Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

351–360 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#351

Post by illusionofchaos »

WA wrote: post #295
cybrox wrote: post #280

Earlier quoted context omitted.

Not sure how far fetched an accusation can be in this case. If the data is accessible in plain text on a device that is clearly linked to an identifiable natural person, which is data that an attacker can easily access, the point of "just this one log file not containing the data" is pretty much mute. Would be an interesting case.

It really is interesting. Apple could potentially claim that they didn't connect Personally Identifiable Information with the leaked health data, but a third party app, which gathered that data, did. Depends on what exactly was in the logs. Did it contain my emergency contact from Apple Health? Or my own contact data? That would be bad.

You can see the logs in JSON inside Settings app. Also if two vulnerabilities are used together, you can get full name and email and connect it to health data

Re: Disclosure of three 0-day iOS vulnerabilities

#352

Post by rescbr »

samhw wrote: post #281
willis936 wrote: post #270

Earlier quoted context omitted.

They're suggesting a patch in the classical sense of the term. A whole hog OS update does not qualify. These complications were addressed 20+ years ago when whole hog OS updates were unreasonable. It requires a certain amount of cleverness, but that may be too much to ask of the fruit company. https://en.wikipedia.org/wiki/Patch_(computing)

I understand the change would be a patch, but that's separate from the question of how you encode and ship it, surely? How are you suggesting a small patch would be shipped?

In the simplest way, not unlike Windows Update: snapshot filesystem, start filesystem transaction, unzip changed binary files, check new files integrity, end transaction.

Indeed, Apple used to distribute patches this way in the past.

You also could ship a list of updated system files hashes, compare to the installed files and just download the changed ones, like rsync.

Better than shipping a whole new disk image every small update they do.

Re: Disclosure of three 0-day iOS vulnerabilities

#353

Post by illusionofchaos »

babesh wrote: post #183
babesh wrote: post #165

Earlier quoted context omitted.

No. Those static analysis tools don't catch everything. There are relatively well known and somewhat widespread tricks to avoid being caught by them.

I speculate that GameKit is basically abandonware by Apple. They even got rid of the app a few years ago. There probably hasn't been hardening of it in years and the initial work was probably developed in haste. This is systemic. Apple has a bad habit of abandoning software that isn't a priority. So, one shouldn't be surprised that Apple hasn't fixed these exploits. And I wonder if the author has fully mined GameKit…

I haven't checked further, maybe authentication token can be used to gain access to Apple account and more data. Also one other method could used to write arbitrary data outside of an app sandbox, that might be useful for further exploitation.

Re: Disclosure of three 0-day iOS vulnerabilities

#354

Post by samhw »

howinteresting wrote: post #292
samhw wrote: post #281

Earlier quoted context omitted.

I understand the change would be a patch, but that's separate from the question of how you encode and ship it, surely? How are you suggesting a small patch would be shipped?

Android does them just fine: https://source.android.com/devices/tech/ota/reduce_size In particular, bsdiff has been around for a very long time and is an industry standard binary diffing tool.

Yeah, I mentioned bsdiff in my original comment. I don't think Android uses it for operating system updates, though, as far as I can tell. I believe that page is describing APK updates (i.e. app updates).

Re: Disclosure of three 0-day iOS vulnerabilities

#355

Post by the_errorist »

lazka wrote: post #253
evercast wrote: post #230

Earlier quoted context omitted.

I have some doubt with respect to whether what author claims is "medical data" is indeed medical. Practically speaking, the data he mentions seems like the things collected by Apple Watch and stored in the Health app. There is indeed heart rate tracking, but can we really label this data as medical? IMHO "medical" would relate more to professional diagnosis, treatment etc. which according to Apple is stored in an enc…

According to the GDPR health data is a special category that needs extra care and heart rate falls in that category: "Information derived from the testing or examination of a body part or bodily substance"

"cervical mucus quality" sounds like it fits that definition.

Re: Disclosure of three 0-day iOS vulnerabilities

#356

Post by ChuckNorris89 »

black_puppydog wrote: post #266
TrueDuality wrote: post #92

Earlier quoted context omitted.

As someone that actively works in the security industry and has spent quite a bit of time tracking this... Yes, there is a massive disconnect in pricing for private acquisitions of vulnerabilities in commonly used software. Almost always it's between a 2-5 magnitude order of difference in price between a bug bounty and what a company like Zerodium pays. When they have a valuable enough customer asking for something s…

Holy fuck what kind of turds are these? Their "temporary" bounty boost listing includes specifically Moodle. That's an application that will be used by minors to a large extent, meaning they're literally leaving kids the world around unsafe. How any of this can be legal is beyond me. Btw they're also targeting pidgin, I'm imagining this might be related to OTR sessions over tor...? Edit: remembered moodle is used by…

>as an industry we should simply consider people who were willing to sign a contract with these criminals to be unemployable.

By that same logic we coul include mass ad/surveillance companies like Google and Facebook to the list. IMHO those do way more damage to society as a whole. Where do we draw the line?

Re: Disclosure of three 0-day iOS vulnerabilities

#357

Post by shmatt »

sseppola wrote: post #308
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

Best explanation I've heard was in Darknet Diaries about Zero Day Brokers, which was a fantastic listen! ( https://open.spotify.com/episode/4vXyFtBk1IarDRAoXIWQFf?si=3... ) The short version is that if the bounties become too large they'll lose internal talent who can just quit to do the same thing outside the org. Another reason was that they can't offer competitive bounties for zero days because they'll be competin…

this is the real reason. not anything internal/culture related

A good iOS 0-day is worth hundreds of millions of dollars in contracts with shady governments. Apple can't compete with that multiple times a year

Re: Disclosure of three 0-day iOS vulnerabilities

#358

Post by Amin699 »

The vulnerably allows any user-installed app to determine whether any app is installed on the device given its bundle ID.

XPC endpoint com.apple.nehelper has a method accessible to any app that accepts a bundle ID as a parameter and returns an array containing some cache UUIDs if the app with matching bundle ID is installed on the device or an empty array otherwise.

Re: Disclosure of three 0-day iOS vulnerabilities

#359

Post by zibzab »

1vuio0pswjnm7 wrote: post #296

With these Apple-related vulnerability annoucements on HN, usually we see response from a satisified Apple owner along the lines of "This is fixed in [some new version number]". The thing is, the problem isnt whether something is fixed, its that it was broken to begin with. It passed "QA" at a trillion dollar company and its a pre-installed fixture^1 on some relatively expensive hardware item. If there is such an "it…

Consider also time of introduction (of the vulnerability) to time of patch.

We have now seen bugs that have been around for 4-5 years before being discovered by ethical hackers and subsequently patched.

Re: Disclosure of three 0-day iOS vulnerabilities

#360

Post by howinteresting »

Bud wrote: post #61
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

It's interesting to me that in this entire thread, nobody is even mentioning or considering the possibility that COVID has impacted Apple's operations. It obviously has. It has affected every tech company. Certainly it has affected mine. Whether this is an example of that, I don't know, of course, but I think it's plausible.

Apple could have chosen to simply not release a new iPhone or iOS version this year, if it wanted to. To the extent that they prioritized that over fixing up their security infra, that's on them.
Post reply on HN