4 ms·

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publicly. I've had this for months, and I did not intend on disclosing at all. Proof of my "for months" assertion: https://www.youtube.com/watch?v=8arPid8GtFk https://www.youtube.com/watch?v=8arPid8GtFk > As a bare minimum Apple needs a few hours to analyze the bug Again, for the record: Apple has full details of the underlying bug. They won't even need to check my github at all.

scintill76 11y ago
The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?
- qwertyoruiop 11y ago
  iOS is vulnerable too as far as the vulnerability is concerned. It is not directly exploitable on iOS, however having a NULL task_t still does give you some abilities, even if not (directly?) SVC code exec.
MagerValp 11y ago
That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.
- qwertyoruiop 11y ago
  I have asked on Twitter if anyone could sign it for me. For some reason neither of the two people who tried to do so were able to sign it. No idea why. kexts were signed but they kept getting rejected for some reason.
  - MagerValp 11y ago
    You need a developer ID with kext signing ability, not a regular developer ID: https://www.google.com/search?num=30&q=site%3Adeveloper.apple.com+kext+signing+certificate https://www.google.com/search?num=30&q=site%3Adeveloper.appl...

scintill76 11y ago

The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?

qwertyoruiop 11y ago
iOS is vulnerable too as far as the vulnerability is concerned. It is not directly exploitable on iOS, however having a NULL task_t still does give you some abilities, even if not (directly?) SVC code exec.

MagerValp 11y ago

That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.

qwertyoruiop 11y ago
I have asked on Twitter if anyone could sign it for me. For some reason neither of the two people who tried to do so were able to sign it. No idea why. kexts were signed but they kept getting rejected for some reason.
- MagerValp 11y ago
  You need a developer ID with kext signing ability, not a regular developer ID: https://www.google.com/search?num=30&q=site%3Adeveloper.apple.com+kext+signing+certificate https://www.google.com/search?num=30&q=site%3Adeveloper.appl...