Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

i.blackhat.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#41

Post by gerdesj »

wycy wrote: post #10
gerdesj wrote: post #7

Great write up and very well presented. All in all a bit disturbing but that's what you should get from Blackhat. "Started macOS/iOS security from the second half of 2019"[!]

What’s disturbing about it? I didn’t understand the slides or the implications thereof well enough to actually figure that out.

A bright lad with a few years experience finds a way around the mitigations for a flaw found in the previous version. Bear in mind Apple is a $T1 organisation and he ... isn't.

Not only does he perform a rather well polished dance but he writes it up in an entertaining and well presented way. I suspect english is a second language too which makes the whole thing even more impressive.

Just to reiterate: he waltzes around a key aspect of the security in iOS 14 - that is disturbing to me. If he can do that, what do you think a well funded nation state bunch of noddies gets up to?

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#42

Post by TechBro8615 »

crazygringo wrote: post #30
iJohnDoe wrote: post #15

Earlier quoted context omitted.

Agreed. PDFs are still considered very unsafe from unknown sources. Always be cautious. They are constantly used in phishing attacks.

All phishing attacks require you to click on a link embedded in the PDF, right? On the one hand, you'd think anyone technologically savvy wouldn't do that. On the other hand, accidentally clicking on links in PDF's is the bane of my existence. I constantly consume academic books and papers as PDF's on my iPad in the built-in Books app, tap somewhere with my Apple Pencil for any number of reasons (to pan, to zoom, to…

“Our users were getting exploited in our PDF viewer, so we added a stack”

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#43

Post by solarkraft »

Here’s a thing about jailbreaking.

As a user I like my device being safe from outside attackers (NSO & co).

But I definitely do not want my device to be protected against me. It’s absurd that I have to use the methods of an attacker to gain modification privileges on a device I own.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#44

Post by dijit »

lostlogin wrote: post #32
fortran77 wrote: post #27

When will start seeing laws making it illegal to disable the scanning for hashes?

I’m all ignorance on this subject - what would making scanning illegal prevent?

Other way around.

If you root your phone and disable its ability to spy on you then that’s obviously against the desired effect. The whole point of the hash scanning is that, you, the user, cannot disable it.

Meaning there would probably be laws to force us not to tamper with that functionality.

Similar to how printer manufacturers have to look for “the yellow dots” on bank notes and refuse to print/scan.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#45

Post by solarkraft »

lostlogin wrote: post #32
fortran77 wrote: post #27

When will start seeing laws making it illegal to disable the scanning for hashes?

I’m all ignorance on this subject - what would making scanning illegal prevent?

It’s about evading the forbidden images scanning, which becomes possible when you can modify the software you’re running.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#46

Post by techrat »

solarkraft wrote: post #43

Here’s a thing about jailbreaking. As a user I like my device being safe from outside attackers (NSO & co). But I definitely do not want my device to be protected against me . It’s absurd that I have to use the methods of an attacker to gain modification privileges on a device I own.

That's why Apple needs to unclench and give up its need for absolute control and just allow bootloader unlocking. Users who modify will always want to be able to modify and the only way to have that and have security as well is to allow specific ways for it to be done... not to force modders to rely on exploits.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#47

Post by pshc »

saurik wrote: post #38

The fact that Apple clearly cares a lot about software security from at least two angles--both securing the device for the user from external attackers (I know they truly care about this, even though they frankly seem to focus only on users in the west and have been known to throw people from the east under the bus without a fight: see their attempt to downplay Google Project Zero's critical discoveries a few years a…

Hello fellow poster! Line breaks would be lovely for comprehension's sake.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#48

Post by nitrogen »

smnrchrds wrote: post #35
niea_11 wrote: post #34

Earlier quoted context omitted.

It's a comment from a correspondence between Donald E. Knuth and Peter van Emde Boas (meant as a joke I think). You can find it in this pdf at the end of the 7th page : https://staff.fnwi.uva.nl/p.vanemdeboas/knuthnote.pdf Knuth mentions it in his FAQ (at the end) : https://www-cs-faculty.stanford.edu/~knuth/faq.html

I got that part. The part I don't understand is this: what does it mean for a program to be proven correct but still not work?

In addition to the sibling answers, one could have verified an algorithm mathematically, but made a typo in the code.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#49

Post by vbezhenar »

solarkraft wrote: post #45
lostlogin wrote: post #32

Earlier quoted context omitted.

I’m all ignorance on this subject - what would making scanning illegal prevent?

It’s about evading the forbidden images scanning, which becomes possible when you can modify the software you’re running.

If scanning works on filesystem-level, just storing images in any non-standard format would be enough, you don't need root for that. Most likely even storing images in an sqlite would make them inaccessible for those scanners. Trying to force all apps in the world to use some scanning API for their images is unrealistic. Also you can use web apps with some website hosted in a free country with canvas drawing.

They'll just use mass-bombing by targeting most popular apps and services and that's about it. It's unrealistic to expect 100% solution, because 99% solution will be good enough.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#50

Post by vitus »

gerdesj wrote: post #41
wycy wrote: post #10

Earlier quoted context omitted.

What’s disturbing about it? I didn’t understand the slides or the implications thereof well enough to actually figure that out.

A bright lad with a few years experience finds a way around the mitigations for a flaw found in the previous version. Bear in mind Apple is a $T1 organisation and he ... isn't. Not only does he perform a rather well polished dance but he writes it up in an entertaining and well presented way. I suspect english is a second language too which makes the whole thing even more impressive. Just to reiterate: he waltzes aro…

> A bright lad with a few years experience

A few years experience specifically working with iOS. That doesn't say anything about how much existing experience he has in the security space.

Here's a Java critical patch update from 2017 that references someone of the same name (probably him):

https://www.oracle.com/security-alerts/cpujul2017.html

Post reply on HN