4 ms·

This article was criticised the first time on HN. This part is particularly fanciful: >an adversary could find a vulnerability in the LLVM backend to obtain re

This article was criticised the first time on HN. This part is particularly fanciful: >an adversary could find a vulnerability in the LLVM backend to obtain remote code execution on Apple’s Bitcode compilation infrastructure to inject a compiler trojan that would affect every single app on the App Store that was submitted with Bitcode. That seems like a very much "just so" failure scenario. There's no reason to think this would open up a huge, recommend exploitable attack surface. And even if it did, it seems highly unlikely it'd be limited to just apps submitted with Bitcode. Same for the backdoor risk. Thinking suddenly Apple would be a target is silly. There may be good reasons against Bitcode but these security hysterics don't help the argument.

lern_too_spel 10y ago
A compiler provides a very large attack surface. Once an attacker exploits it, they can directly attack bitcode applications without any further exploits. Attacking non-bitcode applications requires exploiting certificate validation as well.
- eridius 10y ago
  One would assume Apple is running the compiler backend in a heavily locked-down container or VM.
  - lern_too_spel 10y ago
    But that sandbox has access to all bitcode apps by necessity. That's the whole point — once the bitcode compiler has been owned, all bitcode apps are immediately vulnerable, while compromising non-bitcode apps requires significantly more additional work.
    - gpderetta 10y ago
      Why would it have access to all apps? It only need access to the app it is currently compiling.
      - lern_too_spel 10y ago
        Depends on how it is implemented. If it is implemented as the GGP described, as a container or VM back end service that compiles multiple apps, that's a problem. That is precisely the type of problem that would only affect bitcode apps that the top post didn't think could exist.
dguido 10y ago
I completely agree. It's fairly simple to isolate and sandbox individual compiler processes in the cloud and fully mitigate this risk. You can be sure that whatever processes the bitcode on Apple's servers is only supposed to touch a very limited number of files, syscalls, etc. If any cloud instance deviates from that norm, it should be trivial to detect that deviation. So, yes, I would probably try and submit malformed bitcode to Apple if I wanted to be a jerk... but I think Apple has probably thought of this too given how incredibly obvious it is.

lern_too_spel 10y ago

A compiler provides a very large attack surface. Once an attacker exploits it, they can directly attack bitcode applications without any further exploits. Attacking non-bitcode applications requires exploiting certificate validation as well.

eridius 10y ago
One would assume Apple is running the compiler backend in a heavily locked-down container or VM.
- lern_too_spel 10y ago
  But that sandbox has access to all bitcode apps by necessity. That's the whole point — once the bitcode compiler has been owned, all bitcode apps are immediately vulnerable, while compromising non-bitcode apps requires significantly more additional work.
  - gpderetta 10y ago
    Why would it have access to all apps? It only need access to the app it is currently compiling.
    - lern_too_spel 10y ago
      Depends on how it is implemented. If it is implemented as the GGP described, as a container or VM back end service that compiles multiple apps, that's a problem. That is precisely the type of problem that would only affect bitcode apps that the top post didn't think could exist.

dguido 10y ago

I completely agree. It's fairly simple to isolate and sandbox individual compiler processes in the cloud and fully mitigate this risk. You can be sure that whatever processes the bitcode on Apple's servers is only supposed to touch a very limited number of files, syscalls, etc. If any cloud instance deviates from that norm, it should be trivial to detect that deviation. So, yes, I would probably try and submit malformed bitcode to Apple if I wanted to be a jerk... but I think Apple has probably thought of this too given how incredibly obvious it is.