Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher Charlie Miller booted from Apple Developer Program

news.cnet.com

Post reply on HN
Print view View original

111–116 of 116 posts

Re: Security researcher Charlie Miller booted from Apple Developer Program

#111

Post by mikeash »

crb wrote: post #110
mikeash wrote: post #39

Earlier quoted context omitted.

He did not put users at risk. This vulnerability allows apps to download and execute new code, but that new code is still subject to the app's sandbox. This vulnerability is interesting from a research standpoint, but has zero actual consequences to the security of iOS.

In his demo video, he shows a metasploit interpreter downloading the address book. He mentioned it was a different payload, but I don't recall if he said it was a different application. If it was the same app, then does that imply the sandbox for a stockmarket app allows access to the address book?

I don't believe address book access is gated in any way.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#112

Post by freemarketteddy »

mikeash wrote: post #94
humbledrone wrote: post #46

Earlier quoted context omitted.

It easily qualifies as an exploit, given that Apple's app store model is based on the fact that each app is reviewed beforehand to ensure various properties, including the property that the app does not contain spyware, etc. If Apple approved a harmless app, and then said app downloaded code that snooped on the user's calls or asked for their credit card number, that's an exploit.

App review ensures no such thing. Put in your spyware with a timer so it doesnt activate for a week. Boom, reviewers don't see it, and users do.

lol...timer!!....really?

Re: Security researcher Charlie Miller booted from Apple Developer Program

#113

Post by dasil003 »

ootachi wrote: post #43
dasil003 wrote: post #18

Earlier quoted context omitted.

The downside is poorer security, which could blow up in their face spectacularly at some point in the future.

I really doubt it. To be blunt, Apple is an existence proof that security on consumer products doesn't provide business value in proportion to its cost. Keeping users safe is seldom worth investing in.

That's sort of a strange thing to say considering that iOS and app store sandboxing are doing more to innovate in the security department than any other consumer device manufacturer.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#114

Post by mikeash »

freemarketteddy wrote: post #112
mikeash wrote: post #94

Earlier quoted context omitted.

App review ensures no such thing. Put in your spyware with a timer so it doesnt activate for a week. Boom, reviewers don't see it, and users do.

lol...timer!!....really?

Yep. There's no deep check of what your code contains, only a fairly superficial check of what it actually does. You can include nearly anything in your app (perhaps lightly obfuscated) as long as it doesn't show its face during the review.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#115

Post by freemarketteddy »

mikeash wrote: post #114
freemarketteddy wrote: post #112

Earlier quoted context omitted.

lol...timer!!....really?

Yep. There's no deep check of what your code contains, only a fairly superficial check of what it actually does. You can include nearly anything in your app (perhaps lightly obfuscated) as long as it doesn't show its face during the review.

yes that is indeed true...but why a timer?....you can just query your own web server and figure out what to do.

But yeah if you dont have time to make a small web server the timer idea could also work.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#116

Post by mikeash »

freemarketteddy wrote: post #115
mikeash wrote: post #114

Earlier quoted context omitted.

Yep. There's no deep check of what your code contains, only a fairly superficial check of what it actually does. You can include nearly anything in your app (perhaps lightly obfuscated) as long as it doesn't show its face during the review.

yes that is indeed true...but why a timer?....you can just query your own web server and figure out what to do. But yeah if you dont have time to make a small web server the timer idea could also work.

Depends on your level of paranoia and willingness to rely on the network. The server has the advantage of letting you turn it on and off at will, but a timer will work even if the user has no internet connection or your server gets confiscated by the FBI.
Post reply on HN