351–360 of 433 posts
That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…
Earlier quoted context omitted.
Exploit yes Decade old Backdoors no
> Decade old Backdoors no I really doubt it's a backdoor after reading the blog post and this thread chain from a prolific M1 MacBook hacker (macran) I think it was just an unused or very rarely used feature that was left enabled by accident. https://social.treehouse.systems/@marcan/111655847458820583 Some choice quotes. First, yeah, the dbgwrap stuff makes perfect sense. I knew about it for the main CPUs, makes perf…
Why? Apple isnt exactly a small family business and this is quite the drastic "feature" to be left enabled by accident.
How would one look from your perspective?
I didn't hear anyone mention fuzzing once. I guess there was probably very specific insider knowledge being made use of and they wanted to point a finger, which is fair enough I guess. I'm just a bit surprised that it has not been mentioned so far in the discussion. Anyhow it seems that a allow-list approach by Apple would have been better than a deny list approach! Literally not checking out of expected bounds!
If they were using a deny list, that sounds like an intentional backdoor.
Earlier quoted context omitted.
Yes, the famously compartmentalized Apple, whose roadmap regularly leaks out to the press years (cars, AirTags, Vision Pro) and months in advance (leaks about every iPhone), absolutely a great target for subterfuge.
“Undocumented registers” is uninteresting to the general public and only needs to be known to a handful of people.
Earlier quoted context omitted.
“Undocumented registers” is uninteresting to the general public and only needs to be known to a handful of people.
Oh absolutely! But that's true of ~anyone making chips; my point was that Apple isn't any worse in that regard due to their "secrecy".
Earlier quoted context omitted.
> 2-3 million dollars is not “amazing”. I don't know. $2-3m for reading code in Ghidra and throwing stuff at a wall until something sticks? Maybe some fuzzing, etc. I get that you theoretically could find an exploit that for example, you send to 100 known wealthy people, and with it you steal saved cookies + device IDs from financial apps and then try to transfer their funds/assets to an account you control but... Co…
this has the (un)fortunate consequence of being illegal. Writing exploits and selling them to a friendly government, on the other hand, is totally legal. Plus, then you can sell support contracts for that sweet recurring revenue!
Quite the cost in my eyes...
Earlier quoted context omitted.
Or they have assets working at Apple... or they hired an ex-Apple employee... etc. That's the problem with this sort of security through obscurity; it's only secure as long as the people who know about it can keep it secret.
I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…
That'd probably depend on which team the dev worked in. If they were in the right team, then it might.
Earlier quoted context omitted.
The whole story starts with them detecting the anomalous network traffic, so not sure what you think they did wrong.
I read it as it was going on for 4 years and they did 12 months of investigation leaving an unknown amount of time it went undetected.
Earlier quoted context omitted.
Sure. Rewrite sensitive parts of their stack in memory safe languages. They have Swift after all. A lot of the iOS security improvements over time have really been more like mitigations that try to contain the damage when the giant of pile of decades old C gets exploited.
They’re working on it, but a memory-safe language doesn’t help you in some of the surface that the attackers exploited here.
Earlier quoted context omitted.
iOS has a reputation for having the best security, but how many times have Android/WhatsApp had these sorts of silent-instant-root exploits via invisible messages? I don't remember it happening. Maybe the strategy of writing lots of stuff in Java is paying off there.
What’sapp has had exploits. See https://gbhackers.com/new-whatsapp-0-day-vulnerabilities/amp...