Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

joshua.hu

Post reply on HN
Print view View original

161–170 of 242 posts

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#161

Post by FirmwareBurner »

K0nserv wrote: post #150

Apple, in my opinion, does a very good job of supporting old devices. Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android. I do wish legislators forced Apple and Google to give users a path to install an alternative OS on their device. That would enable old iPhones(and Androids) to have their lifetime extende…

>Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android.

What's stopping you from keeping your Android 6 years making it an event better value? Most people I know don't throw away their Androids after 3 years but keep them as long as iPhones. Basically until it breaks/dies. So far I don't know anyone who got hacked and suffered damages for using an Android that stopped getting updates.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#162

Post by nindalf »

beeboobaa wrote: post #154
nindalf wrote: post #149

Earlier quoted context omitted.

It’s not economical to support devices used by less than 1% of the user base. Linux only manages it because community members step up to support older architectures. And sometimes when no one steps up the architectures are removed. - Linux dropping support for old graphics drivers (Nov 2023) - https://www.phoronix.com/news/Linux-Drop-Old-UMS-DRM-Infra - Linux Kernel Developers Discuss Dropping A Bunch Of Old CPUs (Ja…

Shrug. That's their problem. Or it should be, at least. Don't sell crap you can't support for a decent amount of time. Stop ruining this planet we live on by creating immense amounts of e-waste every few years. We both know your argument is dishonest or at least naive, though. They could easily support updates if they want to. But it's about money. This way they are forcing people to buy a new phone every few years.…

> dishonest

Dishonest? You're saying I'm lying to support a trillion dollar corporation I have no financial stake in and never have? Is such an accusation really in the spirit of this forum?

I suggest you review the guidelines - https://news.ycombinator.com/newsguidelines.html

Don't be snarky. Don't sneer. Assume good faith.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#163

Post by midtake »

saagarjha wrote: post #102
conradev wrote: post #59

/etc/passwd is the same on every device because it is in the system image, which is world readable. I don't think this exploit can be used to read the call history database as the author implies because it is outside of the sandbox profile.

It probably does let you grab cookies and browsing history from Chrome, though.

> probably

I wish the author included a full proof of concept

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#164

Post by K0nserv »

FirmwareBurner wrote: post #161
K0nserv wrote: post #150

Apple, in my opinion, does a very good job of supporting old devices. Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android. I do wish legislators forced Apple and Google to give users a path to install an alternative OS on their device. That would enable old iPhones(and Androids) to have their lifetime extende…

>Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android. What's stopping you from keeping your Android 6 years making it an event better value? Most people I know don't throw away their Androids after 3 years but keep them as long as iPhones. Basically until it breaks/dies. So far I don't know anyone who got hac…

Shorter patch cycles - at least historically, I haven't kept pace with the Android ecosystem. That said, with Android you can use a different OS and keep the device secured

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#165

Post by hulitu »

beeboobaa wrote: post #153
gridder wrote: post #7

This is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry

My 10 year old laptop is still getting OS updates

> My 10 year old laptop is still getting OS updates

Microsoft is trying to fix this. Win 11 wants a TPM. /s

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#166

Post by tsimionescu »

userbinator wrote: post #142
tsimionescu wrote: post #140

Earlier quoted context omitted.

If I prove I got a shell prompt on a remote device without any authentication, do I then need to show that I can execute arbitrary code? Or is it clearly implied? If the page body can read a file, then it can just execute an XmlHttpRequest to send that data to the origin server, which is the attacker in this scenario. This is just how the web works, nothing more to say about it, and no need to prove it.

It's not necessarily true that what can be read locally can be sent to a remote server.

It very much is on the web, if you are sending it to the origin server.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#167

Post by hulitu »

fh9302 wrote: post #61
xyst wrote: post #55

Those Apple commercials purporting their ecosystem was the safest/secure have aged like old milk

Which 10 year old phone is more safe / secure?

> Which 10 year old phone is more safe / secure?

Windows Phone ? I bet nobody writes exploits for it anymore. /s

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#168

Post by FirmwareBurner »

K0nserv wrote: post #164
FirmwareBurner wrote: post #161

Earlier quoted context omitted.

>Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android. What's stopping you from keeping your Android 6 years making it an event better value? Most people I know don't throw away their Androids after 3 years but keep them as long as iPhones. Basically until it breaks/dies. So far I don't know anyone who got hac…

Shorter patch cycles - at least historically, I haven't kept pace with the Android ecosystem. That said, with Android you can use a different OS and keep the device secured

Sure, but like I said, people don't throw away their phones once they get stop getting SW patches the same way they don't throw away their ancient Macbooks with glowing Apple logos just because Apple stopped pushing OS updates years ago, because most non-HN people have no idea what patches are and they keep their phone and laptop as long as it still works and the battery lasts.

Obsession with zero day patches and security hypochondria is mostly a HN/tech-workers thing as if they're under attack by state actors using Pegasus. The average joe doesn't care not is he very likely to be impacted, unless using Android Jellybean or something, since most malware in the wild out to get them is script kiddie level not state-actor level.

And anyway, someone correct me if I'm wrong, but from my knowledge and experience with Android security, most Android critical vulns that can impact the day to day security of the Average Joe are covered by updating Google Play services and Chrome or whatever browser you use as those are the main attack surfaces for (non state sponsored) malware based on what people do with their phones, and those services keep getting updates from Google long after the manufacturers stopped pushing OS updates.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#169

Post by no_time »

nindalf wrote: post #149
no_time wrote: post #141

Earlier quoted context omitted.

This bug touches nothing hardware specific. In alternative timeline where mobile OSes arent fisher price parodies of proper operating systems, they could push the same image to all iphones and have a proper hardware abstraction layer take care of the specific details. There is nothing fundamentally incompatible about the last couple of generation of iphones. ARMv8 CPU, PowerVR derived GPU. If the mobile computing spa…

It’s not economical to support devices used by less than 1% of the user base. Linux only manages it because community members step up to support older architectures. And sometimes when no one steps up the architectures are removed. - Linux dropping support for old graphics drivers (Nov 2023) - https://www.phoronix.com/news/Linux-Drop-Old-UMS-DRM-Infra - Linux Kernel Developers Discuss Dropping A Bunch Of Old CPUs (Ja…

>It’s not economical to support devices used by less than 1% of the user base. Linux only manages it because community members step up to support older architectures. And sometimes when no one steps up the architectures are removed.

Again, bugs are this are not hardware specific. You are not supporting "devices". You are supporting the OS which all of them run. Ideally (I'm not familiar with OSX/iOS internals) all they have to do is push out an update that contains the newly fixed libwebkit.so or whatever. They control everything on their own platform so they don't even have to deal with glibc breaking backcompat like we have to in the GNU/Linux world.

If they can't figure out a way to make changes like this universal across devices, it's either deliberate negligence or incompetence.

Re: No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

#170

Post by oefrha »

mmsc wrote: post #111

Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to…

You didn’t answer the biggest question: being able to read /etc/passwd does not imply being able to read any of the sensitive files listed under “What files could somebody steal? Well, there’s always:”. Did you actually test any of those?
Post reply on HN