6 ms·
Hard to tell what’s really going on here from this article. Although it seems like five vulnerabilities were fixed and one remains (and google is being unusuall
by sambroner 7y ago
Hard to tell what’s really going on here from this article. Although it seems like five vulnerabilities were fixed and one remains (and google is being unusually patient about the sixth issue)
One thing I’ve always struggled with is the strategy of these white hat teams. I’m sure Google Zero spends a lot of time on Apple because Apple is an enormous company, large partner, and competitor in some spaces.
So now I wonder: does the release of vulnerabilities ever get effected by business agenda?
I assume it has to, although I’m not sure of the agenda here. In this case, iMessage is in direct competition with a Google sms protocol (although googles hasn’t gained much traction). Maybe the vuln is less impressive than saying, “there’s one more”?
- dmix 7y agoThese guys are the best experts in the world and Apple is getting free work done. Who cares if Apple is angry, Google made their software slightly safer and probably put the iMessage dev team on their toes (as they should be).
- soup10 7y agoif they are so good why was gmail completely compromised without their knowledge
- angulardementia 7y agoWhen was this?
- soup10 7y agoSnowden leaks confirmed that gmail was compromised under PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) They now claim its secure again because they are encrypting internal traffic. It's such a high priority and centralized target with so much valuable intelligence that any such claims have to be taken with a grain of salt.
- CobrastanJorji 7y agoPRISM was the one with FISA warrants, where the government lawfully acquired data from Google via formal processes. MUSCULAR was the the one where the NSA tapped Google's inter-datacenter fiber lines in order to spy on their internal traffic. https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- soup10 7y agonaturally its hard to keep track of all their cute code names, at the end of the day all the data ends up queryable by analysts with nothing resembling a warrant process
- dmix 7y agoPRISM wasnt a vulnerability, Google (et al) was basically forced to build a system to automatically handle FISA warrants data requests. For example, a single warrant signed in a secret court would request all data for a person of interest plus one or more hops of every person they communicated with which got funnelled through the PRISM system to multiple tech companies in the US simultaneously which then got fed back into XKeyScore for agents to go through the data and do graph analysis. Which is still really bad but not the same as these software vulnerabilities.
- espeed 7y agoNot only is it encrypted -- in transit and at rest -- Google uses its own silicon and has its own fiber.
- calciphus 7y agoGood doesn't mean perfect.
- donarb 7y agoWhy would Apple be angry?
- eatbitseveryday 7y agoApple carefully controls its messaging to its customers. With Google able to disclose software security flaws, and Apple not able to keep up in fixing them (some non-trivial), it puts some control into the hands of Google.
- bun_at_work 7y agoDoesn't the article say that 5/6 were fixed? And that the 6th isn't disclosed yet, as the 90 day period isn't up yet? Seems like Apple is keeping up reasonably well, wrt disclosure windows.
- eatbitseveryday 7y agoThat doesn’t mean they aren’t upset. Two years ago I spoke with someone on the CoreOS team at a conference and he expressed dissatisfaction at Project Zero. It forces them to halt other work they are doing to design fixes for these bugs, as they often get pressure from Google close to the 90-day window. One fix, he explained, related to process management and would affect all OS builds. Getting that fix integrated and tested into all recent macOS and iOS versions takes time, despite the 90-day window.
- dmix 7y agoThe big headlines about vulnerabilities in iMessage being misunderstood by laypeople?
- kps 7y agoProject Zero, as evident from their bug tracker¹, is a Chrome security effort. It looks at everything in the browsing stack — Chrome, libraries, plugins, OS, processors, proxies — presumably because security can be broken anywhere in the chain. ¹ https://bugs.chromium.org/p/project-zero/issues/list?can=1 https://bugs.chromium.org/p/project-zero/issues/list?can=1
- pjmlp 7y agoAnd they keep collecting exploits thanks to memory corruption bugs.
- samstave 7y agoHow did you make the little ‘1’ ? ^1
- saagarjha 7y agoChrome doesn’t run on iOS. They’re doing this because they want to, not because it would somehow make Chrome more secure.
- richardwhiuk 7y agoThere is a Google Chrome for iOS - though it doesn't use the rendering engine.
- ajross 7y agoiMessage is better software now than it was before this disclosure. I don't think that logic really works. If Google wanted to be evil and damage Apple, they would have leaked the vulnerabilities to the press and not bothered to work with them for a fix. If they wanted to be really evil, they could have leaked them to black hats first and waited for a real zero day before talking to the press. Instead, they worked together to fix the bugs. This is exactly what we want, there is no better resolution.