Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disclosure of three 0-day iOS vulnerabilities

habr.com

Post reply on HN
Print view View original

71–80 of 464 posts

Re: Disclosure of three 0-day iOS vulnerabilities

#71

Post by hsbauauvhabzb »

pvg wrote: post #43
58x14 wrote: post #26

Earlier quoted context omitted.

I would be an order of magnitude less concerned with camera/mic access, compared to perfect historical proof of my usage and communication patterns. Exploits often feel like pathogens, probably why they share the term virus. If a virus has a high mortality rate, contagion is lower, because it frequently kills the host before it can spread. Similarly, I think a 'complete device compromise' is much more likely to be id…

It's hardly 'perfect historical proof', not to diminish the seriousness of the vulnerability. But more importantly, the mechanism matters a great deal. This particular vulnerability requires the install of a malicious app, a much higher bar than a 'drive by' exploitation. This leaves a trace and exposes the attacker to consequences. No (statistically speaking) app producer with any interest in continuing to use the p…

I’ve always been curious how many developers might drop this in their code but only activate against potentially valuable targets

Re: Disclosure of three 0-day iOS vulnerabilities

#72

Post by cjbprime »

tinus_hn wrote: post #62
H8crilA wrote: post #38

Earlier quoted context omitted.

FYI, 0-day just means "first time made public".

It means a vulnerability is made public while there is no patch available. As opposed to releasing the information a number of days after the patch was released.

It doesn't even really mean that anymore. From the blog post here:

> I've reported four 0-day vulnerabilities this year

They're just using 0-day to mean "a new vulnerability finding disclosed to the vendor privately", which is becoming the new definition of the term.

Re: Disclosure of three 0-day iOS vulnerabilities

#73

Post by bnjemian »

hsbauauvhabzb wrote: post #24
sam0x17 wrote: post #19

Earlier quoted context omitted.

You can do a lot more damage with someone's bank account than you can by exploding their phone.

Won’t matter much if it burns your house down while you’re inside. A complete compromise can also get access to your bank, mail accounts, message history, mic and camera. Which vulnerability would you prefer be used against you?

I'd marry mic access, F#$% camera access, and kill bank access. Maybe that's just a personal opinion, though.

Re: Disclosure of three 0-day iOS vulnerabilities

#74

Post by hungryforcodes »

JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

You know, I'd love to think that the problem is cyber security is hard -- which it IS -- but I'm starting to get the feeling that the actual problem is that Apple doesn't care about this kind of stuff. So many incredible vulnerabilities going back generations of iPhones and iOS...the zero click iMessages one floored me.

Re: Disclosure of three 0-day iOS vulnerabilities

#75

Post by robterrell »

asteroidbelt wrote: post #59
MrGando wrote: post #35

Obscure ad-tech companies would love to get those installed apps like they were aggressively doing (Facebook & Twitter too) about 5 years ago.

Facebook and Twitter exploited 0-day security vulnerabilities to collect private data? Can show the proof link please?

I believe the poster was referring to the practice of testing if an app was installed by calling [UIApplication canOpenURL:] —- as I recall Twitter was found to check for hundreds of different apps, to feed into their ads and analytics business, and Apple later changed it to only be callable 50 times.

Re: Disclosure of three 0-day iOS vulnerabilities

#76

Post by saagarjha »

sam0x17 wrote: post #19
hsbauauvhabzb wrote: post #8

Earlier quoted context omitted.

If these are gargantuan, how would you describe a remote zero click complete device compromise (complete with camera/microphone access)? What about an exploit that can cause the users phone to explode?

You can do a lot more damage with someone's bank account than you can by exploding their phone.

Depends on where the phone is at the time. Do it while they’re on a call and it’s going to really suck.

Re: Disclosure of three 0-day iOS vulnerabilities

#77

Post by emsy »

JoeOfTexas wrote: post #69

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission. It's the same never-ending war as anti-cheat vs cheat.

The problem is not that cyber-security is hard, but that a trillion dollar company is incapable to handle security disclosures.

Re: Disclosure of three 0-day iOS vulnerabilities

#78

Post by ok123456 »

Bud wrote: post #61
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

It's interesting to me that in this entire thread, nobody is even mentioning or considering the possibility that COVID has impacted Apple's operations. It obviously has. It has affected every tech company. Certainly it has affected mine. Whether this is an example of that, I don't know, of course, but I think it's plausible.

So what? Everyone has been affected. Apple doesn't somehow get a pass at not doing their basic duties.

Sitting at home looking at a monitor and typing is largely the same doing the same thing in an office. They're not service sector workers, doctors, nurses, or truck drivers who actually have had to deal with the impact of this head on.

Re: Disclosure of three 0-day iOS vulnerabilities

#79

Post by saagarjha »

Bud wrote: post #61
thatswrong0 wrote: post #12

Explain I'm naive: why would Apple's bug bounty program be so poorly run? Is it simply a sign of organizational failure? (e.g. perhaps the managers running the program have been promoted to a position that they simply don't belong in, and higher up execs don't care? Or are they prioritizing profit over success?) I would think that, given the profitability and positioning of Apple in the marketplace, that they would b…

It's interesting to me that in this entire thread, nobody is even mentioning or considering the possibility that COVID has impacted Apple's operations. It obviously has. It has affected every tech company. Certainly it has affected mine. Whether this is an example of that, I don't know, of course, but I think it's plausible.

I see no reason COVID has anything to do with Apple’s poor response to external reporters, which has been something that has been a problem for decades.

Re: Disclosure of three 0-day iOS vulnerabilities

#80

Post by saagarjha »

robterrell wrote: post #75
asteroidbelt wrote: post #59

Earlier quoted context omitted.

Facebook and Twitter exploited 0-day security vulnerabilities to collect private data? Can show the proof link please?

I believe the poster was referring to the practice of testing if an app was installed by calling [UIApplication canOpenURL:] —- as I recall Twitter was found to check for hundreds of different apps, to feed into their ads and analytics business, and Apple later changed it to only be callable 50 times.

Nit: for 50 different schemes, not 50 times.
Post reply on HN