Disclosure of three 0-day iOS vulnerabilities • Hacker News Board

Re: Disclosure of three 0-day iOS vulnerabilities

#321

Post by kube-system » Fri, Sep 24, 2021, 1:37 PM UTC

midasuni wrote: post #184

sam0x17 wrote: post #19

Earlier quoted context omitted.

You can do a lot more damage with someone's bank account than you can by exploding their phone.

Currently holding my phone, with a full charge. Basically a hand grenade, about 12” from my face, with (thanks to oversized phones), both hands on it. At best id be blind and unable to use my hands. I don’t give a stuff about my bank account compared with that.

There are no explosives in a phone though. Lithium batteries might burn when short circuited... however, this requires physically damaging the battery, or shorting the circuitry. This requires some seriously silly hardware vulnerabilities (lithium cell protection is typically implemented in dedicated silicon), not simply a software vulnerability. And if you could successfully perform an exploit like this, you would probably drop the phone before it hurt you.

https://youtu.be/osfgkFyq7lA?t=246

Re: Disclosure of three 0-day iOS vulnerabilities

#322

Post by kif » Fri, Sep 24, 2021, 1:37 PM UTC

davewritescode wrote: post #317

I'm not defending Apple but looking at the code published here, it's clear that most, if not all, of these bugs could be caught via static analysis which Apple obviously uses as part of its approval process. Frankly, I'm a lot more concerned with bugs that have to deal with input handling than SDK bugs that developers can use to do bad things. This is likely a non-issue for those of us who haven't jailbroken our devi…

If Apple allowed a jailbreaking application make it to the App Store, then I do not trust their processes to not fail again.

Re: Disclosure of three 0-day iOS vulnerabilities

#323

Post by floatingatoll » Fri, Sep 24, 2021, 1:37 PM UTC

diebeforei485 wrote: post #55

floatingatoll wrote: post #34

It must be nice to give up $100k by being impatient. I do understand that OP probably feels a moral reason to do so, but that $100k would be life-changing for me, even if it took 3 years to pay out.

There is no $100K coming. Apple hopes you'll stay silent by dangling a hypothetical $100K (or whatever large amount) in the vague future. Once they've fixed the bug, they no longer have an incentive to pay you so they won't.

You’re claiming that they maliciously lie and refuse to payout because, based on OP, they screwed up on release notes and didn’t get it solved within the 90 day crunch period between WWDC and release.

It took so little evidence for you to decide it’s hopeless and declare as fact your prediction. Maybe you felt this way before this post? Otherwise I’m just not sure how to respond.

Re: Disclosure of three 0-day iOS vulnerabilities

#324

Post by mr_overalls » Fri, Sep 24, 2021, 1:39 PM UTC

frankfrankfrank wrote: post #287

Until we understand and push through a system (whether law or practice) that makes harming others, especially against their will and intentionally, far more costly than the massive returns and profits they today produce, NONE of these kinds of behaviors will ever cease. The examples are numerous; * Violation of human right to privacy and property * Violation of human right to not being tracked * Illegitimate wars * P…

> Siphoning off potential and sabotaging developing countries through human resource poaching called "immigration"

You think immigration should be illegal?

> Government theft and fractional enslavement through taxation

You really had me in agreement with the first few items. You are not a serious person.

Re: Disclosure of three 0-day iOS vulnerabilities

#325

Post by floatingatoll » Fri, Sep 24, 2021, 1:40 PM UTC

moepstar wrote: post #116

diebeforei485 wrote: post #64

Earlier quoted context omitted.

Yes. In some cases when they did pay, they paid significantly less than their published rates.

From the PoV of a security researcher - why even bother disclosing responsibly (moral obligations aside)? Best case scenario: you don't get sued into oblivion, will be ghosted and gaslightened, receive pocket change arbitrary amount of time later. Compared to that, i suppose the exploit brokers got their stuff together - after all, time is money - chances are someone else may stumble upon the same vulnerability...

If the payout is higher priority to you than the ethics of selling an exploit that governments around the world will end up using to hunt and capture or kill political dissidents, then you are of course free to sell it on the exploit market :) I prefer to sleep at night, though.

Re: Disclosure of three 0-day iOS vulnerabilities

#326

Post by dangerface » Fri, Sep 24, 2021, 1:41 PM UTC

JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

Don't apple make the frameworks they use? Im pretty sure they could just patch them when they are notified of a vulnerability.

Re: Disclosure of three 0-day iOS vulnerabilities

#327

Post by ziml77 » Fri, Sep 24, 2021, 1:44 PM UTC

api wrote: post #294

JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

It would really help a lot if: (1) We used safe languages like Go, Rust, C#, Java, and Swift instead of 1970s YOLO languages like C and C++. (2) Our operating systems were designed from the ground up to be secure in a modern environment. Unix (all flavors) and Windows were both built long before security was anywhere near as much of a concern as it is today. Their security posture is very lax by modern standards. App…

Entitlements are great, right up until someone has to start manually deciding what access to give. After being blocked or questioned by the OS a handful of times, people are going to either disable the security or effectively disable it with wildcard matches.

Re: Disclosure of three 0-day iOS vulnerabilities

#328

Post by illusionofchaos » Fri, Sep 24, 2021, 1:54 PM UTC

raspasov wrote: post #241

I am not able to compile the first two of these (after the first two I stopped trying) with the newest Xcode on iOS 15.0. I haven't tried the other two or older tools. The source code as given also had syntax errors in it.

Follow the links to GitHub, the code there compiles perfectly, the PoC inside the article is just a shortened version

Re: Disclosure of three 0-day iOS vulnerabilities

#329

Post by ls65536 » Fri, Sep 24, 2021, 1:54 PM UTC

xpuente wrote: post #187

Security through obscurity is a very bad idea. This is the main Achilles heel of Apple.

Obscurity and secrecy seem to be so ingrained in the Apple culture that I don't see this changing anytime soon short of some kind of existential crisis or a major threat to a substantial amount of their revenue. And even then it isn't likely to be easy to turn the tide.

Right now we see these negative externalities of security vulnerabilities being "paid for" by their customers, in the vast majority of cases seemingly unwittingly, but that can only go on for so long before it backfires (even if it's a long time).

Re: Disclosure of three 0-day iOS vulnerabilities

#330

Post by dangerface » Fri, Sep 24, 2021, 1:56 PM UTC

thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

Its company culture, some companies see failure as a problem to be avoided others see failure as the road to success.

Evidently apple see failures like bugs as a problem to be avoided and are just trying to avoid the problem with the obvious result that they have problems and look like a failure.

Companies that accept failure as a consequence of trying will learn and improve until they achieve success.