4 ms·

Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bu

by akerl_ 8y ago

Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person. Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.

giancarlostoro 8y ago
> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
- akerl_ 8y ago
  I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
  - deleted 8y ago
    [deleted]
  - nkozyra 8y ago
    > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception. That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar. edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.
    - akerl_ 8y ago
      https://www.zdnet.com/article/ios-mac-flaw-exposes-your-password-with-one-image-file/ https://www.zdnet.com/article/ios-mac-flaw-exposes-your-pass... Where sending somebody a .tiff file via iMessage, web page, or email would give the attacker RCE on the device.
      - saagarjha 8y ago
        The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.
        akerl_ 8y ago
        The ask from the comment I’m responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I’d say it’s clearly comparable.
      - nkozyra 8y ago
        Unless I'm missing something this was patched before it was publicly announced. I also don't think it had the impact you're suggesting, nor would it be as immediately palatable as a privacy issue to the layperson.
  - giancarlostoro 8y ago
    > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? That reads much clearer, you're right, I misunderstood what you meant. I think it depends, PSN isn't as personal as someone's potential unsolicited nudes being extracted by total strangers. If enough bad press came of it, it wouldn't be the same ballpark. I certainly hope nothing horrible comes of it.
manigandham 8y ago
Surely you understand that different bugs create vastly different problems? Audio and video leaking without knowledge from such a personal device that people take with them everywhere is about as bad as it gets in terms of privacy breach.
- danso 8y ago
  It’s also the kind of bug and impact that is very easy for the layperson to understand, even without sensationalist write ups.
deleted 8y ago
[deleted]
paxys 8y ago
Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.
- akerl_ 8y ago
  Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?
  - freehunter 8y ago
    As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer. The sad fact is consumers don't care one bit. The only people who care are people who have some interest in disliking the company who was breached, in which case they're likely not paying customers anyway.
    - Chris_Chambers 8y ago
      Caring about an issue isn’t the same as having the power to do anything about it.

by akerl_ 8y ago

giancarlostoro 8y ago

> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!

akerl_ 8y ago
I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
- deleted 8y ago
  [deleted]
- nkozyra 8y ago
  > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception. That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar. edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.
  - akerl_ 8y ago
    https://www.zdnet.com/article/ios-mac-flaw-exposes-your-password-with-one-image-file/ https://www.zdnet.com/article/ios-mac-flaw-exposes-your-pass... Where sending somebody a .tiff file via iMessage, web page, or email would give the attacker RCE on the device.
    - saagarjha 8y ago
      The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.
      - akerl_ 8y ago
        The ask from the comment I’m responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I’d say it’s clearly comparable.
    - nkozyra 8y ago
      Unless I'm missing something this was patched before it was publicly announced. I also don't think it had the impact you're suggesting, nor would it be as immediately palatable as a privacy issue to the layperson.
- giancarlostoro 8y ago
  > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? That reads much clearer, you're right, I misunderstood what you meant. I think it depends, PSN isn't as personal as someone's potential unsolicited nudes being extracted by total strangers. If enough bad press came of it, it wouldn't be the same ballpark. I certainly hope nothing horrible comes of it.

manigandham 8y ago

Surely you understand that different bugs create vastly different problems? Audio and video leaking without knowledge from such a personal device that people take with them everywhere is about as bad as it gets in terms of privacy breach.

danso 8y ago
It’s also the kind of bug and impact that is very easy for the layperson to understand, even without sensationalist write ups.

deleted 8y ago

[deleted]

paxys 8y ago

Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.

akerl_ 8y ago
Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?
- freehunter 8y ago
  As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer. The sad fact is consumers don't care one bit. The only people who care are people who have some interest in disliking the company who was breached, in which case they're likely not paying customers anyway.
  - Chris_Chambers 8y ago
    Caring about an issue isn’t the same as having the power to do anything about it.