Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

41–50 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#41

Post by whoknowswhat11 »

aetherspawn wrote: post #15

If your annual revenue is above $100M, you should be held accountable to a strict version of GPDR enforced by an ombudsman, that requires you to patch all data leaking vulnerabilities within 90 days, or pay out everyone who bought your product. I just updated to iOS 15 and it now tells you which sites you have been compromised on, or had your passwords/info compromised on. To be clear, I use a password manager with a…

God, I would HATE if the US follows the EU with this craziness. I'm already sick of the cookie popups, now layer on the GDPR insanity and we will definitely lose the privacy fight to users who will be sick of this nonsense as well.

I've seen studies that show crap like GDPR (which makes basically all normal interaction cumbersome) has like 10% of folks clicking around to "opt-out" while 90% can't be bothered. And of course, you COULD just clear your own cookies.

There is no more real security in the EU. Your mental health records will be leaked there. The EU will spy on you like crazy. And more.

Re: Disclosure of three 0-day iOS vulnerabilities

#43

Post by pvg »

58x14 wrote: post #26
hsbauauvhabzb wrote: post #8

Earlier quoted context omitted.

If these are gargantuan, how would you describe a remote zero click complete device compromise (complete with camera/microphone access)? What about an exploit that can cause the users phone to explode?

I would be an order of magnitude less concerned with camera/mic access, compared to perfect historical proof of my usage and communication patterns. Exploits often feel like pathogens, probably why they share the term virus. If a virus has a high mortality rate, contagion is lower, because it frequently kills the host before it can spread. Similarly, I think a 'complete device compromise' is much more likely to be id…

It's hardly 'perfect historical proof', not to diminish the seriousness of the vulnerability. But more importantly, the mechanism matters a great deal. This particular vulnerability requires the install of a malicious app, a much higher bar than a 'drive by' exploitation. This leaves a trace and exposes the attacker to consequences. No (statistically speaking) app producer with any interest in continuing to use the platform would deploy such an exploit even if they had access to it.

Re: Disclosure of three 0-day iOS vulnerabilities

#44

Post by arvindamirtaa »

whoknowswhat11 wrote: post #41
aetherspawn wrote: post #15

If your annual revenue is above $100M, you should be held accountable to a strict version of GPDR enforced by an ombudsman, that requires you to patch all data leaking vulnerabilities within 90 days, or pay out everyone who bought your product. I just updated to iOS 15 and it now tells you which sites you have been compromised on, or had your passwords/info compromised on. To be clear, I use a password manager with a…

God, I would HATE if the US follows the EU with this craziness. I'm already sick of the cookie popups, now layer on the GDPR insanity and we will definitely lose the privacy fight to users who will be sick of this nonsense as well. I've seen studies that show crap like GDPR (which makes basically all normal interaction cumbersome) has like 10% of folks clicking around to "opt-out" while 90% can't be bothered. And of…

Is there a point to this...? Or did you just want to crap on GDPR?

Not saying it's good or bad. But just...relevance?

Re: Disclosure of three 0-day iOS vulnerabilities

#45

Post by alphabettsy »

H8crilA wrote: post #38
alphabettsy wrote: post #32

Maybe it's just me, but these aren't what I think of when I hear 0-day. These are serious, but I was guessing remote code execution or sandbox escape. It seems like we're talking about bypassing privacy controls though. That said, Apple needs to take this much more seriously. They created the program reluctantly and it shows.

FYI, 0-day just means "first time made public".

Completely aware of that. Just a weird perception thing for me.

Re: Disclosure of three 0-day iOS vulnerabilities

#46

Post by babesh »

jonahx wrote: post #42

Are there any partial mitigations you can take until these are patched?

Don’t update your apps till after Apple releases a patch. The first two are API calls that apps can make.

An exploit wishing to exploit these vulnerabilities has to be coded to make these calls. Most apps don’t dynamically construct arbitrary API calls. In fact, you can’t do that in Swift AFAIK. You have to drop to Objective-C or C to do that.

So most apps need to be updated to exploit the vulnerability. The only exceptions would be apps that are intentionally constructed to call arbitrary APIs or at least with arbitrary parameters. The first would be a violation of developer agreements but that hasn’t stopped people in the past. Also, these aren’t even private APIs. These are public APIs that got exploited due to not properly checking parameters/entitlements.

I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps.

Re: Disclosure of three 0-day iOS vulnerabilities

#47

Post by cmeacham98 »

whoknowswhat11 wrote: post #41
aetherspawn wrote: post #15

If your annual revenue is above $100M, you should be held accountable to a strict version of GPDR enforced by an ombudsman, that requires you to patch all data leaking vulnerabilities within 90 days, or pay out everyone who bought your product. I just updated to iOS 15 and it now tells you which sites you have been compromised on, or had your passwords/info compromised on. To be clear, I use a password manager with a…

God, I would HATE if the US follows the EU with this craziness. I'm already sick of the cookie popups, now layer on the GDPR insanity and we will definitely lose the privacy fight to users who will be sick of this nonsense as well. I've seen studies that show crap like GDPR (which makes basically all normal interaction cumbersome) has like 10% of folks clicking around to "opt-out" while 90% can't be bothered. And of…

GDPR cookie consent banners that make it more difficult to opt out than opt in are illegal, and only continue to exist because the GDPR is poorly and inconsistently enforced.

Re: Disclosure of three 0-day iOS vulnerabilities

#48

Post by alphabettsy »

gzer0 wrote: post #39
alphabettsy wrote: post #32

Maybe it's just me, but these aren't what I think of when I hear 0-day. These are serious, but I was guessing remote code execution or sandbox escape. It seems like we're talking about bypassing privacy controls though. That said, Apple needs to take this much more seriously. They created the program reluctantly and it shows.

From an earlier post: This is a boat load of mission critical data. - all contacts, including 3rd party messaging apps, with metadata (interactions, timestamps, other stats) - full address book - whether any app is installed - SSID of connected wifi - medical info - device usage - screen time - device accessories

I must have missed the medical info.

I guess I don't consider contacts mission-critical though I definitely would not want them exposed and generally don't give apps access to them.

Re: Disclosure of three 0-day iOS vulnerabilities

#49

Post by snuser »

sam0x17 wrote: post #22
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

Bug bounty programs are the antithesis of Apple's internal methodology, culture, and way of doing business. They keep everything close to the chest, they shun "outsiders", etc.. The idea that someone outside of Apple, from the unwashed masses, could find a flaw in Apple's own software is a pretty big pill for them to swallow. Thus it doesn't surprise me there are problems with their bug bounty program. I think if the…

that's just dumb, like third parties do all the work and contact you about critical bugs the only effort on Apple's part of verification and some coordination which shouldn't be a huge issue for a company the size of apple.. just hire a team to do it and be done with it the whole 'secrecy culture' is a bunch of hogwash
Post reply on HN