Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

rambo.codes

Post reply on HN
Print view View original

181–190 of 259 posts

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#181

Post by saagarjha »

legutierr wrote: post #166
pvg wrote: post #165

Earlier quoted context omitted.

Who would you sell it to and what would the buyer do with it? Outline the scenario you have in mind and we can try to sort out how to leverage this specific bug for $7000 worth of some kind of value.

Conceivably, a state actor could use this bug to eavesdrop on an espionage target, no? There is a market for zero-day exploits, where state espionage entities and criminal organizations both pay to learn about the existence of vulnerabilities like this—with prices in the hundreds of thousands to the millions of dollars. Are you saying that this particular bug would not be worth more than $7000 in one of these markets…

The former.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#182

Post by saagarjha »

happyopossum wrote: post #175
pvg wrote: post #165

Earlier quoted context omitted.

Who would you sell it to and what would the buyer do with it? Outline the scenario you have in mind and we can try to sort out how to leverage this specific bug for $7000 worth of some kind of value.

There are a number of actors who buy bugs like this - you largely don’t hear about them because once they became notorious it gets harder for them to do their jobs. Google The NSO Group for an example, and that’s just private entities. nation state actors are a whole other market for such things.

NSO creates their own chains, they don’t buy them.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#183

Post by scarface74 »

noptd wrote: post #170
sixstringtheory wrote: post #109

Earlier quoted context omitted.

I called this a data grab from day 1 and stand by that. The amount of fellow iOS developers I've had argue for the "convenience" is astounding. There should be a settings toggle to control the auto-reenable behavior.

Yeah, this behavior sounds a bit anti-user to me. The action pretty much boils down to, "Oh, you disabled Bluetooth and left it that way? Well, we know better so we're going to turn it back on without your knowledge or approval. You're welcome." I don't buy the convenience excuse either otherwise the behavior could be disabled if desired.

You mean it’s anti user when it says in big letters “turn off Bluetooth until tomorrow” when you click on the button in control center?

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#184

Post by bdamm »

metafunctor wrote: post #134
SamuelAdams wrote: post #124

Earlier quoted context omitted.

And this is why I have the internal microphone disconnected on my macbook pro. The only time a mike is attached is when I'm actively using it, and even then they have hardware kill switches. Simple kill switches would be nice to see but I doubt Apple would ever implement something like that.

Quoted post unavailable.

There are all kinds of things I don't want Apple employees to hear, or developers of some random app that runs on iOS or Mac OS.

Little brother can in many ways be far more threatening than big brother.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#185

Post by scarface74 »

alphabetting wrote: post #140
freeplay wrote: post #11

Earlier quoted context omitted.

Couldn't agree more. As stupid as it may be, the only reason I haven't moved to Andoid/GrapheneOS is iMessage.

that's the main reason for most iphone users i know and exactly why Apple will stall for as long as possible on RCS compatibility

Yes I’m sure that Apple’s 95% retention rate is based on iMessage based on the sample size of “people you know”.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#186

Post by josephg »

Kye wrote: post #131
josephg wrote: post #126

Earlier quoted context omitted.

I've given up asking her arbitrary questions - the other day I asked what the weather was like in Sydney. (I live in Australia, so the context is really obvious). She told me what the weather was like at "Sidney's tool shed" - wherever that is. But I use siri daily for things like: - Setting and stopping alarms and timers: ("Hey siri - set alarm for tomorrow morning at 9:25" / when the alarm goes off: "Hey siri stop"…

Siri handles this fine on my new phone from the opposite end of the globe. This seems to support my suspicion that they ship increasingly less sophisticated Siris to increasingly older phones. Siri on my 6S Plus before this became almost useless once they switched to on-device processing. It's also much better at identifying objects in photos for searches.

I'm querying siri on a homepod, not a phone. And I just checked - she still answers with a weather report near "Sidney Tools". (Its currently raining and 17 degrees C, if you're wondering.)

I have a running theory that you can tell how long any FAANG bug will stick around by just imagining a 25 year old tech dude in the bay area. If Dave the bay area tech dude will never encounter the bug, you're in for a bad time.

For example, google maps used to give terrible directions at roundabouts (traffic circles). That makes sense because there's no traffic circles in the bay area. All the people who could fix the problem weren't aware there was a problem at all. Dave is terrified of roundabouts, so of course it took about a decade for directions at roundabouts to improve.

A corollary of this is that modern software works well proportionally to how closely your setup matches that of the average bay area tech dude. Everything works best if you have a new phone (preferably an iPhone), fast computer and you speak english. Woe be to you if your computer is old and slow, or you use a right-to-left language, if you're blind or you have a bad internet connection.

Macos feels laggy and slow on a slow internet connection because of course it does. Bay area tech bros are never in that situation! What would Dave know about slow internet?

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#187

Post by pvg »

legutierr wrote: post #166
pvg wrote: post #165

Earlier quoted context omitted.

Who would you sell it to and what would the buyer do with it? Outline the scenario you have in mind and we can try to sort out how to leverage this specific bug for $7000 worth of some kind of value.

Conceivably, a state actor could use this bug to eavesdrop on an espionage target, no? There is a market for zero-day exploits, where state espionage entities and criminal organizations both pay to learn about the existence of vulnerabilities like this—with prices in the hundreds of thousands to the millions of dollars. Are you saying that this particular bug would not be worth more than $7000 in one of these markets…

Conceivably, a state actor could use this bug to eavesdrop on an espionage target, no?

Well, let's try to conceive it. Our state level actor is now in possession of an exploit that lets them eavesdrop on a target when they text-dictate or activate Siri, while wearing particular Apple headphones. After getting the target to install a specific malicious app from the App Store. And to run it. And to give it Bluetooth permission. And to make sure to restart it whenever they reboot their phone or the phone kills it for any reason. The value of this as state-level actor surveillance malware feels a lot closer to $0 than $7000 to me but I'm happy to hear a different conception of how this might work.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#188

Post by [deleted] »

cstejerean wrote: post #15
freeplay wrote: post #14

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.

Even worse, it looks like on MacOS you can just straight up start recording on-demand, no need for dictation or siri. > Even worse, this particular exploit would also allow the app to request DoAP audio on-demand, bypassing the need to wait for the user to talk to Siri or use dictation.

[deleted]

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#189

Post by alphabetting »

scarface74 wrote: post #185
alphabetting wrote: post #140

Earlier quoted context omitted.

that's the main reason for most iphone users i know and exactly why Apple will stall for as long as possible on RCS compatibility

Yes I’m sure that Apple’s 95% retention rate is based on iMessage based on the sample size of “people you know”.

I didn't claim that. It's just the main reason for not switching according to my friends. The imessage moat in the US is pretty heavily discussed on here.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#190

Post by scarface74 »

alphabetting wrote: post #189
scarface74 wrote: post #185

Earlier quoted context omitted.

Yes I’m sure that Apple’s 95% retention rate is based on iMessage based on the sample size of “people you know”.

I didn't claim that. It's just the main reason for not switching according to my friends. The imessage moat in the US is pretty heavily discussed on here.

If HN were a representative sample of what most users wanted from their phones you would think they wanted to spend half the day compiling the Linux kernel on their phone and the other half bemoaning if only they had the “right to repair” they could put their own headphone jack on their phone and get rid of those pesky AirPods
Post reply on HN