Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to unc0ver a 0-day in 4 hours or less

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: How to unc0ver a 0-day in 4 hours or less

#101

Post by swiley »

jsjohnst wrote: post #37
saagarjha wrote: post #32

Earlier quoted context omitted.

The problem is not running arbitrary code, but running arbitrary code without informed consent. Malware runs without consent. Apple's solution for iOS is removing the ability to run anything completely, bypassing the need to figure out how to obtain consent.

> bypassing the need to figure out how to obtain consent How do you propose getting “informed” consent from an audience who doesn’t care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn’t seem the least bit a solved problem anywhere.

I don’t understand why people think that because some people are clumsy the rest of us have to live in a straight jacket.

Re: How to unc0ver a 0-day in 4 hours or less

#102

Post by swiley »

olliej wrote: post #22
devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

In other words:

The current model fails to protect people anyway while providing an extremely strong incentive for the community to publish software that undermines the “security” of the device.

Re: How to unc0ver a 0-day in 4 hours or less

#103

Post by jsjohnst »

swiley wrote: post #101
jsjohnst wrote: post #37

Earlier quoted context omitted.

> bypassing the need to figure out how to obtain consent How do you propose getting “informed” consent from an audience who doesn’t care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn’t seem the least bit a solved problem anywhere.

I don’t understand why people think that because some people are clumsy the rest of us have to live in a straight jacket.

> why people think that because some people are clumsy

Nobody said anything about clumsy people. As one of many examples, look at all the guides that tell folks to disable SIP and don’t explain the risk and really don’t even need to disable SIP, the app should just be fixed properly.

There are exceptions of course and good reasons to disable it, so I’m glad Apple has the option, but I’d venture to say 85% of the time it’s done by a person who isn’t really making an “informed consent”.

Re: How to unc0ver a 0-day in 4 hours or less

#104

Post by eertami »

zaptrem wrote: post #62
BEEdwards wrote: post #59

Earlier quoted context omitted.

Or you could just buy an android and not worry about it. Not even to fan boy, but half of those are things that android did from the go and the rest have been added or are generally easy to do.

But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, and (for the most part) rock solid and extremely efficient OS.

>But then we miss out on Apple's hardware quality, industry-crushing A-Series processors,

To what end, my 5 year old midrange phone still loads everything instantly (Snapdragon 801). Is there actually any benefit of 'top of the line' mobile CPUs except for mobile gamers?

Re: How to unc0ver a 0-day in 4 hours or less

#105

Post by the_pwner224 »

swiley wrote: post #99
devenblake wrote: post #3

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue…

> unless you disable auto-updates and tap "Later" on every update notification Some of us do that for this exact reason. I wish there was a way for me to just pick software to give root to though, this is way less secure.

This is how it works on Android. Generally on a rooted phone you have a 'manager' like Magisk or Superuser. The first time an application tries to use root, the manager makes a popup and allows you to grant permission temporarily or forever.

Re: How to unc0ver a 0-day in 4 hours or less

#106

Post by Bnshsysjab »

muppetman wrote: post #73
ueouieodue wrote: post #70

Earlier quoted context omitted.

> That was an issue with one phone, once, and it was a problem with the battery, not Android If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own. > That's actually solved by rooting since you can update from any source instead of just signed packages Installing software downloaded from xda-developers is, what I lik…

Can you link me to a custom ROM on XDA that was shown to have Malware?

This seems like a pretty weak argument, are you sure you want to trust a bunch of hobbiest devs with the security of your (probably) most valuable computer?

Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.

Re: How to unc0ver a 0-day in 4 hours or less

#107

Post by doublerabbit »

MaxLeiter wrote: post #39

Checkra1n, another iOS exploit (although it's more impressively a bootrom exploit), is mentioned. You can see slides on it from 2019 here: https://iokit.racing/oneweirdtrick.pdf (The One Weird Trick SecureROM Hates)

Interesting, from that slide I should always null my variables after I'm finished with them.

Re: How to unc0ver a 0-day in 4 hours or less

#108

Post by IncRnd »

muppetman wrote: post #73
ueouieodue wrote: post #70

Earlier quoted context omitted.

> That was an issue with one phone, once, and it was a problem with the battery, not Android If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own. > That's actually solved by rooting since you can update from any source instead of just signed packages Installing software downloaded from xda-developers is, what I lik…

Can you link me to a custom ROM on XDA that was shown to have Malware?

That's a poor argument. That's like saying you didn't read this page's article, because the malware being discussed wasn't already known to you. Absence of evidence is not evidence of absence. Formally, this is called an argument from ignorance.

Re: How to unc0ver a 0-day in 4 hours or less

#109

Post by empath75 »

albntomat0 wrote: post #2

Since this always comes up, here's an overview I made several weeks ago about where Project Zero focuses their efforts: All counts are rough numbers. Project zero posts: Google: 24 Apple: 28 Microsoft: 36 I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=And…

Even if Project Zero exclusively focused on competitors, they'd still be providing a valuable service. Maybe Microsoft and Apple should have the same sort of project. If they're all competing at who can break each other's code the worst, that'll end up with better products from all of them.

Re: How to unc0ver a 0-day in 4 hours or less

#110

Post by lawnchair_larry »

tptacek wrote: post #87
realusername wrote: post #86

Earlier quoted context omitted.

I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine. To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter contr…

We're discussing this on a story about an untethered jailbreak --- a kernel RCE.

This is neither untethered nor RCE.
Post reply on HN