24 ms·
Google reveals fistful of flaws in Apple's iMessage app
- goldrake 7y agoMeanwhile google keyboard collects everything you type and android collects everything you say. Who needs bugs..
- jeffrallen 7y agoA fish, a barrel, and a smoking gun.
- sambroner 7y agoHard to tell what’s really going on here from this article. Although it seems like five vulnerabilities were fixed and one remains (and google is being unusually patient about the sixth issue) One thing I’ve always struggled with is the strategy of these white hat teams. I’m sure Google Zero spends a lot of time on Apple because Apple is an enormous company, large partner, and competitor in some spaces. So now I wonder: does the release of vulnerabilities ever get effected by business agenda? I assume it has to, although I’m not sure of the agenda here. In this case, iMessage is in direct competition with a Google sms protocol (although googles hasn’t gained much traction). Maybe the vuln is less impressive than saying, “there’s one more”?
- dmix 7y agoThese guys are the best experts in the world and Apple is getting free work done. Who cares if Apple is angry, Google made their software slightly safer and probably put the iMessage dev team on their toes (as they should be).
- soup10 7y agoif they are so good why was gmail completely compromised without their knowledge
- angulardementia 7y agoWhen was this?
- soup10 7y agoSnowden leaks confirmed that gmail was compromised under PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) They now claim its secure again because they are encrypting internal traffic. It's such a high priority and centralized target with so much valuable intelligence that any such claims have to be taken with a grain of salt.
- CobrastanJorji 7y agoPRISM was the one with FISA warrants, where the government lawfully acquired data from Google via formal processes. MUSCULAR was the the one where the NSA tapped Google's inter-datacenter fiber lines in order to spy on their internal traffic. https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- soup10 7y agonaturally its hard to keep track of all their cute code names, at the end of the day all the data ends up queryable by analysts with nothing resembling a warrant process
- kps 7y agoProject Zero, as evident from their bug tracker¹, is a Chrome security effort. It looks at everything in the browsing stack — Chrome, libraries, plugins, OS, processors, proxies — presumably because security can be broken anywhere in the chain. ¹ https://bugs.chromium.org/p/project-zero/issues/list?can=1 https://bugs.chromium.org/p/project-zero/issues/list?can=1
- pjmlp 7y agoAnd they keep collecting exploits thanks to memory corruption bugs.
- samstave 7y agoHow did you make the little ‘1’ ? ^1
- saagarjha 7y agoChrome doesn’t run on iOS. They’re doing this because they want to, not because it would somehow make Chrome more secure.
- richardwhiuk 7y agoThere is a Google Chrome for iOS - though it doesn't use the rendering engine.
- ajross 7y agoiMessage is better software now than it was before this disclosure. I don't think that logic really works. If Google wanted to be evil and damage Apple, they would have leaked the vulnerabilities to the press and not bothered to work with them for a fix. If they wanted to be really evil, they could have leaked them to black hats first and waited for a real zero day before talking to the press. Instead, they worked together to fix the bugs. This is exactly what we want, there is no better resolution.
- mey 7y agoInteresting that there isn't a post on Project Zero's blog. That's typically how they do public notification.
- ehsankia 7y agoI definitely would've preferred that to the BBC article. ZDNet seems to be the better / primary source on most other articles: https://www.zdnet.com/article/google-researchers-disclose-vulnerabilities-for-interactionless-ios-attacks/ https://www.zdnet.com/article/google-researchers-disclose-vu...
- sigmar 7y ago>We are withholding CVE-2019-8641 until its deadline because the fix in the advisory did not resolve the vulnerability Wonder how this happened? rushed patch or perhaps they only tested against a submitted PoC? Only a week left until the defcon talk. Still listed as "fixed" in Apple's release here: https://support.apple.com/en-us/HT210346 https://support.apple.com/en-us/HT210346
- mzkply 7y agoPerhaps it was a bad fix.
- ajross 7y agoFixes can have bugs too, there's nothing odd about that. Maybe there was an edge case the developers didn't understand from the report, etc...
- foobiekr 7y agoSometimes it’s basically that the person in charge of fixing it didn’t. A year ago one of the fixes for a widespread remote execution flaw was to see if the user agent was curl.
- d2mw 7y agoProject Zero has always been disguised marketing, and IMHO an extremely nasty form of it. I have no doubt they plan coordinated releases like this on a regular basis (these downvotes are confusing. Do you disagree that it is marketing? That their approach is brutal? That they plan this regularly?)
- cameronbrown 7y agoSo what. I don't personally care if a company's marketing is affected - we as consumers have the right to know if iMessage or other protocols aren't secure. This is in the public interest and I'm glad Google's doing this. Apple can start their own Project Zero investigating Android if they want.
- zerocrates 7y agoWhat's nasty about what they're doing here?
- d2mw 7y agoThey pay a team to embarrass competitors. The technical aspect is a small part of what is happening here.
- grenoire 7y agoCompetitors should be embarrassed when it concerns security flaws. It's one of the best ways to generate media buzz and inform customers about the flaws, and also their consequences.
- angulardementia 7y agoSo you don't view this as Apple getting free whitehat testing and a chance to not get hacked? I think there are two viewpoints you could take here and I think the truth is directly in the middle.
- ChrisSD 7y agoI wish my competitors "embarrassed" me by helping to improve my software for free.
- 0x0 7y agoIs this why Apple also quietly released updates for older devices as iOS 9.3.6 and 10.3.4? IIRC Apple has only patched EOL'd iOS releases once before - in 6.1.6 for the ssl gotofail?
- george_perez 7y agoThat was for the GPS 10-bit bug. https://www.theregister.co.uk/2019/02/12/current_gps_epoch_ends/ https://www.theregister.co.uk/2019/02/12/current_gps_epoch_e... Apple's runs out in November 2019 instead of April.
- 0x0 7y agoApple's changelogs are often incomplete at time of release and updated with additional CVEs later. A gps fix sounds like a convenient cover story for an emergency 0day patch for imessage, for example.
- mktmkr 7y agoApparently iOS 12.4 came out last week but I have automatic updates on and the update is not installed. I just triggered it manually a moment ago.
- yots 7y agoCan anyone explain iOS “automatic” updates? They never seem to work for me.
- gruez 7y agoSame here. For the last few iOS updates I was notified through hacker news rather than through the "automatic update" feature.
- captn3m0 7y agoSame, never worked for me. At least I should be given a notification so I can install it myself.
- george_perez 7y agoIt’s very specific parameters. Automatic Updates are done after they’re downloaded, and automatic downloads are rolled out around a week and a half later or around that time. https://imgur.com/a/u6Mxz4A https://imgur.com/a/u6Mxz4A
- spike021 7y agoYou have to have the phone charging overnight, usually. But sometimes I wake up in the morning to a message that it had an issue and couldn't update.
- runeks 7y agoI always wake up to this message, and have to do it manually. I don’t know why.
- theobeers 7y agoSame here. This was an unpleasant surprise. Even after I checked and saw that I didn’t have 12.4 installed yet, there was no red badge on the Settings app icon to indicate an available update.
- HNisCurated 7y agoHere is a question to people who proposed criminal charges for managers who let their platform get hacked- Even Apple gets cracked. Do these developers need to do jail time? Edit, I don't even agree with this. I'm asking the popular sentiment.
- godzillabrennus 7y agoThe only developers that would be left after such a shift in liability would be the ones with law degrees.
- pjmlp 7y agoAnd the ones with a proper engineering degree, instead of calling themselves engineers after a 6 months bootcamp.
- ancarda 7y agoDo you think Apple is hiring those people to work on iMessage?
- pjmlp 7y agoIt doesn't matter what a single company does, the whole industry needs to improve in regards to quality of deliverables.
- evilolive 7y agowhat about any kind of degree that prevents people from jumping to such logical chains : coding bootcamps -> low quality of deliverables industry wide -> iMessage bug!
- pjmlp 7y agoIf companies were hint hard on their pockets due to iMessage like bugs, they certainly would take care to hire and put into place the respective measures to prevent them from happening. One of such measures, like in other professions, is ensuring a proper education and respective certification.
- tptacek 7y agoI believe Natalie Silvanovich is giving a talk at Black Hat about some of these next week. Silvanovich is a machine.
- vesche 7y agoIndeed: https://www.blackhat.com/us-19/briefings/schedule/#look-no-hands----the-remote-interaction-less-attack-surface-of-the-iphone-15203 https://www.blackhat.com/us-19/briefings/schedule/#look-no-h...
- rllyboredonline 7y agoWhile being a Project Zero member is cool and all, Natalie is also a well-known Tamagotchi hacker https://natashenka.ca/about/ https://natashenka.ca/about/
- mavrick33 7y agoGlad to see tech companies holding each other accountable. I hope the white hat hacking between these folks continues. The more vulnerabilities found, the safer our data will be.
- finnthehuman 7y agoProject Zero Works for the manufacturer of the largest data exfiltration vector in human history and don’t seem to be making meaningful progress on fixing that. All their bug reports come with a bad taste in my mouth.
- _jal 7y agoI'm a citizen of a country that is likely responsible for more preventable deaths than any other. Guilt by association is in fact not completely unjustifiable. But either it attenuates quickly, or every human you know must be shunned for ethical reasons.
- finnthehuman 7y agoI’m not judging the people that like finding exploits for a living, I’m judging google employing them while the rest of googles business model is directly opposed to user security.
- jdgoesmarching 7y agoYou’re upset that a deep-pocketed company is funding security research? I have no love for Google but I’m extremely happy they found vulnerabilities that could be patched on my phone before someone else did.
- cromwellian 7y agoPrivacy and security are different concepts.
- metromint 7y agoProject Zero isn't Facebook.
- mikeash 7y agoWould you prefer that they not find or report these bugs, and let them remain unfixed?
- ziddoap 7y agoIt seems like peoples hatred for Google is leaking over to how they think vulnerability disclosures should happen. Reading through the comments is disorientating - people are angry that researchers are.. gasp... researching vulnerabilities. It's not some faceless Google Incarnate monstrosity, they are paid researchers (humans, too!). If it was Cure53 that did this, for free, and made the exact same announcement no one would bat an eye. Good on whatever company does vulnerability research, follows established protocols in disclosure, and makes the world a safer place.
- mehrdadn 7y agoMy beef is with the established protocol (Google or not) and that is that you disclose enough details to potentially repro even if the vendor patches correctly and promptly. Why the hell suddenly put everyone's devices at immediate risk until they get a chance to update? That's "responsible"?
- sixothree 7y agoOn the surface it appears Google is spending millions of dollars to expose flaws in competitor's products.
- runeks 7y agoI’m not sure why you received downvotes. Looks like people are a bit sensitive on this subject. You are exactly right.
- foobiekr 7y agoGood. Because the competitors aren’t.
- root_axis 7y agoSounds great for consumers.
- ziddoap 7y agoWords are wonderful. Try saying it this way: Google is spending millions of their own dollars to freely help other companies (and themselves!) enhance their security and close holes malicious actors can exploit. Now replace "Google" with any other company or independent researcher of your choice. If you're no longer angry, you're being biased solely because its Google and not someone you like.
- sildur 7y agoI replaced Google with Microsoft, Oracle and SCO, and the feeling is the same.
- 0x6c6f6c 7y agoSo, you're not okay with white hats or security researchers at all then
- kiallmacinnes 7y agoI suspect it's large companies, given the names provided. Really, I don't get peoples hatred for Project Zero. Sure, hate the companies, but can you seriously argue that companies spending money on security research is a bad thing? Even if gasp they might get some good publicity from that research?
- snazz 7y agoI wonder what kind of infrastructure they had set up to find these vulnerabilities and extract names of classes and methods. Do they jailbreak iPhones and run fuzzers directly on the device? Do they analyze IPSWs directly? Edit: and explains how to set up tooling to test these components. I'll wait for the BlackHat slides.
- saagarjha 7y ago> extract names of classes and methods This is very easy to do using tools such as class-dump if you can get access to the binary (either from the IPSW, or sometimes directly from the shared cache).
- jwildeboer 7y agoTL;DR Apple happily fixes what Google’s hackers uncover and responsibly disclose but the beeb desperately spices things up because clickbait ;)
- mr_toad 7y agoWish I had a bunch of people testing my code for free and giving me 30 days to fix things before anyone else found out.
- panpanna 7y agoEven better when your competitors do it! Think if Google instead of disclosing these responsibly would leak one bug to hackers every month or so. How many would stay on iMessage efter getting owned for the tenth time??
- Bhilai 7y agoThe recent barrage of security bugs in iOS makes me wonder if Apple has been more lenient on their security posture in recent times. It also shows that Google Project Zero is very successful in marketing their work. There are several other players reporting security bugs in iOS regularly, I see Tencent KeenLab, Pangu, Checkpoint, GaTech SSLab in the last two releases to name a few, but very few have achieved similar recognition as GPZ.
- cheeze 7y agoI think it's clear that Apple security hasn't been as good as everyone would like. Remember the disastrous Mac OS login bug?
- macrael 7y agoProject Zero continues to be a Good Thing
- skc 7y agoThis type of thread always goes alot differently when the flaws revealed aren't in Apple products
- buboard 7y agoChoice supportive bias is real, and it seems to scale with price
- tristor 7y agoI'm honestly appalled at the number of comments in this thread trying to lambast Project Zero for the good work they do in improving software security. Even if Google specifically started and ran Project Zero to target competitor's products (which they didn't, and they don't, there's over 100 bugs found by P0 in Google products), it wouldn't matter because the effect would still be that the online world is a safer place with more secure software. Of all places, I thought Hacker News would have a community which understands the critical importance of security research and the fact that fixing software security bugs is a net benefit to everyone, every time, all the time.
- quantdev 7y agoHacker News has become tribal and politicized, much like many other parts of the internet.
- dobleboble 7y agoThere's a lot of potential value in influencing public opinion.
- stcredzero 7y agoThere are multiple tribes represented in HN. I know, having been on here for years. I've met face to face with other HNers who might today disguise themselves and punch me in the street. I also continue to have productive and (at times) civil discussions with them, even in today's crazy climate.
- deleted 7y ago[deleted]
- rootusrootus 7y agoVery true. And both Apple- and Google-related discussions brings out both sides in force. In this case we have a story that involves both, so I am not at all surpised to see it get contentious. Personally, I've observed (via the voting mechanism and commentary) several different cohorts of people visit HN throughout the day. You get a real sense that opinions are regional and tribal. Europeans in the early morning, then east coast and flyover states, and then brace for impact when SV (in particular Googlers and/or pro-Googlers) pile on. It's fascinating.
- caycep 7y agoTBH, while I think the iMessage service is invaluable, the app itself is often buggy for me. On OS X, it often hangs w/ the spinning beach ball when attempting text input, the iCloud sync can be spotty, and the cardinal sin, on my iPhone X, there are inexcusable screen draw bugs w/ orientation rotation, or w/ the keyboard popping up to type....so I am not entirely surprised. It is an app in need of a good overall bug hunt.
- Nextgrid 7y agoOne bug I’ve noticed on iOS is the bar with the message text field and the send button sometimes being displayed at the bottom even if you’re on the message list view.
- pmarreck 7y agoWould be nice if Google finally came out with their own iMessage-like service that texted over the Internet instead of 30 year old SMS
- garysahota93 7y agoDoes anyone know how to file a bug report for iMessages? I have a slew of bugs I'd like to report from my day to day usage.
- mrunkel 7y agohttps://feedbackassistant.apple.com/ https://feedbackassistant.apple.com/