Isn't the JS exfiltration part trivial? The attack assumes that the victim is visiting an attacker-controlled web server. If the attacker can put secret data in the DOM within the victim's browser, the attacker can also add JS on the same page that POSTs the DOM contents to the server once they're populated with secrets.
If it's "trivial", then perhaps the article should've demonstrated that.
Vulnerabilitity research without doing the work to productize exploits is good and productive, let's not normalize the opposite expectation. It's a chilling effect.
Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to…
Welcome to HN, in as gentle a way possible I refute this statement > Apple continues to support nearly-decade-old devices like the iPhone 6S, which and iOS 15.8 is still powering those devices, seemingly with official Apple support, with the latest update from October the 25th, which addressed some security vulnerabilities. With: try to update your Apple Watch with a device running the latest iOS 16
Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to…
You didn’t answer the biggest question: being able to read /etc/passwd does not imply being able to read any of the sensitive files listed under “What files could somebody steal? Well, there’s always:”. Did you actually test any of those?
I only tested passwd at the time and I don’t currently have access to the 6s to test the other files. I can report back whenever I get access to that phone again.
I feel this is misleading as most iPhone users are totally aware that iPhone Models not running iOS 17 are not being actively updated. The list is widely published: https://support.apple.com/guide/iphone/models-compatible-wit... Any model more than 5 years old (Xr and Xs) are essentially not being updated and not secure. So an iPhone 1, 3, 5, 6, 7, 8 and X are all not secure and most people who use the iPhone are tot…
This is about the browser, not the OS. The unique thing about apple is that they tie the browser to the OS. So you won't even get application updates, which is quite surprising for anyone that has ever touched a computer. That is some Windows 98 nonsense right there.
I understand your point, but I just think the headline.... "No new iPhone? No secure iOS" is misleading, because iPhone xR and xS, iPhone 11, iPhone 12, iPhone 13 and iPhone 14 models are all not new iPhones, but they receive secure iOS updates. The headline suggests only brand new iPhones are secure, but when you click they are talking about deprecated devices more than 5 years old that most users know do not receive updates just like Microsoft/Android or any other vendor, Apple explicitly stated they won't update these devices and most users are aware of this fact.
That was about the literal iPhone X (the letter X). The iPhone Xr and Xs (roman numeral 10) are still supported.
It’s made more confusing by the fact that the comment omits all the S models from the list of unsupported models (along with the iPhone 4 for some reason). So at a glance one could assume that the XS is lumped in with the X just like the 6S is lumped in with the 6.
Sorry for my poor drafting. I agree with your comment.
Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to…
It,'s always a fun and interesting read when your posts hit HN. How much time would you estimate goes into researching? And do you have any pointers for someone which want to dip their toes into this vast sea of exploration?
This wasn't really my "finding" per-se (the original vulnerability was from June, after all), it was just something that came into my eyes and I thought it would be interesting to discuss the implications and some perceptions I have based on it.
>And do you have any pointers for someone which want to dip their toes into this vast sea of exploration?
Can you expand on what you mean by this exactly? I got into security by accident when I was a child and have never followed any type of routine when it comes to learning.
Probably the only pointer that may help is: take something that you know and use often (some piece of software) and ask "what if?" or "why can't I or someone do X?" ¯\_(ツ)_/¯
Personally I don’t think Apple’s level of support is incredibly bad when you take a look at the used device market. Even with Apple’s famously high resale values, depreciation on smartphones is huge. Don’t buy brand new old phones new from Apple, they’re a ripoff. If you buy either an iPhone 12 or 13 used for $250-350 you can basically plan on a $50 a year budget to have a smartphone that always has the latest OS jud…
> I don’t think we will be able to say the same thing about an iPhone 12 or 13 The wildcard here is local LLM use cases and any new hardware that increases their speed by orders of magnitude.
I just want a glorified iPod from my old phone that won't get pwned at the airport.
> So far I don't know anyone who got hacked and suffered damages for using an Android that stopped getting updates. That’s a “hope for the best” approach to security, for me it’d be irresponsible to recommend it to even friends and family. But if you want to do it with knowledge of the potential problems — go for it. It’s your phone and your data.
Not when you can load an OS like Calyx [0], GrapheneOS [1] or LineageOS [2]. In this context the iPhone ends up the true "hope for the best" option. The original Pixel / Pixel XL (2016.10.04) can still run the latest LineageOS with current patches [3]. [0] https://www.lineageos.org/ [1] https://grapheneos.org/ [2] https://calyxos.org/ [3] https://download.lineageos.org/devices/sailfish/changes
I was responding to the parent who recommended using unpatched, out of support Android.
People who’re comfortable (or can be bothered) installing alternative OSes on their phones have an entirely different view on device obsolescence. Statistically they’re also a rounding error in the total mobile-using population.
Apple: proven track record Google: promises you're being disingenuous
> Google: promises Google is not promising this out of the goodness of their heart. They're just getting ahead of what the EU is planning to mandate [0], and doing that to get some good marketing while they're at it. So, while Google's track record leaves a lot to be desired, in this, I think they'll keep their promise, either because they actually care, or because the EU will force them to. Either way, we, the end u…
>Google is not promising this out of the goodness of their heart. They're just getting ahead of what the EU is planning to mandate
If that was the case then why did Google exceed the requirement by 2 years? Additionally, Google is providing 7 years of OS upgrades and 7 years of security updates. Google could have easily just do what they did with the Pixel 7 and offer 3 years of OS upgrades and 5 years of security updates, thus, meeting these EU requirement of 5 years of updates. So to claim that Google offering an industry leading 7 years of OS upgrades and 7 years of security updates is not out of the "goodness of their heart" is being disingenuous IMO.
Moving the photos and videos to a hard rive is a pain usb is buggy, icloud is useless. Cheaper iphones have very little storage and there is no ssd slot either. It means, when the phone is full you have to buy a new one. If you want to update (assuming updates are available) you have to do hours of manual photo and video deletion to make space for the update.
If they really wanted to update phones that are full they could move the images/video to their server until the update is done.