Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

joshua.hu

Post reply on HN
Print view View original

11–20 of 242 posts

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#11

Post by jeroenhd »

chrismeller wrote: post #5

The iPhone 6S mentioned was released in 2015, but should run iOS 15, which Apple still should be releasing security updates for?

Apple only publishes all iOS and macOS updates to the latest version of their operating systems. They release important updates to older operating systems (which is better than much of their competition!) but not all vulnerabilities are fixed for old versions.

You'll probably always be safe from remote code execution on supported versions of iOS/macOS, but exploits like these aren't always fixed. Unfortunately, you can't install an alternative browser engine on iOS/iPadOS, so I guess you should expect all websites to be able to read all of your cookies just in case.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#12

Post by chrismeller »

garbagewoman wrote: post #8
chrismeller wrote: post #5

The iPhone 6S mentioned was released in 2015, but should run iOS 15, which Apple still should be releasing security updates for?

As he clearly describes in the article, Apple seems to patch some exploits but not others in older versions of iOS.

I understand that, I’m just saying that they claim it gets security updates, so it seems like the kind of thing they should include.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#13

Post by charcircuit »

This is true for pretty much every vendor. Security fixes do not all get backported to every previous version of something. Newer iPhone do not just run the latest version of iOS, but they are more secure from a hardware perspective too.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#14

Post by gridder »

refulgentis wrote: post #9
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Correct. The issue is it is not commonly known that Apple isn't actually backporting fixes for exploits while it has been claiming to update the phones: this is earth-shaking[^1] news [^1] It would be completely reasonable to say "Earth-shaking? Really? You expect security backports for a decade?" I've been in mobile my whole career, iOS for 7 years, starting from jailbreaking the original iPhone, then worked on Andr…

Touche. P.S. Keep in mind though, what is the state of security of the Android phone you bought new in November 2015?

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#15

Post by geodel »

refulgentis wrote: post #9
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Correct. The issue is it is not commonly known that Apple isn't actually backporting fixes for exploits while it has been claiming to update the phones: this is earth-shaking[^1] news [^1] It would be completely reasonable to say "Earth-shaking? Really? You expect security backports for a decade?" I've been in mobile my whole career, iOS for 7 years, starting from jailbreaking the original iPhone, then worked on Andr…

Huh, it can be totally earth shaking or completely normal depending on time and place. In current market place of smartphones it is more towards earth shaking than normal.

You don't have to agree but resell value of older iPhone being much-much higher than Android tells customer values the support and quality of iPhone.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#16

Post by ionyun »

gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#17

Post by madars »

gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

It's fine for a vendor to completely abandon 10 year old hardware but if you can still pay 30% App Store tax/pay for iCloud/etc, the security fixes should be backported as well. The current situation is charging full price for inferior (or maybe even dangerous) product: Apple wants to have its cake and eat it too.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#18

Post by TheDong »

gridder wrote: post #14
refulgentis wrote: post #9

Earlier quoted context omitted.

Correct. The issue is it is not commonly known that Apple isn't actually backporting fixes for exploits while it has been claiming to update the phones: this is earth-shaking[^1] news [^1] It would be completely reasonable to say "Earth-shaking? Really? You expect security backports for a decade?" I've been in mobile my whole career, iOS for 7 years, starting from jailbreaking the original iPhone, then worked on Andr…

Touche. P.S. Keep in mind though, what is the state of security of the Android phone you bought new in November 2015?

The Nexus 6 (2014) can still run a version of android with security patches: https://wiki.lineageos.org/devices/shamu/

Google no longer offers security patches directly, but since you control the phone sufficiently to install your own OS, the community can come together and keep security updates flowing. You could do it yourself if you wanted.

Apple devices make this sort of community maintainership effectively impossible.

I know this means practically nothing since only nerds can actually install a third-party ROM, so for the general populace only the "default" security patch window matters, but for the hacker news crowd it seems like it might be a meaningful difference.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#19

Post by handsclean »

gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

It’s an issue of expectations. If Apple advertises security support then it’s fraudulent to not deliver it; on the other hand, if they advertise an EOL date, then I’d agree there’s no reasonable expectation of security updates. But what they actually do is neither, they communicate very little, supporting some past iOS versions fully and others to degrees that only they know, resulting in them profiting off a reputation for backporting security updates while not actually binding themselves to deliver it, or, often, doing so.

Like the battery issue, I feel the whole issue is communication. Apple needs to communicate when they EOL OS versions. You don’t otherwise know it, partly because EOL OS’s, including this phone’s, still get security updates, just not all of them.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#20

Post by mtlynch »

userbinator wrote: post #3

When opening the page, your /etc/passwd is there for the world to see. ...more precisely, for you to see; this needs to be combined with something to send back data (JS?) to be truly exploited.

Isn't the JS exfiltration part trivial?

The attack assumes that the victim is visiting an attacker-controlled web server.

If the attacker can put secret data in the DOM within the victim's browser, the attacker can also add JS on the same page that POSTs the DOM contents to the server once they're populated with secrets.

Post reply on HN