Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

271–280 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#271

Post by EMM_386 »

grey-area wrote: post #138
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

I imagine they are just overwhelmed. Let’s say they have a team of 6 engineers tasked with this. They probably receive hundreds of reports a day, many bogus, some real, but all long winded descriptions like this framed to make the vuln seem as bad as possible. In addition many vuln reports are generated by automated tools and sprayed to thousands of sites/vendors daily in the hope of one of them paying out, they seem…

> Let’s say they have a team of 6 engineers tasked with this.

They are a trillion dollar company. They can have as many engineers as they'd like.

Re: Disclosure of three 0-day iOS vulnerabilities

#273

Post by jeltz »

godelski wrote: post #127
JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

> The problem is that cybersecurity is ridiculous hard problem. This is why I wonder why "minimize your data exposure" is such a controversial opinion.

Because it makes developing new features slightly slower and that is for mostly stupid reasons deemed unacceptable.

Re: Disclosure of three 0-day iOS vulnerabilities

#274

Post by tonmoy »

raspasov wrote: post #241

I am not able to compile the first two of these (after the first two I stopped trying) with the newest Xcode on iOS 15.0. I haven't tried the other two or older tools. The source code as given also had syntax errors in it.

Just curious, what kind of compilation error are you getting?

Re: Disclosure of three 0-day iOS vulnerabilities

#275

Post by scns »

concinds wrote: post #131
JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3…

I hate blaming people and pointing fingers. It seems to me, that the current CEO, who was the CFO at the same company before, would be well advised to drop the "numbers & metrics" MBA mindset.

Written five years ago but sadly still relevant: https://steveblank.com/2016/10/24/why-tim-cook-is-steve-ball...

Re: Disclosure of three 0-day iOS vulnerabilities

#276

Post by minxomat »

black_puppydog wrote: post #137
sam0x17 wrote: post #22

Earlier quoted context omitted.

Bug bounty programs are the antithesis of Apple's internal methodology, culture, and way of doing business. They keep everything close to the chest, they shun "outsiders", etc.. The idea that someone outside of Apple, from the unwashed masses, could find a flaw in Apple's own software is a pretty big pill for them to swallow. Thus it doesn't surprise me there are problems with their bug bounty program. I think if the…

That makes apple (the org, not the fanboys) sound a bit cultish... Can't say I'm surprised though...

There are entire books that romanticise the cult aspect of working at Apple.

Re: Disclosure of three 0-day iOS vulnerabilities

#277

Post by FabHK »

mschuster91 wrote: post #242
concinds wrote: post #191

Earlier quoted context omitted.

I get that, but given that some countries have insanely restrictive Wi-Fi data caps (I heard 200GB, which I would probably blow through in a week or less), I don't see the problem. Even if updates-over-4G are disabled by default, power users should be able to turn it on. My grandma has 70GB for 15€ a month; she only makes FaceTime calls, so uses on average 4GB of data a month. I'd love to use SharePlay to share her s…

> My grandma has 70GB for 15€ a month I'm German, and ... wtf, I'm envious. We have three carriers: O2 (which is cheap, but their network is horrible), Vodafone (which is expensive, has a good network, and is constantly plagued by issues with its customer service) and Telekom (expensive, good network and decent customer service). Telekom's cheapest plan is 40€ a month which has 6GB, and the biggest plan before flat-r…

To be fair, looking around a bit, you can get

14 GB for 13€ (https://www.handyvertrag.de - it's a brand of Drillish, reseller of the O2/Telefónica/E-Plus network)

40 GB for 19€ (https://bestellung.vitrado.de/offer/index/2b5pv1)

Re: Disclosure of three 0-day iOS vulnerabilities

#278

Post by funcDropShadow »

kiklion wrote: post #263
funcDropShadow wrote: post #228

Earlier quoted context omitted.

So, is this the lack of grandmas working at Apple in software development? This is nothing you can fix by following some diversity ideology. This is a question of respecting different requirements from different user groups. You cannot mirror every user group in the development teams. How do you represent people of old age, with illnesses, or certain disabilities in a development team? How do you represent people liv…

Sometimes you need to accept you just aren’t the target audience of a product. You may love cars. You might think Tesla’s are amazing. But if you live on a small island without an electrical grid, it might not be the car for you just because it doesn’t come with its own solar panels.

But what do you do when you realize you are neither the target sheep, ehh, customer, of iOS nor Android? But that is just the other side of the coin of what I wrote about the development teams. Sometimes, they just have to accept that diversity is not going to solve all problems.

Re: Disclosure of three 0-day iOS vulnerabilities

#279

Post by cybrox »

saagarjha wrote: post #201
speedgoose wrote: post #107

Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way? I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?

Isn't it better to persist medical data on the device rather than putting it on Apple's servers?

Not if your API design is so bad that any third party can access them, apparently.

Aside from that, I'm pretty sure they'll also get stored on their servers, if you have not declined all the nagging iCloud sync requests.

Re: Disclosure of three 0-day iOS vulnerabilities

#280

Post by cybrox »

evercast wrote: post #227
WA wrote: post #208

I'm wondering how the health-data incident works with respect to the GDPR. Apple says it stores Health data in a protected way on the device. In reality, health data is leaked through logs and can be accessed by any other app. It is impossible to tell whether or not this data has been accessed in the wild. Since Apple failed to implement their claimed security features properly and you need to assume exploitation by…

According to my understanding of GDPR, the data would need to contain personal information i.e. something that allows you to link it to an identifiable person. Quick search on google gives the following definition of personal data [1]: "Personal data are any information which are related to an identified or identifiable natural person." So if there is no personal data in the logs, it should not be a GDPR breach. [1]…

Not sure how far fetched an accusation can be in this case.

If the data is accessible in plain text on a device that is clearly linked to an identifiable natural person, which is data that an attacker can easily access, the point of "just this one log file not containing the data" is pretty much mute.

Would be an interesting case.

Post reply on HN