Isn't the walled garden and locked down OS/hardware supposed to prevent these things?
Whoever advertised that, they lied. There's no actual way to prevent these things - aside from not participating at all.
A Saudi woman's iPhone revealed hacking around the world
111–120 of 184 posts
Re: A Saudi woman's iPhone revealed hacking around the world
#112Tech has essentially created this problem. Can’t tech fix it?
Nope, it can't. As long as you use tech, it's a risk management situation, and a cat and mouse game.
Re: A Saudi woman's iPhone revealed hacking around the world
#113Earlier quoted context omitted.
Good analogy. Question here is: can they fix potholes faster than new ones show up? Seems answer is no for tech. And construction, these days.
It takes an expert to know that there's vulnerability. Whereas construction engineer can "see" the pothole and so they can fix it. Software engineer has to "know from exploits" that there's a vulnerability so they can fix it. It's not far away when OS are written in memory safe languages like Rust.
It's more complex to find security bugs, yes, but I think the analogy stands.
In order for a construction engineer to "see" a pothole, they need to actually know where the pothole is and physically go there.
When you have millions of kilometers of paving across a continental-sized country, like the US or China, for example, this is unfeasible. "Seeing" a pothole isn't so simple as it might give you a first impression...
Re: A Saudi woman's iPhone revealed hacking around the world
#114Earlier quoted context omitted.
Because Animoji was more important. Incase anyone was wondering, yes the amount they spent on that particular feature vastly eclipsed their spend on the kinds of teams that could have caught this.
I find it very hard to believe that the richest company in the world, didn’t have enough money to implement Animoji. And they had to eclipse the budget of security team. Could you provide a source for that?
3rd richest if we are going by profits: https://companiesmarketcap.com/most-profitable-companies/
Re: A Saudi woman's iPhone revealed hacking around the world
#115Earlier quoted context omitted.
That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.
I always remember a quote from a sci fi I read about the "multi planet Internet" there. It was layer upon layer upon layer of protocols and software. Because it wasn't possible to remove old layers (because some satellites or wormholes or whatever would stop working.) So, it was super easy to hack...and sending spam. Well you will get killed for that though.
Would be interested in the name of he book ?
Re: A Saudi woman's iPhone revealed hacking around the world
#116Earlier quoted context omitted.
Holy shit. My relatives have asked me in the past "could this [image|video|other supposedly innocuous file format] be a virus or hack my phone?". I've always told them not to worry. Can't do that anymore.
https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter abo…
I wish OSs would just can support for legacy stuff nobody uses and make it an explicit install for the 1% of people who need it.
Re: A Saudi woman's iPhone revealed hacking around the world
#117Earlier quoted context omitted.
I find it very hard to believe that the richest company in the world, didn’t have enough money to implement Animoji. And they had to eclipse the budget of security team. Could you provide a source for that?
3rd richest if we are going by profits: https://companiesmarketcap.com/most-profitable-companies/
I mean thats not really something any relevant to my comment, even if by profits it lags at 3rd place.
Yet its significantly ahead of Microsoft and Google.
And Apple doesn’t even have its own cloud business like Azure to take care of, so its very tough to believe Apple spent all its money on a novelty trick.
Re: A Saudi woman's iPhone revealed hacking around the world
#118Why doesn’t Apple have a team doing what Citizens Lab does, instead of victims contacting a third party? Also, I wonder if Google Pixel is more secure?
Because Animoji was more important. Incase anyone was wondering, yes the amount they spent on that particular feature vastly eclipsed their spend on the kinds of teams that could have caught this.
10 years from now:
“security researchers find a blank Animoji file that ended up being a security exploit wrapped around an OS written with image files”
Re: A Saudi woman's iPhone revealed hacking around the world
#119Earlier quoted context omitted.
Not to sound like a broken record but…. This was yet another memory management bug that would have been prevented if using a memory safe language
On a brighter note, apple is currently in the process of converting almost all iMessage components to Swift for this reason. I'm sure it is taking many engineering hours, and image parsers/open source libraries like this are the most difficult to convert.
1000 FTEs thwart the world’s nation state hackers?
Re: A Saudi woman's iPhone revealed hacking around the world
#120Tech has essentially created this problem. Can’t tech fix it?
As long as people aren't put in jail for faulty software, it will never be fixed.
Remember Diginotar?
Who knows how many lives were affected in Iran...