Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

261–270 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#261

Post by howaboutnope »

tonypace wrote: post #254
howaboutnope wrote: post #54

Earlier quoted context omitted.

> crap like GDPR (which makes basically all normal interaction cumbersome) Only if you count "tracking users on first visit before they do anything else" as normal. Otherwise, there isn't a banner needed; sites could simply have a link to opt-in to tracking in the header or footer, and not track unless the user opts in. This is like passing a law making it illegal to just hit people in the street, requiring you have…

You cannot claim that GDPR is a good law, not with the galaxy-sized loophole where you can track the vast majority of people just like before, as long as your annoy them first. Better than nothing, sure, but not good.

I didn't say it's perfect, but it's surely better than it's presented by people who get nothing about it right.

Re: Disclosure of three 0-day iOS vulnerabilities

#262

Post by easton »

tyrfing wrote: post #129
hungryforcodes wrote: post #74

Earlier quoted context omitted.

You know, I'd love to think that the problem is cyber security is hard -- which it IS -- but I'm starting to get the feeling that the actual problem is that Apple doesn't care about this kind of stuff. So many incredible vulnerabilities going back generations of iPhones and iOS...the zero click iMessages one floored me.

> the zero click iMessages one floored me. In case there is any confusion, there has been at least one of those a year for the past 3 years.

What is dumb about it to me is that the solution in my mind is simple: don’t give Messages.app private API access. They get access other messaging apps from the App Store can’t have and that’s what’s causing these vulnerabilities, but all they need is APNS and access to the SMS service (which is private but shouldn’t be dangerous… right?).

Re: Disclosure of three 0-day iOS vulnerabilities

#263

Post by kiklion »

funcDropShadow wrote: post #228
rixed wrote: post #209

Earlier quoted context omitted.

> my grandma doesn’t have WiFi Tech workers have difficulty taking into consideration lifestyles they don't know exist, which is understandable. At the end of the day this comes as another consequence of the lack of diversity in tech, I guess.

So, is this the lack of grandmas working at Apple in software development? This is nothing you can fix by following some diversity ideology. This is a question of respecting different requirements from different user groups. You cannot mirror every user group in the development teams. How do you represent people of old age, with illnesses, or certain disabilities in a development team? How do you represent people liv…

Sometimes you need to accept you just aren’t the target audience of a product.

You may love cars. You might think Tesla’s are amazing. But if you live on a small island without an electrical grid, it might not be the car for you just because it doesn’t come with its own solar panels.

Re: Disclosure of three 0-day iOS vulnerabilities

#264

Post by samhw »

concinds wrote: post #131
JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…

> instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari..."

Your comment seems to be implying that Apple could simply ship the delta in the source code: i.e. something like `git diff --minimal --word-diff=porcelain head^1`. Would this not require iOS to be compiled on the device, and store its own source code, à la `.git`? How would you address the issue of the compiler itself needing to be updated as part of this process?

Or are you suggesting they would ship the diff for the binary? For one, I don't think the delta in the resulting binary would be as small as the delta in the source, due to addresses changing, etc. There are tools like bsdiff which can 'intelligently' handle this, but I believe they aren't widely used for operating system updates, as opposed to standard userspace binaries.

In addition to this, the diff shipped would be relative to whatever version the device is currently using, which would necessitate storing a very large number of diffs, especially for binaries, or else computing it on the fly (which simply shifts the burden from disk space to CPU cycles).

Or have I misunderstood you entirely?

Re: Disclosure of three 0-day iOS vulnerabilities

#265

Post by wil421 »

Cipater wrote: post #159
aetherspawn wrote: post #15

If your annual revenue is above $100M, you should be held accountable to a strict version of GPDR enforced by an ombudsman, that requires you to patch all data leaking vulnerabilities within 90 days, or pay out everyone who bought your product. I just updated to iOS 15 and it now tells you which sites you have been compromised on, or had your passwords/info compromised on. To be clear, I use a password manager with a…

Hang on, you have a coffee machine that is capable of being compromised? How exactly? Further to this, you claim that you have been compromised on HUNDREDS of sites even though you use a unique password everywhere? How is this happening to you? Isn't this a huge concern?

When I was looking for an espresso making a lot of them have touch screens and connected features. They will wake up before you get out of bed and have hot water ready. I specifically bought one without touch screens and all that crap. It takes maybe 30 seconds for the water to heat up.

Lots of people will get their regular coffee maker ready the night before with water and ground beans. At a specific time in the AM it will brew. Lots of old models have timers you can set. I avoid smart devices like the plague. My Bosch fridge is a smart fridge and I plan on putting it on a VLAN.

Re: Disclosure of three 0-day iOS vulnerabilities

#266

Post by black_puppydog »

TrueDuality wrote: post #92
mrslave wrote: post #28

Earlier quoted context omitted.

This is a part of our industry I do not follow beyond headlines. A lot of those headlines are about hackers trying to be responsible getting screwed out of supposed bounties that to my mind already appear quite small. Also responsible companies doing very little to quickly close them. Does anyone have any insight into how the market for vulnerabilities operates? Is there is a significant disparity in price between of…

As someone that actively works in the security industry and has spent quite a bit of time tracking this... Yes, there is a massive disconnect in pricing for private acquisitions of vulnerabilities in commonly used software. Almost always it's between a 2-5 magnitude order of difference in price between a bug bounty and what a company like Zerodium pays. When they have a valuable enough customer asking for something s…

Holy fuck what kind of turds are these? Their "temporary" bounty boost listing includes specifically Moodle.

That's an application that will be used by minors to a large extent, meaning they're literally leaving kids the world around unsafe.

How any of this can be legal is beyond me.

Btw they're also targeting pidgin, I'm imagining this might be related to OTR sessions over tor...?

Edit: remembered moodle is used by universities as well, so not overwhelminly but still....

Edit 2: IMHO working or having worked for one of these companies should be a career ending move. Simply not acceptable to be working in this field anymore. Not by legal means of course, but as an industry we should simply consider people who were willing to sign a contract with these criminals to be unemployable. "Sorry we don't do business with turds."

Re: Disclosure of three 0-day iOS vulnerabilities

#267

Post by guntars »

merb wrote: post #258
robertlagrant wrote: post #218

Earlier quoted context omitted.

Strangely I did the same thing last night and it did resume, although you only see the resumption when it starts. There's no prior indication that it will resume.

it depends on your free storage. if it is less than X % they will try to download it one go. the resumable download will download all in chunks and than concat them.

Just tried it again. I have 70GB available. Got on the hotspot, started the download, unplugged the laptop, waited for it to go to sleep, woke it up - same result. I had to accept the EULAs again and it started to download from about 50mb.

Having attempted (unsuccessfully) to write a resumable HTTP/HTTPS downloader, which is what I suspect nsurlsessiond is using behind the scenes - it's really hard to get it right. Meanwhile I expect to be able to start a BitTorrent download, throw the laptop down the stairs, take out the hard drive and be able to successfully resume it on a different computer because that's a protocol that was actually designed for it.

Re: Disclosure of three 0-day iOS vulnerabilities

#268

Post by acdha »

concinds wrote: post #131
JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…

> I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly)

Print Nightmare was part of a risky call in the printing subsystem design which was recognized as such when they made it in the 90s. That specific vulnerability was disclosed to Microsoft in 2020, accidentally disclosed in public in June, flailed at with incomplete patches and bad documentation all summer while ransomware gangs exploited it, and has theoretically finally been patched in the September release following multiple incomplete patches.

The Exchange auto discover bug announced yesterday had previously been reported with Microsoft telling the reporter that it wasn’t a bug. Oops.

This is hard but it’s also important to remember that this is an industry-wide failure because it’s been cheaper to clean afterwards than invest in proactive cleanup of old “stable” code, and it will likely continue as long as there are no financial consequences for a breach. Adding consequences would change that dynamic but would also be a massive change to the industry. It could endanger open source and would almost certainly make everything more expensive.

Re: Disclosure of three 0-day iOS vulnerabilities

#269

Post by EMM_386 »

raesene9 wrote: post #207
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

Here's my totally outsider informed guesswork. We've seen similar problems recently with Microsoft, where legitimate sounding issues are denied bounties, so this kind of issue is not unique to Apple. My guess would be, that MSRC and Apple's equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do "well run" companies do with cost centres...…

> My guess would be, that MSRC and Apple's equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do "well run" companies do with cost centres... they minimize them :)

It would have to be this.

If you start to increase the payout, you get more people wanting the payout.

Re: Disclosure of three 0-day iOS vulnerabilities

#270

Post by willis936 »

samhw wrote: post #264
concinds wrote: post #131

Earlier quoted context omitted.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…

> instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari..." Your comment seems to be implying that Apple could simply ship the delta in the source code: i.e. something like `git diff --minimal --word-diff=porcelain head^1`. Would this not require iOS to be compiled on the device, and store its own source code, à la `.git`? How would you address the issue of the c…

They're suggesting a patch in the classical sense of the term. A whole hog OS update does not qualify. These complications were addressed 20+ years ago when whole hog OS updates were unreasonable. It requires a certain amount of cleverness, but that may be too much to ask of the fruit company.

https://en.wikipedia.org/wiki/Patch_(computing)

Post reply on HN