I am not able to compile the first two of these (after the first two I stopped trying) with the newest Xcode on iOS 15.0. I haven't tried the other two or older tools.
The source code as given also had syntax errors in it.
Disclosure of three 0-day iOS vulnerabilities
241–250 of 464 posts
Re: Disclosure of three 0-day iOS vulnerabilities
#242Earlier quoted context omitted.
> but iOS updates can’t be done on 4G > This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma In too many countries, mobile data is incredibly expensive. If Apple were to allow over-the-air OS updates, you can bet it would take only a week until the first class-action lawsuit by people having their data caps blown through because they did not underst…
I get that, but given that some countries have insanely restrictive Wi-Fi data caps (I heard 200GB, which I would probably blow through in a week or less), I don't see the problem. Even if updates-over-4G are disabled by default, power users should be able to turn it on. My grandma has 70GB for 15€ a month; she only makes FaceTime calls, so uses on average 4GB of data a month. I'd love to use SharePlay to share her s…
> My grandma has 70GB for 15€ a month
I'm German, and ... wtf, I'm envious. We have three carriers: O2 (which is cheap, but their network is horrible), Vodafone (which is expensive, has a good network, and is constantly plagued by issues with its customer service) and Telekom (expensive, good network and decent customer service).
Telekom's cheapest plan is 40€ a month which has 6GB, and the biggest plan before flat-rate (at 85€) is 24 GB for 60€ a month...
Re: Disclosure of three 0-day iOS vulnerabilities
#243Earlier quoted context omitted.
This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…
> but iOS updates can’t be done on 4G > This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma In too many countries, mobile data is incredibly expensive. If Apple were to allow over-the-air OS updates, you can bet it would take only a week until the first class-action lawsuit by people having their data caps blown through because they did not underst…
Given they can apply censorship per region I'm sure they could apply a simple setting change per region if they wanted to.
Re: Disclosure of three 0-day iOS vulnerabilities
#244Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way? I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?
I have some doubt with respect to whether what author claims is "medical data" is indeed medical. Practically speaking, the data he mentions seems like the things collected by Apple Watch and stored in the Health app. There is indeed heart rate tracking, but can we really label this data as medical? IMHO "medical" would relate more to professional diagnosis, treatment etc. which according to Apple is stored in an enc…
> menstrual cycle length, biological sex and age, whether user is logging sexual activity, cervical mucus quality, etc.
These are hardly data collected by Apple Watch, unless someone is being inventive with one. These come from HealthKit. Which is alarming as HealthKit can also sync your EHR from health providers.
Re: Disclosure of three 0-day iOS vulnerabilities
#245Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way? I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?
Isn't it better to persist medical data on the device rather than putting it on Apple's servers?
What's funny about it is that apparently some of their WatchOS/device combos have FIPS 140-2 and FIPS 140-3 certifications. Pretty useless security theatre if you then shuffle the data around to other operating systems or into arbitrary servers with complex infrastructures.
Re: Disclosure of three 0-day iOS vulnerabilities
#246Earlier quoted context omitted.
> I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps. On a side note, this is one more reason Apple can cite for their App Store exclusivity. If there is a vulnerability in the OS exploitable by apps, and they can’t get a patch out in time, they can screen and prevent the download of such dangerous apps. Not a popular position here I know. But I’m correc…
No. Those static analysis tools don't catch everything. There are relatively well known and somewhat widespread tricks to avoid being caught by them.
Catching some is better than catching none. Apple will be evolving their analysis tools too as they go along.
Re: Disclosure of three 0-day iOS vulnerabilities
#247The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.
You talk as if the Apple engineers couldn't have fixed those 3 vulnerabilities in half a year because it's too difficult for them...
Re: Disclosure of three 0-day iOS vulnerabilities
#248Earlier quoted context omitted.
> This is a complete myth. No, it isn't. Snow Leopard was awesome. Mavericks was also pretty solid. In fact, I'm still running that on my machines today.
Yes, it is. Snow Leopard and Mavericks are not devices. The quote I am responding to is: > Apple used to be the company that made devices that were secure and "just worked". Unless your first generation iPod still works wonders.
Ok, old (first gen) Mac Pro, preferably running Snow Leopard.
BTW, I've one still running. Also a G3 from 1999 still up.
Re: Disclosure of three 0-day iOS vulnerabilities
#249The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.
Or better, we could stop making excuses for trillion-dollar companies with terrible security practices.
i agree that we need to hold massive corporations to a higher standard, but security is incredibly difficult. this comment is more directed at all of the comments who are dismissive of how difficult good security is.
even some of the sharpest security/privacy minds on the planet, who work for organizations who exist purely to make secure software or hardware stumble often.
now add in that we actually expect our devices to also be usable, and yes, security is very very _very_ difficult.
if someone hasn’t learned by now that every device will eventually be cracked, we should question their ability to reason.
now again, we should absolutely expect more from apple/google/$company than we do, but we also can’t hand-wave away that security is very hard.
Re: Disclosure of three 0-day iOS vulnerabilities
#250Earlier quoted context omitted.
I’ve always been curious how many developers might drop this in their code but only activate against potentially valuable targets
I'd think also almost zero. A lot of sleazy data collection operates under at least some fig leaf pretense of user consent, in this case there's none. Once the vulnerability is discovered, Apple could find out if you've deployed such code more or less ever. Then you'd probably have problems bigger than just a contractual dispute with Apple.
Maybe some devs are allowed to do this. And that's why it wasn't patched.