Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

421–430 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#421

Post by mswtk »

Bhilai wrote: post #377
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

Having worked in at a large tech company with a big bug bounty program and seeing tonnes of bugs come through, my experience is that usually there is a wide disconnect between the bug bounty program (situated in one org of the company) and the engineering group responsible for fixing the bug (which is in a different part of the company.) This is exacerbated by misaligned incentives, bug bounty team wants fixes ASAP w…

That honestly sounds like a failure to communicate with the researcher first and foremost. If it's difficult to prioritize the fix internally due to organizational politics, that's one thing, but that shouldn't stop the bounty team from communicating the status to the researcher. In fact, that should be the simplest part of the whole process, as it's completely within the purview of the bug bounty team. If they handle that right and build some trust, they might be able to successfully ask the researcher for an extension on disclosure.

Case in point, Apple likely could have come out of this looking much better if they didn't ignore and then actively lie to illusionofchaos. That really isn't a very high bar to clear.

Re: Disclosure of three 0-day iOS vulnerabilities

#422

Post by 93po »

floatingatoll wrote: post #318
93po wrote: post #67

Earlier quoted context omitted.

This fellow has a lot more to gain than $100k by the popularity and prestige he'll gather from publishing this. Especially considering that Apple will never change their ways until they're publicly shamed, the long term outcome of shaming them is worth more than $100k if they actually change the policies to take security researchers and the bug bounty seriously

I would not consider Apple particularly concerned about shame in regard to bounty program delays in communication and publication, no matter how much people try.

I agree, but the shame of getting 0-day exploits published on the web by someone who doesn't work at Apple might shame them enough to change.

Re: Disclosure of three 0-day iOS vulnerabilities

#423

Post by illusionofchaos »

raspasov wrote: post #417
illusionofchaos wrote: post #328

Earlier quoted context omitted.

Follow the links to GitHub, the code there compiles perfectly, the PoC inside the article is just a shortened version

Thank you for the explanation! Will give it a shot. P.S. Yes it works! Perhaps add a comments in the short version where it says //This shortened version does not compile, use the GitHub version of the code It said "proof-of-concept" and I generally expect PoC to work as presented. My bad for not reading everything carefully.

Good idea, I've added the comment

Re: Disclosure of three 0-day iOS vulnerabilities

#424

Post by Bud »

Cipater wrote: post #156
Bud wrote: post #61

Earlier quoted context omitted.

It's interesting to me that in this entire thread, nobody is even mentioning or considering the possibility that COVID has impacted Apple's operations. It obviously has. It has affected every tech company. Certainly it has affected mine. Whether this is an example of that, I don't know, of course, but I think it's plausible.

I'm curious. Would you accept it if Apple came out and said that the reason this is happening is because of the COVID pandemic affecting their operations? Surely even if it were true, that is no excuse for a company like Apple?

Did I say I "accept" it? No.

Did I say it was an "excuse"? No.

Please don't put words in my mouth. The -4 downvotes made your point well enough. I get it: people want to trash Apple by any means necessary and that's way more important than a free and open discussion of the issue. Thanks.

Re: Disclosure of three 0-day iOS vulnerabilities

#425

Post by saagarjha »

user-the-name wrote: post #316
jtbayly wrote: post #300

Earlier quoted context omitted.

Do you have any evidence that Apple has been checking for these vulnerabilities in apps? I mean, if you tried now, sure, I'm guessing you'd get caught (or will be soon). But these have been around a long time.

No, I mean if you try it now.

https://twitter.com/izmcm/status/1441491002259218432

Re: Disclosure of three 0-day iOS vulnerabilities

#426

Post by saagarjha »

sam0x17 wrote: post #378
OJFord wrote: post #229

Earlier quoted context omitted.

I think it's the phrases 'some coordination' and 'company the size of Apple'. It's rarely the case (well, hopefully?!) that a fix is as trivial as 'oh yeah, oops, let's delete that `leak_data()` line' - it's going to involve multiple teams and they're all going to think anything from 'nothing to do with us' to 'hm yes I can see how that happened, but what we're doing in our piece of the pie is correct/needs to be so,…

What's worse, typically an exploit doesn't involve knowledge of the actual line of code responsible -- it's just a vague description of behavior or actions that leads to an exploit, making it much easier to pass the buck in terms of who is actually responsible for fixing it. The kicker is if your department/project/whatever fixes it, you're also taking responsibility for causing this error / causing this huge affront…

Most good exploits have a pretty solid root cause attached to them.

Re: Disclosure of three 0-day iOS vulnerabilities

#427

Post by dang »

frankfrankfrank wrote: post #287

Until we understand and push through a system (whether law or practice) that makes harming others, especially against their will and intentionally, far more costly than the massive returns and profits they today produce, NONE of these kinds of behaviors will ever cease. The examples are numerous; * Violation of human right to privacy and property * Violation of human right to not being tracked * Illegitimate wars * P…

We detached this subthread from https://news.ycombinator.com/item?id=28640879.

Re: Disclosure of three 0-day iOS vulnerabilities

#429

Post by sangnoir »

shmatt wrote: post #357
sseppola wrote: post #308

Earlier quoted context omitted.

Best explanation I've heard was in Darknet Diaries about Zero Day Brokers, which was a fantastic listen! ( https://open.spotify.com/episode/4vXyFtBk1IarDRAoXIWQFf?si=3... ) The short version is that if the bounties become too large they'll lose internal talent who can just quit to do the same thing outside the org. Another reason was that they can't offer competitive bounties for zero days because they'll be competin…

this is the real reason. not anything internal/culture related A good iOS 0-day is worth hundreds of millions of dollars in contracts with shady governments. Apple can't compete with that multiple times a year

This doesn't compute: is the claim Apple badly manages its bug-bounty because 0-days are too valuable? If that's the case, I'd expect the opposite effect: Apple would recognize how valuable the reports being sent to them by white-hats are, and would react with a sense of urgency and gratitude. As it is, Apple is behaving as if 0-days are worth very little, and not a big priority.

Re: Disclosure of three 0-day iOS vulnerabilities

#430

Post by sangnoir »

worrycue wrote: post #153
babesh wrote: post #46

Earlier quoted context omitted.

Don’t update your apps till after Apple releases a patch. The first two are API calls that apps can make. An exploit wishing to exploit these vulnerabilities has to be coded to make these calls. Most apps don’t dynamically construct arbitrary API calls. In fact, you can’t do that in Swift AFAIK. You have to drop to Objective-C or C to do that. So most apps need to be updated to exploit the vulnerability. The only exc…

> I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps. On a side note, this is one more reason Apple can cite for their App Store exclusivity. If there is a vulnerability in the OS exploitable by apps, and they can’t get a patch out in time, they can screen and prevent the download of such dangerous apps. Not a popular position here I know. But I’m correc…

> But I’m correct no?

You're not correct - Apple can still scan apps installed from elsewhere. With a user opt-in, Android can verify side-loaded apps - no App-store exclusivity required.

Post reply on HN