4 ms·
You say Apple's security isn't sufficient. It certainly appears that as time goes on Apple's security is pretty sufficient for most users. We're talking about e
by eridius 10y ago
You say Apple's security isn't sufficient. It certainly appears that as time goes on Apple's security is pretty sufficient for most users. We're talking about exploits worth 1+ million dollars being used in a targeted attack against a single individual (or, more likely, a relatively small number of targeted individuals over time). This isn't something that the overwhelming majority of users need to be concerned about. Obviously it would be great if Apple's security was so good that not even nation states could get past it, but that's an incredibly high bar.
- toufka 10y agoI don't think the bar is just nation-states. The bar also includes those with any of the following: - $1M Cash - skilled working knowledge of Apple's software and hardware - fast reflexes to quickly react and apply a newly-public exploit derived from any of the above Together, the number of world-wide actors who fall into one of those categories is actually fairly large. Those all have the capability to have total 'access' to my device. Given the value (to me) and the amount of data on that device, that's a huge hole, even for the majority of people. Further, with these networked exploits, the distinction between having one individual targeted, and all individuals running that OS is actually fairly slight. It wouldn't take that much more work to spam a well-designed exploit against an entire class of (normal) users.
- afarrell 10y agoThey also require a few other things: - a single person or committee with the authority to sign off on $1 million for this sort of thing. - a willingness to risk the legal and PR consequences of being discovered. Which cuts out a lot of potential corporate espionage
- vfclists 10y agoThis presumes that the exploits can only be found by companies with deep pockets, which are probably deep only because they are willing to sell them. What if there are equally good teams who are not in it for the money?
- afarrell 10y agoWhy would a corporation maintain an espionage team for any other reason?
- cpach 10y agoI don’t know about you, but there are probably zero persons who would pay $1000000 to gain access to the contents of my phone.
- nso 10y agoJust as an aside; The 1M USD exploit was a bug bounty/publicity stunt. While that also was a chain exploit, that doesn't automatically mean this is a "1M USD" exploit, like everyone is claiming. Or am I missing something?
- belorn 10y agoI think its a bit naive to believe that a 1+ million worth exploit will remain a secret until the patch is shipped, at which point it is worth exactly nothing. There are so many way that the exploit will trickle down to more people until reach mass use. To mention a few ways: The buyer might want to recover the purchasing price by reselling. If its a government agency, they might want to establish credential with future sellers. Reverse engineers have a 1+ million dollars incentive, and they have a much smaller window to sell it before it becomes worthless. Its like piracy. First its the group with so called FTP access. During that period of time, maybe a release is worth X amount of dollars, but whats the chance that it remains there and never reach a mass audience?
- eridius 10y agoI'm not sure what you mean. In this case the exploit did remain a secret until such time as a targeted individual was paranoid enough to send the link to an investigative team instead of clicking on it (and this is what resulted in the patch), or in other words, nobody else besides the attackers, the victim, the investigative team, and Apple knew about the exploit until the patch shipped.