Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero click vulnerability in Apple’s macOS Mail

mikko-kenttala.medium.com

Post reply on HN
Print view View original

221–230 of 269 posts

Re: Zero click vulnerability in Apple’s macOS Mail

#221

Post by runeks »

spitfire wrote: post #104
Zhenya wrote: post #19

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

Bug bounty factoring! From wikipedia: > Factoring is a financial transaction and a type of debtor finance in which a business sells its accounts receivable (i.e., invoices) to a third party (called a factor) at a discount.[1][2][3] A business will sometimes factor its receivable assets to meet its present and immediate cash needs.[4][5] Forfaiting is a factoring arrangement used in international trade finance by expo…

This sounds like discounting a Bill of Exchange. Although the Bill of Exchange is drawn only against the delivery of a physical good, so this may be the difference between the two.

For example, let's say I own a sheep farm. I hire people to trim the sheep, and they produce a bunch of cotton. Without the Bill of Exchange, if I want to pay the people I've hired then I will need to ship this cotton to the spinner, who then ships the spun cotton to the weaver, who then ships the woven cotton to the clothier, who then makes clothes and sells it to a consumer. Only after this has happened can I pay my employees with the money of the paying consumer.

With the Bill of Exchange, a bill is created when I deliver cotton to the spinner. This bill will require the spinner to pay me for the cotton delivered in e.g. three months. I can then take this bill to someone who trusts that the spinner will pay me in three months and ask them to buy the bill at a discount, such that they are paid in three months (when the bill expires). I can then use the proceeds from the sale of the bill to pay my employees immediately. And the buyer of the bill earns a bit of interest because he pays less for the bill than he is paid at maturity.

[1] https://professorfekete.com/articles/AEFMonEcon101Lecture5.p...

[2] https://professorfekete.com/articles/AEFMonEcon101Lecture6.p...

Re: Zero click vulnerability in Apple’s macOS Mail

#222

Post by hnick »

saagarjha wrote: post #151
hnick wrote: post #116

Earlier quoted context omitted.

I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.

Contracts usually pay out on a schedule. If the bug gets patched then you don’t get paid.

Makes sense, thanks. Must be tense waiting.

Re: Zero click vulnerability in Apple’s macOS Mail

#223

Post by tannhaeuser »

toxik wrote: post #68
wunderflix wrote: post #57

Earlier quoted context omitted.

> Android had it since ~2012. I seriously wonder: what difference did it make? Was there any groundbreaking thing iOS users missed for 8 years? Apple is just great in omitting things and keeping focus to deliver a great product and then expand on that basis. Most famous example: First iPhones didn’t have MMS

MMS is whack though

MMS could've been (and still kindof is AFAIK) the only way to send rich text semi-anonymously for money with carrier billing ie not requiring platforms, app stores, and sign-up. Is was also blocked on Android due to the Stagefreight bug. MMS was used at lot for ringtones and wallpapers before the Smartphone era.

Re: Zero click vulnerability in Apple’s macOS Mail

#224

Post by fouc »

lovelyviking wrote: post #171
jonny_eh wrote: post #164

Earlier quoted context omitted.

That may be considered black-mail by some courts.

Can you explain it more? What can make it a black-mail and why? If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail? So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will b…

The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.

Re: Zero click vulnerability in Apple’s macOS Mail

#225

Post by GoblinSlayer »

saagarjha wrote: post #143
philosopher1234 wrote: post #121

Earlier quoted context omitted.

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.

Who does the verification?

Apple's own subdivision :)

An alternative is public offer when Apple promises to not release a fix without payment. If it's not a bug, no need for a fix.

Re: Zero click vulnerability in Apple’s macOS Mail

#226

Post by ClumsyPilot »

young_unixer wrote: post #191
ClumsyPilot wrote: post #167

Earlier quoted context omitted.

I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour

I think they're talking about the implication that if Apple don't pay, then the vulnerability is published. I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.

I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind".

In this case you aren't just a vigilante targetting apple, there is established practice stretching decades.

There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.

Re: Zero click vulnerability in Apple’s macOS Mail

#227

Post by [deleted] »

philosopher1234 wrote: post #121
Zhenya wrote: post #19

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.

[deleted]

Re: Zero click vulnerability in Apple’s macOS Mail

#228

Post by turmio »

KingMachiavelli wrote: post #175

Sounds like the sandbox still worked. Of course it's still bad but it show how sandboxing applications works well to contain exploits. Makes we wonder how many applications on Windows and MacOS actually support the system sandbox.

Thats true. Without sandbox this would have been much worse. Sandboxes are good speed bumps.

Re: Zero click vulnerability in Apple’s macOS Mail

#229

Post by saagarjha »

llarsson wrote: post #216
cortesoft wrote: post #168

Earlier quoted context omitted.

How would price discovery work to "correctly price bugs" What is a bugs correct price? The price that a bad actor would pay for it?

We have CVSS scores for grading vulnerabilities. So that could be useful as a start.

CVSS is pretty useless for categorizing severity.

Re: Zero click vulnerability in Apple’s macOS Mail

#230

Post by viktorcode »

fortran77 wrote: post #92

How does Apple claim they're "secure by design?" [1] They seem to have the same issues as everyone else. [1] https://www.apple.com/business/docs/site/AAW_Platform_Securi...

The claim is not "there's no exploitable bugs". Secure by design usually means that certain mechanisms are present in the system that mitigate security issues. Sandbox is one of them.
Post reply on HN