleep stats etc. and I have never thought of these as medical (health-related yes, but not medical). The line is thin though.

Since you work in the industry, perhaps you could share your opinion how such data should be treated?

[1] https://www.apple.com/healthcare/health-records/

Post reply on HN