211–220 of 433 posts
That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…
Earlier quoted context omitted.
I think you've misunderstood. The point was that there are (to simplify) two different threat models at play here: one where your most powerful adversary is somewhere between your family and domestic law enforcement, and another where you are worth $10+ million to a nation state. 99.99% of the world lives in threat model 1; our goal as security minded people is to protect these people. These people want general purpo…
I'm trying to paint a bigger, better picture. From the inside of the status quo, those threat models, well-informed reasoning, the descriptions of hierarchy, and what “should” and “should not” be possible, “millions will react like this, millions will react like that” are valid and respected. From the outside, there's a tiny bit of a problem: ordinary human has no value apart from that of a cog in the machine, there…
Consequently, I ensure that my motorcade of armed guards are always with me, and accept cars loaded with only the toughest reinforced glass. I am, of course, paranoid about physical proximity to strangers and that mostly incentivizes me to avoid public travel, particularly flights (though even my private jets must be carefully maintained only by my most trusted insiders lest they find themselves tumbling out the sky near Tver). When flying on particularly important trips I send a decoy plane, and I make sure that air space near me is well controlled.
Or maybe, just maybe, I don’t actually face the same threat profile as presidents, spy agency bigwigs, and leaders of paramilitary organizations, and pretending I do is an act of high fantasy that far from empowering my true human soul would be so ridiculous as to make life unlivable!
Earlier quoted context omitted.
I don’t really see anything wrong with their security posture here.
Article says large data files were sent from device to servers. Perhaps they could have configured their networks to detect/block this part.
Earlier quoted context omitted.
I don’t really see anything wrong with their security posture here.
Article says large data files were sent from device to servers. Perhaps they could have configured their networks to detect/block this part.
Earlier quoted context omitted.
Reading between the lines of TFA, it seems the researchers may also suspect that to be the case: > Our guess is that this unknown hardware feature was most likely intended to be used for debugging or testing purposes by Apple engineers or the factory, or that it was included by mistake. Because this feature is not used by the firmware, we have no idea how attackers would know how to use it. However, keep in mind that…
Since they've gone to the trouble of protecting it with an insecure hash, couldn't they also have designed this hardware feature so that it could be completely disabled until the device is rebooted? This vulnerability doesn't persist through reboots, so it would be sufficient to have the firmware lock the feature out during startup outside of development or manufacturing contexts.
I suspect, once you stop receiving data from the device, you just text it the invisible message every few minutes until you start getting data again.
Earlier quoted context omitted.
but why pay hackers to try to find a backdoor when you can just walk in the front door and use the carrot and stick to get what you want?
This happened at a company I worked at so it’s not out of the question. I figured it out by reverse engineering and quit on the spot. They tried to tell me I’d never work again if spying on users was a dealbreaker. They showed me a natsec slide deck that identified other collaborating companies as a way of making their point. Among them was Apple.
It’s quite unfortunate that Apple doesn’t allow users to uninstall iMessage, it seems to be the infection vector for advanced threats like this, NSO group, etc. Presumably it’s to avoid the support burden, but they could gate it behind having Lockdown Mode enabled for a week or something to shake out the vast majority of mistaken activations.
Can someone explain to me why we can load vast quantities of untrusted code and a wide variety of image formats in our browsers all day long and be mostly safe today, but somehow even first party messenger apps seem to be a relatively easily compromised? Why can't messenger apps be sandboxed as well as browsers?
Earlier quoted context omitted.
No, Lockdown Mode doesn't disable iMessage. "Most message attachments are blocked and some features are unavailable." iMessage with blue bubbles still works in Lockdown Mode. I think GIFs don't display properly and certain other attachments, but I can share photos, audio clips and video so I otherwise don't really notice that Lockdown Mode is enabled.
Unfortunately, Lockdown Mode disables Live Photos from being received via iMessage... That's a pretty big iPhone feature to not work under Lockdown Mode!
>This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. This is getting ridiculous. How many iMessage exploits have there now been via attachments? Why aren't Apple locking down the available codecs? Why isn't BlastDoor doing its job? This is really disap…
Earlier quoted context omitted.
well of course nobody would have NSA_friendly_override() in the source plausible deniability is essential in such cases, hence the term bugdoor
This is the same conspiracy mindset of flat earthers, and you deserve your own netflix mockumentary over it. Because a bug is a bug, it's very nature means you cannot prove it isn't malicious, therefore you take it as positive proof of malice and sit pretty bc no one can prove a negative.
In all seriousness, I wish I could tell you that you're wrong, but I can't.