5 ms·
> Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" That's a major problem!
by danielvf 10y ago
> Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip"
That's a major problem!
- RKearney 10y agoAnd yet Apple requires you to download this update over Wi-Fi to receive it OTA. Sure you could update via a computer, but that seems to go against Apple's vision of not requiring tethering your device to a computer every time you need to update/sync/setup.
- digi_owl 10y agoFunny how that goes, as back when the iPod was new the idea at Apple was of the Mac to be the heart of a ecosystem.
- eanzenberg 10y agoSorry for further derailment but imo: Apple sees devices as portals to the same content. Whether you currently have an iphone in your hand, a mac, the watch, an ipad, whatever, Apple sees them as interchangeable to do the work you need. So while I may be using an iphone/watch on the bus ride home, when I'm home I can grab my ipad and try to seamlessly switch what I was focused on to it. The try is the hard part that I think they are focused on and will continue to decrease friction in the future.
- euyyn 10y agoWhat you're talking about is a recent development, and your parent is talking about the past.
- JustSomeNobody 10y agoThat's a rather loose definition of requires.
- evilduck 10y agoWhat do you propose then? Typing in the patch?
- 0x0 10y agoAllowing downloads of OS updates less than 100MB over 3G/4G, just like regular apps? The 10.3.0->10.3.1 patch is ~20MB. My phone downloads multiple ~100MB app updates daily over cellular. Refusing cellular iOS updates that are smaller than one of those apps is getting pretty silly these days.
- mikeash 10y agoAre you really using 10GB of cellular data each month just for app updates? Isn't that expensive?
- RKearney 10y agoWhy[0] would[1] it[2] be[3]? [0] https://www.verizonwireless.com/plans/verizon-plan/ https://www.verizonwireless.com/plans/verizon-plan/ [1] https://www.att.com/plans/unlimited-data-plans.html https://www.att.com/plans/unlimited-data-plans.html [2] https://www.t-mobile.com/cell-phone-plans https://www.t-mobile.com/cell-phone-plans [3] https://www.sprint.com/landings/unlimited-cell-phone-plans/ https://www.sprint.com/landings/unlimited-cell-phone-plans/
- PhantomGremlin 10y agoThe only thing "unlimited" about all 4 of those plans are the weasel words. Verizon: After 22 GB/line/mo, we may prioritize your data behind other Verizon customers during network congestion. ATT: After 22GB of data usage, AT&T may slow speeds T-Mobile: On all T-Mobile plans, if congested, top 3% of data users (>30GB/mo.) may notice reduced speeds due to prioritization Sprint: Data deprioritization during congestion after 23GB/mo.
- mikeash 10y agoThose plans are pretty expensive.
- djrogers 10y agoSo by 'requires' you mean offers it as one possible option? Your post already mentions the most obvious alternative - update via iTunes, and you can also use the lightning-USB adapter and a USB NIC. I'm not sure I really understand the purpose of your post here, unless it was to incite some sort of ire from Apple haters?
- devy 10y agoHonest question, is "execute arbitrary code on the Wi-Fi chip" the same as execute arbitrary code on the SoC (e.g. A10) chip?
- mikeash 10y agoIt's not identical. The WiFi chip has its own processor running its own code, and that's what the exploit affects. It may be possible, even trivial, to leverage that into running arbitrary code on the main CPU, depending on how the stuff is designed. If the WiFi chip has unrestricted access to RAM then that would be it. If not, it's likely that the OS drivers for the chip aren't hardened against malicious input from the WiFi chip and could be exploited.
- devy 10y ago> If the WiFi chip has unrestricted access to RAM Is this the Wi-Fi chip's own internal memory? Or iPhone's main RAM in SoC?
- delinka 10y agoI'sure mikeash means main RAM, not the wifi internal memory. Given DMA to systm RAM, your device is rooted. Given access to wifi chip's RAM, rooting is probably much harder (but still not impossible.)
- acdha 10y agoApple's been shipping hardware DMA restrictions on Macs for awhile - that first appeared on the security radar in the FireWire era – so it's not inconceivable that it's not as simple as getting DMA access but https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf seems to be silent on that unless I'm missing something.
- mikeash 10y agoIOMMUs are important for external interfaces, but much less so for internal hardware. It's certainly possible that they're doing it here, but I wouldn't bet on it.