Zero click vulnerability in Apple’s macOS Mail • Hacker News Board

Re: Zero click vulnerability in Apple’s macOS Mail

#181

Post by smoldesu » Fri, Apr 02, 2021, 3:55 AM UTC

villgax wrote: post #173

smoldesu wrote: post #155

Earlier quoted context omitted.

From what I've seen, the majority of it is theater. Does that mean it's more secure than Android devices? Not necessarily. In any case, the biggest vulnerability in any system is the end user. No amount of idiot-proofing will stop people from being scammed on an iPhone, nor will it stop someone on Android. When these companies market their "Secure Enclave" or "Titan Security", they're really just dressing up otherwis…

And your point being that Android gets more updates/fixes than Apple? Lol, only Apple has a proven track record of providing 5 year old devices with updates/fixes unlike anything from Android, unless you are comfortable flashing your own builds.

No, I specifically said in my original post, "Does that mean it's more secure than Android devices? Not necessarily."

My ultimate point is that the biggest liability is the user, and those "security updates" don't really matter when the biggest attack vectors don't even consider these exploits in the first place.

Re: Zero click vulnerability in Apple’s macOS Mail

#182

Post by eyelidlessness » Fri, Apr 02, 2021, 3:58 AM UTC

adolph wrote: post #156

MuffinFlavored wrote: post #42

Earlier quoted context omitted.

The company has billions of dollars. I don't think a $50k-$100k bug bounty payout for them is a big deal. Even $1m wouldn't be a big deal to them.

A company sufficiently large enough for such an amount to not be a big deal will have a money disbursal process nobody understands enough to make a one time transaction of that size in a reasonable amount of time.

Maybe a company so large it can’t track its own finances is too large to be responsible for its obligations and should be held to standards at least as strict as its less capable business and human peers. And I’m an Apple fan to be clear. But their wealth is the opposite of an excuse.

Re: Zero click vulnerability in Apple’s macOS Mail

#183

Post by eyelidlessness » Fri, Apr 02, 2021, 4:02 AM UTC

techrat wrote: post #88

musicale wrote: post #66

> Mail will parse it to find out any attachments with x-mac-auto-archive=yes header in place. Mail will uncompress those files automatically. What could possibly go wrong? ;-/

This is the same exact issue that used to plague Outlook back in the day with the automatic handling of attachments. You'd think Apple would have learned from others' mistakes.

They still treat PDF files as “safe” to automatically open when downloaded so nope.

Re: Zero click vulnerability in Apple’s macOS Mail

#184

Post by pcthrowaway » Fri, Apr 02, 2021, 4:06 AM UTC

rfd4sgmk8u wrote: post #96

For all those people who are complaining that Apple is taking its time paying out a bounty, and suggesting Zerodium: The end result of selling 0-click RCE vectors like this to brokers is sliced up bodies in embassies. Do folks think where the money coming from, and who would pay? No, its an 'easy' pay day. Some of us fix security bugs to keep people safe. Some of us try to earn an honest living doing so. Others try t…

Can you be a bit more clear on what you're implying? Genuinely curious. I thought Zerodium was selling to government agencies.. so I'm not sure what you mean by sliced up bodies in embassies. Perhaps I'm just not thinking creatively/pessimistically enough.

Re: Zero click vulnerability in Apple’s macOS Mail

#185

Post by Wowfunhappy » Fri, Apr 02, 2021, 4:07 AM UTC

oblib wrote: post #161

So, is this an issue on my old mac running 10.11.6 that will not get fixed?

I'm on 10.9 and I don't want to use anything newer. I can deal with some risk, but this vulnerability is unacceptably bad.

The core problem is that really dumb feature which auto-expands certain zip files. I need to turn that off.

MailWebAttachment.h contains a method:

    - (BOOL)isAutoArchiveAttachment;

I bet that if I Swizzle that to always return false, this "feature" will go away. I'll found out this weekend...

Edit: Is the author's PoC available anywhere? Not that I really need it...

Re: Zero click vulnerability in Apple’s macOS Mail

#186

Post by eyelidlessness » Fri, Apr 02, 2021, 4:14 AM UTC

brundolf wrote: post #135

slimsag wrote: post #106

Earlier quoted context omitted.

Important to note this isn't a memory corruption bug, though. This is a case of the application working as designed, but in unintended ways. A logic flaw. I say this because I don't see a lot of effort being put into solving these types of security issues, compared to e.g. memory safety issues.

Unlike memory safety issues it's not really a category that tends to have category-wide solutions

V1: “This file we downloaded for your convenience is requesting access to [folder]. This may harm your computer or expose you to unknown security risk. Are you sure?”

V2: “This file unexpectedly tried to access [folder].”

The exact same mechanism Apple already used with GateKeeper and FS access for programs at runtime.

Why does it need to be more complicated than that?

Re: Zero click vulnerability in Apple’s macOS Mail

#187

Post by [deleted] » Fri, Apr 02, 2021, 4:21 AM UTC

als0 wrote: post #65

petra wrote: post #38

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

As far as what is feasible, Apple does a very good job with their iPhone/iPad security. With both hardware and software. You can read about it how it all works in their platform security guide. On the Android side, Google makes good software changes to Android, but ultimately the security is dependent on the handset maker (e.g. Samsung) and SoC maker (e.g. Qualcomm). Security will vary between Android phones. The big…

[deleted]

Re: Zero click vulnerability in Apple’s macOS Mail

#188

Post by sitzkrieg » Fri, Apr 02, 2021, 4:32 AM UTC

how stupid do you have to be to think automatically handling mail attachment compression in any way is a good idea

Re: Zero click vulnerability in Apple’s macOS Mail

#189

Post by Wowfunhappy » Fri, Apr 02, 2021, 4:32 AM UTC

ghughes wrote: post #74

viraptor wrote: post #64

Earlier quoted context omitted.

I wouldn't call it extreme when there was a known public website allowing one-click jailbreak for good few months (not sure if it was actually ever patched or just the iOS version got eol)

10 years ago, yeah. https://en.m.wikipedia.org/wiki/JailbreakMe

Actually, Safari has been used for exploits much more recently than that! https://totally-not.spyware.lol/ (iOS 10, 2018)

Re: Zero click vulnerability in Apple’s macOS Mail

#190

Post by my123 » Fri, Apr 02, 2021, 4:53 AM UTC

MuffinFlavored wrote: post #42

lehi wrote: post #4

Earlier quoted context omitted.

> 2021–03–30: Bug Bounty is still being evaluated

The company has billions of dollars. I don't think a $50k-$100k bug bounty payout for them is a big deal. Even $1m wouldn't be a big deal to them.

Your estimates of bug bounty money are orders of magnitude off.

Guess how much Microsoft pays for breaking the Windows Secure Boot implementation? $9k.