Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 254 posts

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#71

Post by atatatat »

radlad wrote: post #10
artful-hacker wrote: post #9

This is just one more nail in the already air-tight coffin Apple has built for themselves. I seriously don't understand why people stick with Apple products, they are getting much harder to use, they lock you in to their gimped ecosystem, and their hardware is constantly failing to be reliable.

I'm so happy Linux is an option on the computer. When it comes to phones I feel stuck behind a rock and a hard place - choose iPhone, with poor Linux integration and threats to passively scan files on my phone and forward them to LEO? Sure, they have a decent record with security but these bug bounty reports haven't been great. Or choose Android, with its poor privacy record, a result of being built by an ad company…

> Or choose Android, with its poor privacy record, a result of being built by an ad company that's already scanning my phone and mining it for data?

GrapheneOS.org

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#72

Post by ballenf »

dev_tty01 wrote: post #59
heavyset_go wrote: post #32

Earlier quoted context omitted.

Apple holds the keys to encrypted iCloud backups.

Yes, they do have some way of using your iCloud account credentials to get to the backup key. Given the level of customer support needed for forgotten backup keys, they have probably chosen this as the lesser of two evils. If you don't like that "feature," don't do iCloud backups. I do direct backups as described in the support link. Apple doesn't have those keys.

I do wonder how much longer local, machine-based backups will continue to be supported. Could easily see a future model dropping the cable entirely, dropping local backup and modestly upping the free iCloud storage.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#73

Post by lccarrasco »

DSingularity wrote: post #62
jtsiskin wrote: post #55

Zerodium ( https://zerodium.com/program.html ) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal. Next time someone finds one of these, I wonder where they will report it to….

Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?

People worried about the morality aspect could sell the exploit, donate the money and report the issue to the manufacturer anyways.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#74

Post by netsec_burn »

jtsiskin wrote: post #55

Zerodium ( https://zerodium.com/program.html ) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal. Next time someone finds one of these, I wonder where they will report it to….

See my comment history for a firsthand account of Zerodium.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#76

Post by doopy1 »

lccarrasco wrote: post #73
DSingularity wrote: post #62

Earlier quoted context omitted.

Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?

People worried about the morality aspect could sell the exploit, donate the money and report the issue to the manufacturer anyways.

I don't think Zerodium payouts are lump sum... I believe they are staggered in order to mitigate against this stuff.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#77

Post by ev1 »

radlad wrote: post #43
h4waii wrote: post #35

Earlier quoted context omitted.

I get that a lot of the Android-based projects don't pan out, but LineageOS has been going for quite a while now, CalyxOS is relatively new, and GrapheneOS (previously CopperheadOS) have successfully established themselves as the defacto hardened Android platform. You can download the source, modify it, and build them all freely. Hopefully more people can get involved and move the needle instead of only lamenting how…

> Hopefully more people can get involved and move the needle instead of only lamenting how they don't succeed while not actively trying to help them succeed. That's totally fair. I don't really have the time or Java/Kotlin/mobile familiarity to jump in here, and these aren't skills I can easily apply elsewhere in my career, personally. > LineageOS has been going for quite a while now, CalyxOS is relatively new, and G…

You can install Lineage without Play, and only use Lineage.

Graphene does not require Play Services, but it only runs on a small subset of Android phones that are ~$500+ here (heavily discouraged to use anything older than 4a 5G)

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#78

Post by nijave »

heavyset_go wrote: post #41
radlad wrote: post #10

Earlier quoted context omitted.

I'm so happy Linux is an option on the computer. When it comes to phones I feel stuck behind a rock and a hard place - choose iPhone, with poor Linux integration and threats to passively scan files on my phone and forward them to LEO? Sure, they have a decent record with security but these bug bounty reports haven't been great. Or choose Android, with its poor privacy record, a result of being built by an ad company…

> I don't see how it's possible without the support of the large tech players - Facebook, Instagram, Snapchat, WhatsApp, Twitter, and Spotify at minimum, to say nothing of the long tail. This wouldn't be much of a problem if it wasn't for Google's SafetyNet that prevents Android apps from running on hardware and software platforms that Google doesn't approve of. You wouldn't need support from large companies if you w…

What's SafetyNet have to do with anything? It's opt it device attestation the app creator has to implement

It's not Android/Google forcing SafetyNet on you, it's app developers insisting you need some special end user setup

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#79

Post by coldtea »

stefan_ wrote: post #69
supernova87a wrote: post #49

Why are people out to crucify Apple for a story that's still being resolved? The article clearly says: "... Due to a processing issue, your credit will be included on the security advisories in an upcoming update. We apologize for the inconvenience," Apple told him when asked why the list of fixed iOS security bugs didn't include his zero-day ..." "... We saw your blog post regarding this issue and your other reports…

> they're just incompetent / slow on this process > I feel for company leaders in this kind of shitty journalism You're not making sense. Plus Apple has a history of being incompetent and slow on this.

>Plus Apple has a history of being incompetent and slow on this

Have they, really? Just because you find this instance here and there of such a story where they were, doesn't mean they have a history of being incompetent and slow on this (the same way someone who hit 99% of their three-pointers doesn't have a history of being an awful shooter).

That's how they fare long term:

https://www.pandasecurity.com/en/mediacenter/mobile-security...

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#80

Post by rOOb85 »

radlad wrote: post #43
h4waii wrote: post #35

Earlier quoted context omitted.

I get that a lot of the Android-based projects don't pan out, but LineageOS has been going for quite a while now, CalyxOS is relatively new, and GrapheneOS (previously CopperheadOS) have successfully established themselves as the defacto hardened Android platform. You can download the source, modify it, and build them all freely. Hopefully more people can get involved and move the needle instead of only lamenting how…

> Hopefully more people can get involved and move the needle instead of only lamenting how they don't succeed while not actively trying to help them succeed. That's totally fair. I don't really have the time or Java/Kotlin/mobile familiarity to jump in here, and these aren't skills I can easily apply elsewhere in my career, personally. > LineageOS has been going for quite a while now, CalyxOS is relatively new, and G…

You can run one of those os's without any Google services. Paid apps are almost certain to not run, and a bunch of other apps that rely on the services. But almost all the apps I use work great.

I have used CalyxOS and it's a great os. I did use microG and 98% of the apps I use worked flawlessly. If you have a supported phone, I'd definitely give it a shot.

Post reply on HN