Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A new CSS-based web attack will crash and restart your iPhone

techcrunch.com

Post reply on HN
Print view View original

121–130 of 140 posts

Re: A new CSS-based web attack will crash and restart your iPhone

#121

Post by 3chelon »

wlesieutre wrote: post #117
anderskaseorg wrote: post #35

Earlier quoted context omitted.

It remains disturbing to read that something needs to be privileged just so it can sandbox unprivileged code. Why should I have to choose between trusting the sandbox and trusting the code that runs inside it? Why do we keep collectively forgetting the lesson that the more useful a sandboxing technology becomes, the more likely it becomes that someone will need to run that sandbox inside another sandbox (or inside an…

It's not privileged in that it can sandbox unprivileged code, it's privileged in that it can run that code at all. Other processes are not allowed to execute writeable memory. MobileSafari has a special "dynamic-codesigning" sandbox entitlement that allows the JIT to function.

This is the correct answer.

Re: A new CSS-based web attack will crash and restart your iPhone

#122

Post by LoSboccacc »

sethammons wrote: post #95
LoSboccacc wrote: post #80

Earlier quoted context omitted.

It’s very convenient, but isn’t that scenario better covered by hibernating the os? That covers all app and doesn’t require any app to have special behaviour coded in

If I never had to restart, sure. I have to restart my laptop weekly at least. Heck, it locked up twice last week opening Diablo 3 forcing a hard power cycle. My phone gets restarted less often but still gets into odd states where a reboot is needed.

tangential, but check out that your power supply is ok, that's the second most common source of random lockups during load (I assume drivers are up to date, that'd be the first)

Re: A new CSS-based web attack will crash and restart your iPhone

#123

Post by andrethegiant »

joering2 wrote: post #22
avip wrote: post #10

Earlier quoted context omitted.

It works!

DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.

If you use iCloud for Safari, you can close another device's Safari tab from your Mac. click the iCloud tabs icon on desktop Safari, then click the circle-x to close the offending tab.

Re: A new CSS-based web attack will crash and restart your iPhone

#124

Post by jedmeyers »

JustSomeNobody wrote: post #110
jedmeyers wrote: post #84

Earlier quoted context omitted.

Older iPhones with physical home button use that for restart.

Last year’s model.

Last year’s iPhones 8 use volume down + power for restart because home is not a button, but a sensor and it has to be powered to work.

Re: A new CSS-based web attack will crash and restart your iPhone

#125

Post by saagarjha »

qrbLPHiKpiux wrote: post #58
sebazzz wrote: post #2

I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?

Same here, I thought it was completely sandb0xed

A completely sandboxes process can do nothing, since doing anything from a network request to drawing to the screen requires cooperation from the OS. Safari is partially sandboxed, just like any other app.

Re: A new CSS-based web attack will crash and restart your iPhone

#126

Post by chrisper »

Eric_WVGG wrote: post #104

This reminds me of how I was unemployed for a good chunk of the year 2001. I was making a fresh start in a new city, and shopping my resumé to various graphics design firms. There was a prominent link to my portfolio site up top. After months of looking I didn’t get a single call-back. Eventually I got a job in another industry, and noticed a bunch of Macs in the corner that they used for testing. One day I decided t…

Is the new industry you are working in penetration testing?

Re: A new CSS-based web attack will crash and restart your iPhone

#128

Post by swingline-747 »

MBCook wrote: post #85
amaccuish wrote: post #75

Earlier quoted context omitted.

Does iOS not enforce reasonable memory limits on apps to prevent a panic?

It does. Your app will get killed. The OS will be fine. My understanding is this bug uses up GPU memory/contexts, not normal system RAM, and that’s why it becomes an issue.

Ohh.. sneaky: a GPU DoS.

Re: A new CSS-based web attack will crash and restart your iPhone

#129

Post by reaperducer »

matkins wrote: post #67
Crontab wrote: post #60

Earlier quoted context omitted.

"Seems like on restart Safari wants to revisit previously opened pages" I've always found that behavior annoying. If I want to revisit the last page, I can find it in history.

I'm sure you're in the absolute minority. Most people want all apps, including the browser, to stay the way they were when they closed them, even after a reboot

Yep. I know someone who keeps dozens and dozens of tabs open on an iPhone. It's kind of like a bookmark library.

I explained that there is a bookmark feature just for this sort of thing, but when you're used to doing something one way, change can be slow.

Re: A new CSS-based web attack will crash and restart your iPhone

#130

Post by swingline-747 »

comex wrote: post #50
jstanley wrote: post #6

Earlier quoted context omitted.

But why is Safari a privileged component?

Just to clarify the situation: fulafel’s comment (parent^4 of this comment) is incorrect. iOS does not automatically reboot when Safari or WebProcess crashes, and Safari is not generally treated as a ‘privileged component’ overall – to the contrary, last I checked it had a tighter sandbox than most apps. As people have noted, Safari does have special privileges to run a JIT, which is otherwise restricted. This is not…

To explain to other readers: JIT processes usually have to violate the standard W^X protection rule for memory pages by either simultaneously mapping them to both data and code virtual pages, or remapping them before&after JIT compilation. I'd hope it's the latter. JITs are basically compiler-linkers directly to memory, so need to have their output transformed from data pages into code page in order for it to be executable.
Post reply on HN