Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Psychic Paper: iOS Sandbox Escape

siguza.github.io

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Psychic Paper: iOS Sandbox Escape

#51

Post by saagarjha »

Twisell wrote: post #50

I'm not in the security community and as an end user there seems to be two lesson there: -Apple should provide better audit tool so that security consultants don't need to rely on unpublished 0day exploits to find other exploits -As an exposed user I really don't thank grey hat People that refrain from publishing 0day exploit for two frigging years for personal gain...

Apple said that they’d make research devices available to select people, but as far as I can tell nobody seems to have gotten one. (Not to mention that such a policy, even if it actually handed out devices, is fairly exclusionary.)

Re: Psychic Paper: iOS Sandbox Escape

#52

Post by pjmlp »

TwoBit wrote: post #31
tomphoolery wrote: post #30

> I just hate GUIs for development, especially when you Google how to do something, and the answer is a series of 17 “click here and there”s that are no longer valid because all the GUI stuff moved somewhere else in the last update. It's not just developer tools that suffer from this problem. I opened iMovie recently after not playing with it for almost 10 years, and was so flabbergasted at how everything worked. Too…

I'm convinced that the reason for the constant game of GUI musical chairs - of which Microsoft is the most guilty - is due to developers attempting to justify their employment.

Cycles are quite common in IT fashion industry, Microsoft isn't the only one playing the game, others are much worse.

Try to compare the Android best practices across all IOs since Android exists.

Re: Psychic Paper: iOS Sandbox Escape

#54

Post by ancarda »

Negitivefrags wrote: post #13

This reminds me a lot of one of the original ways to run unsigned code on the Sony PSP. If you made two directories: SomeApp SomeApp% And then launch the folder with the % sign then the code that checks for valid signatures will check in the directory without the %, but the code that actually launches the binary will still run the code in the directory with the %. So all you need to do is get any binary with a valid…

Why did this happen? Was "%" significant in some way? i.e. maybe it was passing the path to sprintf?

Re: Psychic Paper: iOS Sandbox Escape

#55

Post by loeg »

qubex wrote: post #10
0x8BADF00D wrote: post #5

Earlier quoted context omitted.

Problem is legacy software tends to use XML. iOS can be considered legacy at this point. Plists are prevalent at every level of iOS.

As somebody who was already a high school student deeply ‘into’ computer technology at the time, I perfectly remember the hype and release of XML. IOS was released last week by mental accounting standards. To hear both be branded as ‘legacy’ is, frankly... well, it makes me feel ancient.

You shouldn't feel too ancient, as the label is grossly misused by GP in characterizing iOS and XML :-).

Re: Psychic Paper: iOS Sandbox Escape

#58

Post by httgp »

saurik wrote: post #41

A while back I filed a bug on libplist with some examples of the hilarious this-is-not-XML issues in Apple's userland plist parser, which people might find fun here as it is highly related to this issue. https://github.com/libimobiledevice/libplist/issues/83

Jay, I just wanted to say thanks to all the groundbreaking work you’ve done in the jailbreaking scene. Ages ago I had an iPad Touch and I had so much fun jailbreaking it and playing around with Cydia tweaks.

Re: Psychic Paper: iOS Sandbox Escape

#59

Post by Negitivefrags »

ancarda wrote: post #54
Negitivefrags wrote: post #13

This reminds me a lot of one of the original ways to run unsigned code on the Sony PSP. If you made two directories: SomeApp SomeApp% And then launch the folder with the % sign then the code that checks for valid signatures will check in the directory without the %, but the code that actually launches the binary will still run the code in the directory with the %. So all you need to do is get any binary with a valid…

Why did this happen? Was "%" significant in some way? i.e. maybe it was passing the path to sprintf?

Yep, that’s exactly it. And of course a lesson on why you need to understand the progeny of any string you pass as a format argument.

Re: Psychic Paper: iOS Sandbox Escape

#60

Post by fit2rule »

TwoBit wrote: post #31
tomphoolery wrote: post #30

> I just hate GUIs for development, especially when you Google how to do something, and the answer is a series of 17 “click here and there”s that are no longer valid because all the GUI stuff moved somewhere else in the last update. It's not just developer tools that suffer from this problem. I opened iMovie recently after not playing with it for almost 10 years, and was so flabbergasted at how everything worked. Too…

I'm convinced that the reason for the constant game of GUI musical chairs - of which Microsoft is the most guilty - is due to developers attempting to justify their employment.

You're right that developers do this, but in this case I would say its because the designers have to justify their existence. as a class of developer.

An interface which lasts generations because its good is not the same, necessarily, as this years hot new ideology among the design elite.

Post reply on HN