Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Wi-Fi Stack on Apple Devices

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Exploiting the Wi-Fi Stack on Apple Devices

#21

Post by mikeash »

walterbell wrote: post #19
mikeash wrote: post #16

Earlier quoted context omitted.

Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?

If you want to avoid cellular charges, shouldn't you be turning off cellular?

The problematic scenario goes like this:

1. You're in a coffee shop. The WiFi sucks today. You turn off WiFi so you can use your cellular connection instead.

2. Many hours later, you go home, having forgotten about #1.

3. You binge-watch the entirety of Doctor Who streaming on your phone, not realizing the phone is still using cellular.

4. Large bill from your provider.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#22

Post by Cyph0n »

mikeash wrote: post #16
walterbell wrote: post #14

Why did Apple make it harder to turn off the WiFi radio in iOS11?

Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?

On Android 7.0, the cellular icon in the status bar makes it very clear when you are not on WiFi. The icon serves as a reminder for me since I usually switch off WiFi in the morning and re-enable it at home. I don't recall ever forgetting cellular on.

Regardless, I think Apple could have come up with a more user-friendly solution. This just looks like a lazy hack to be honest.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#23

Post by rasz »

0x0 wrote: post #10
benzinschleuder wrote: post #8

Amazing. Did they need to jailbreak or physically open the phone to find all this stuff? They talk about reversing binary images and using their "Legilimency" toolkit; I wonder if a vanilla phone was enough to research all this and propagate through Wi-Fi.

I'm guessing there must be other jailbreaks involved to be able to observe and experiment on the ios kernel side of things while developing the wifi chip exploit; going in all blind from the wifi side only sounds impossible. The question now is, are they sitting on 0day jailbreaks for current iOS versions or did they have to do all the tests on legacy iOS versions?

most likely this research is a result of Project Zero playing with PCIe interception/injection hardware toolset

Re: Exploiting the Wi-Fi Stack on Apple Devices

#24

Post by hdra »

mikeash wrote: post #21
walterbell wrote: post #19

Earlier quoted context omitted.

If you want to avoid cellular charges, shouldn't you be turning off cellular?

The problematic scenario goes like this: 1. You're in a coffee shop. The WiFi sucks today. You turn off WiFi so you can use your cellular connection instead. 2. Many hours later, you go home, having forgotten about #1. 3. You binge-watch the entirety of Doctor Who streaming on your phone, not realizing the phone is still using cellular. 4. Large bill from your provider.

I want to see the problem solved, but this feels like the wrong solution.

Reminds me of the time where I couldn't trust what the UI says about the audio of my desktop computer running Linux circa 2005

Re: Exploiting the Wi-Fi Stack on Apple Devices

#25

Post by KGIII »

bitexploder wrote: post #20
js2 wrote: post #3

I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way. Just writing the blog post and generating all the images for it must've taken many days.

I have followed iOS JB for years and keep up with exploit dev and mitigation/defense. The usage of source code and avoiding deep assembly documenting helped a lot. You are still looking at several man days of deep work on understanding the driver and stack. KASLR was the only real mitigation to bypass. That could have been a difficult part worth it's own discussion. Bypassing ASLR typically requires an info leak. I t…

If others don't know, the K is for kernel. I had guessed that it was, but decided to look it up. I figure this may save others some time.

It looks pretty neat, conceptually. It loads the kernel into a random location in memory on boot. I haven't looked into how random it is, but it's a good idea.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#26

Post by nardi »

Cyph0n wrote: post #22
mikeash wrote: post #16

Earlier quoted context omitted.

Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?

On Android 7.0, the cellular icon in the status bar makes it very clear when you are not on WiFi. The icon serves as a reminder for me since I usually switch off WiFi in the morning and re-enable it at home. I don't recall ever forgetting cellular on. Regardless, I think Apple could have come up with a more user-friendly solution. This just looks like a lazy hack to be honest.

It would have taken you 10 seconds to Google and find out that iOS also has an icon in the status bar that shows you whether you’re on Wi-Fi or cellular.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#27

Post by Cyph0n »

nardi wrote: post #26
Cyph0n wrote: post #22

Earlier quoted context omitted.

On Android 7.0, the cellular icon in the status bar makes it very clear when you are not on WiFi. The icon serves as a reminder for me since I usually switch off WiFi in the morning and re-enable it at home. I don't recall ever forgetting cellular on. Regardless, I think Apple could have come up with a more user-friendly solution. This just looks like a lazy hack to be honest.

It would have taken you 10 seconds to Google and find out that iOS also has an icon in the status bar that shows you whether you’re on Wi-Fi or cellular.

Why thank you! I would truly be lost without your wisdom.

Unfortunately, that still doesn't explain Apple's decision to make it harder to switch off WiFi. Do iPhone users simply not notice the status bar?

Re: Exploiting the Wi-Fi Stack on Apple Devices

#29

Post by williamscales »

Cyph0n wrote: post #27
nardi wrote: post #26

Earlier quoted context omitted.

It would have taken you 10 seconds to Google and find out that iOS also has an icon in the status bar that shows you whether you’re on Wi-Fi or cellular.

Why thank you! I would truly be lost without your wisdom. Unfortunately, that still doesn't explain Apple's decision to make it harder to switch off WiFi. Do iPhone users simply not notice the status bar?

Android does the same thing, more or less, now. For quite a while Wi-Fi has not been truly off unless you access a buried setting—it's scanning for access points for location data. Now in the latest release the Wi-Fi will turn itself back on after having been turned off once you're near a known access point. I never really had an issue with this, as you say it is not that hard to notice the icon in the status bar, but I will admit it is a nice touch. Granted, I have already signed my soul over to Google so I have little to care about.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#30

Post by williamscales »

hdra wrote: post #24
mikeash wrote: post #21

Earlier quoted context omitted.

The problematic scenario goes like this: 1. You're in a coffee shop. The WiFi sucks today. You turn off WiFi so you can use your cellular connection instead. 2. Many hours later, you go home, having forgotten about #1. 3. You binge-watch the entirety of Doctor Who streaming on your phone, not realizing the phone is still using cellular. 4. Large bill from your provider.

I want to see the problem solved, but this feels like the wrong solution. Reminds me of the time where I couldn't trust what the UI says about the audio of my desktop computer running Linux circa 2005

Many apps will prompt before doing a large download over data. Spotify has separate settings for mobile data and Wi-Fi streaming quality. One could imagine a video app would prompt before streaming on mobile data. I'm pretty sure this is the solution—perhaps the Android or iPhone media framework itself could implement something that would warn people if app developers are often forgetting to add this feature?
Post reply on HN