12 ms·

Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

134 points by dvcrn 7y ago

lol768 7y ago
>A third security researcher, Stefan Esser said that people should be careful what apps they download from the App Store right now. "Any such app could have a copy of the jailbreak in it," he wrote on Twitter. Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..
- 0x0 7y ago
  It's happened before, and it's probably not super easy for Apple to do static binary analysis to determine if an app is going to make exactly the bad syscalls necessary for the jailbreak gated behind an undisclosed trigger functionality.
- Flockster 7y ago
  Can a review really check for this? Aren't there obfuscation methods and ways to delay the trigger of the exploit? It could wait for a special network package to start the exploit. For iOS 9.3.3 there even was an app in the App Store, that could jailbreak your phone. (PG Client)
- deleted 7y ago
  [deleted]
- yots 7y ago
  Yes, to some extent people should be worried about apps potentially containing exploits, but then again they should be more worried about 0-days than a known vulnerability.
  - oarsinsync 7y ago
    > A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software)[0] Why should a publicly known unpatched vulnerability be a lesser concern than something that you don't know exists? [0]https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing)
- n1000 7y ago
  > Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still.. Well, until now I assumed Apple would test for patched vulnerabilities in new iOS releases too.
dessant 7y ago
It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or we have to spend years to learn the skills to unlock these systems ourselves.
- snaky 7y ago
  Do you consider https://download.lineageos.org/ https://download.lineageos.org/ a questionable source?
  - dessant 7y ago
    I do not, but you have to be lucky enough to have a device that is supported by LineageOS, or you need to spend time learning the skills to build a custom ROM for your device. Why isn't there an option in developer mode that gives us a root shell on our Android devices? Why is an escape hatch that gives back control to the user so frightening for these companies?
    - deleted 7y ago
      [deleted]
    - threeseed 7y ago
      It's because that same escape hatch can be used by bad actors. And unfortunately as we have seen all too often users are willing to blindly do what they are told if they get something out of it e.g. free game, credits etc.
      - deleted 7y ago
        [deleted]
    - StavrosK 7y ago
      I mean, it's not luck if you just buy one of those devices...
stock_toaster 7y ago
No regression tests? ಠ_ಠ
- mehrdadn 7y ago
  I mean... does every single patch need a regression test? If I did free(p); p[i] = 1; and then I fixed it by doing p[i] = 1; free(p); do I really need a regression test to trigger the dumb use-after-free I'd introduced?
  - reacweb 7y ago
    I think the answer to your question is not obvious. Here, it would have prevented the problem of Apple. 12 years ago while working on a military project on sun, I have encountered a similar vulnerability caused by a regression https://blog.erratasec.com/2007/02/trivial-remote-solaris-0day-disable.html#.XV0RbegzbmE https://blog.erratasec.com/2007/02/trivial-remote-solaris-0d... Adding this kind of non regression test is costly, but it protects against source code management mistakes.
    - michaelt 7y ago
      Unless, of course, the code management mistake that removes the patch also removes the regression test!
    - mehrdadn 7y ago
      > I think the answer to your question is not obvious. You mean the answer could be "yes, every single patch must have a regression test"?
- threeseed 7y ago
  It looks like a bad merge in which if there was a test it would've not been merged either.
  - m0xte 7y ago
    (again). Goto fail comes to mind.
mehrdadn 7y ago
I got a lot of flak here recently for suggesting that maybe security researchers shouldn't be publishing PoCs or deep vulnerability details literally 1 week after the vendor issues a patch. Here's to hoping that, now that this happened, someone will give this idea another consideration... (P.S. for those wondering: apparently this is CVE-2019-8605: https://bugs.chromium.org/p/project-zero/issues/detail?id=1806 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...)
- 0x0 7y ago
  But it's been 3 months since the vendor first issued a patch!
  - mehrdadn 7y ago
    I mean, I'm not suggesting 1 week should've been 1 month or even 3 months. Those are too short to me too. But regardless, that's already 3 months people had to design, write, test, and perfect an exploit for it...
    - consp 7y ago
      The exploit was patched in iOS 12.3, not known since 12.3. Apple probably knew for longer, fixed it in 12.3 and reverted the patch (somehow) in 12.4. If you want to make your point, this is one of the worst examples you can take as it is an old exploit, which has been patched and now works again. The code should be in the public after the patch anyway if a researcher found it.
      - mehrdadn 7y ago
        > The exploit was patched in iOS 12.3, not known since 12.3. Apple probably knew for longer, fixed it in 12.3 and reverted the patch (somehow) in 12.4. Huh? Am I misreading the timeline? iOS 12.3 was released May 13, and I see the view restriction removed (Label:-Restrict-View-Commit) on May 20... which is almost exactly 3 months ago: https://bugs.chromium.org/p/project-zero/issues/detail?id=1806#c8 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... https://support.apple.com/en-us/HT210118 https://support.apple.com/en-us/HT210118
eljefe900 7y ago
Please excuse the tinfoil hat - is there any chance that this vulnerability was reintroduced at the request of the Chinese government to allow easier access to Hong Kong protesters devices?
- pilif 7y ago
  no
  - eljefe900 7y ago
    Apple has definitely accommodated the Chinese government’s desires before: https://9to5mac.com/2018/05/19/apple-cracking-down-on-callkit-apps-in-china-app-store-due-to-government-regulation/ https://9to5mac.com/2018/05/19/apple-cracking-down-on-callki...
    - pilif 7y ago
      During the San Bernardino case, they have said multiple times that they cannot install software without the user entering their password. And even if you assume a publicly traded company lying outright, what do you think is more likely: then silently backdooring the phones of people in Hongkong or pretending to have accidentally unpatched a vulnerability, hoping people would update to that OS in order for pretty obvious exploits being able to run? If I was as evil as you make Apple out to be I would sure as hell do the former.
- UweSchmidt 7y ago
  No need for a tinfoil hat or this specific vulnerability. Any number of backdoors can be introduced with any update for any operating system or app. Generally governments around the world want backdoors and information from companies and companies generally comply.
  - pilif 7y ago
    Last time this happened to Apple they fought it tooth-and-nail and at least from what the public knows they were victorious and did not have to add a backdoor.
nikisweeting 7y ago
I'm just thankful for a working jailbreak on the latest version with no "Please update your iOS beta version" popup. It's like a dream come true.
- nathancahill 7y ago
  Absolutely incredible to have a jailbreak on the latest signed version of iOS.
userbinator 7y ago
The saddest thing about this is the article presents jailbreaking as an entirely negative thing, while the comments offer a more balanced opinion.
- draw_down 7y ago
  I’m ok with security vulnerabilities being portrayed negatively!
- auiya 7y ago
  For most end-users it is. It allows any compromise of the device to elevate to root privileges.
pier25 7y ago
I've never understood why iOS isn't more like macOS. There aren't really any technical reasons why this couldn't be. It's common for the security argument to be used to justify Apple's practices, but Mac users have been perfectly fine installing third party apps such as Transmit, Adobe Photoshop, or even Google Chrome from outside of Apple's walled garden. I've been using macOS since 2007 and I've never had a virus or any security problem, nor anyone else I know using a Mac. From my dev colleagues to my 70 year old mother in law or my 15 year old nephew. It seems to me the only real arguments for Apple's walled garden are economical.
- kgwxd 7y ago
  There will likely be a day when it's very difficult to install anything you want on macOS. Same with Windows. They keep trying really hard to make it happen but, for now, people keep pushing back even harder. For me, the fact that they're even trying is enough to leave.
- TacticalTable 7y ago
  Market share is an appreciable concern here. Macs haven't been more than 20% of the market for a long time. iPhones are a much larger market share, especially among affluent users. I don't think we'd see any widespread viruses, but there would certainly be a ton of people losing their financial info from their own irresponsibility.
  - pier25 7y ago
    So your argument is that because there are more users it needs to be more secure?
    - mattdanger 7y ago
      I think the argument is that if an OS has a tiny market share then it tends to be more open to 3rd party developers as a way to increase market share. MacOS used to be a more developer friendly.
    - TacticalTable 7y ago

134 points by dvcrn 7y ago

>A third security researcher, Stefan Esser said that people should be careful what apps they download from the App Store right now. "Any such app could have a copy of the jailbreak in it," he wrote on Twitter. Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..

0x0 7y ago
It's happened before, and it's probably not super easy for Apple to do static binary analysis to determine if an app is going to make exactly the bad syscalls necessary for the jailbreak gated behind an undisclosed trigger functionality.
Flockster 7y ago
Can a review really check for this? Aren't there obfuscation methods and ways to delay the trigger of the exploit? It could wait for a special network package to start the exploit. For iOS 9.3.3 there even was an app in the App Store, that could jailbreak your phone. (PG Client)
deleted 7y ago
[deleted]
yots 7y ago
Yes, to some extent people should be worried about apps potentially containing exploits, but then again they should be more worried about 0-days than a known vulnerability.
- oarsinsync 7y ago
  > A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software)[0] Why should a publicly known unpatched vulnerability be a lesser concern than something that you don't know exists? [0]https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing)
n1000 7y ago
> Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still.. Well, until now I assumed Apple would test for patched vulnerabilities in new iOS releases too.

dessant 7y ago

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning. We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent. We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or we have to spend years to learn the skills to unlock these systems ourselves.

snaky 7y ago
Do you consider https://download.lineageos.org/ https://download.lineageos.org/ a questionable source?
- dessant 7y ago
  I do not, but you have to be lucky enough to have a device that is supported by LineageOS, or you need to spend time learning the skills to build a custom ROM for your device. Why isn't there an option in developer mode that gives us a root shell on our Android devices? Why is an escape hatch that gives back control to the user so frightening for these companies?
  - deleted 7y ago
    [deleted]
  - threeseed 7y ago
    It's because that same escape hatch can be used by bad actors. And unfortunately as we have seen all too often users are willing to blindly do what they are told if they get something out of it e.g. free game, credits etc.
    - deleted 7y ago
      [deleted]
  - StavrosK 7y ago
    I mean, it's not luck if you just buy one of those devices...

stock_toaster 7y ago

No regression tests? ಠ_ಠ

mehrdadn 7y ago
I mean... does every single patch need a regression test? If I did free(p); p[i] = 1; and then I fixed it by doing p[i] = 1; free(p); do I really need a regression test to trigger the dumb use-after-free I'd introduced?
- reacweb 7y ago
  I think the answer to your question is not obvious. Here, it would have prevented the problem of Apple. 12 years ago while working on a military project on sun, I have encountered a similar vulnerability caused by a regression https://blog.erratasec.com/2007/02/trivial-remote-solaris-0day-disable.html#.XV0RbegzbmE https://blog.erratasec.com/2007/02/trivial-remote-solaris-0d... Adding this kind of non regression test is costly, but it protects against source code management mistakes.
  - michaelt 7y ago
    Unless, of course, the code management mistake that removes the patch also removes the regression test!
  - mehrdadn 7y ago
    > I think the answer to your question is not obvious. You mean the answer could be "yes, every single patch must have a regression test"?
threeseed 7y ago
It looks like a bad merge in which if there was a test it would've not been merged either.
- m0xte 7y ago
  (again). Goto fail comes to mind.

mehrdadn 7y ago

I got a lot of flak here recently for suggesting that maybe security researchers shouldn't be publishing PoCs or deep vulnerability details literally 1 week after the vendor issues a patch. Here's to hoping that, now that this happened, someone will give this idea another consideration... (P.S. for those wondering: apparently this is CVE-2019-8605: https://bugs.chromium.org/p/project-zero/issues/detail?id=1806 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...)

0x0 7y ago
But it's been 3 months since the vendor first issued a patch!
- mehrdadn 7y ago
  I mean, I'm not suggesting 1 week should've been 1 month or even 3 months. Those are too short to me too. But regardless, that's already 3 months people had to design, write, test, and perfect an exploit for it...
  - consp 7y ago
    The exploit was patched in iOS 12.3, not known since 12.3. Apple probably knew for longer, fixed it in 12.3 and reverted the patch (somehow) in 12.4. If you want to make your point, this is one of the worst examples you can take as it is an old exploit, which has been patched and now works again. The code should be in the public after the patch anyway if a researcher found it.
    - mehrdadn 7y ago
      > The exploit was patched in iOS 12.3, not known since 12.3. Apple probably knew for longer, fixed it in 12.3 and reverted the patch (somehow) in 12.4. Huh? Am I misreading the timeline? iOS 12.3 was released May 13, and I see the view restriction removed (Label:-Restrict-View-Commit) on May 20... which is almost exactly 3 months ago: https://bugs.chromium.org/p/project-zero/issues/detail?id=1806#c8 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... https://support.apple.com/en-us/HT210118 https://support.apple.com/en-us/HT210118

eljefe900 7y ago

Please excuse the tinfoil hat - is there any chance that this vulnerability was reintroduced at the request of the Chinese government to allow easier access to Hong Kong protesters devices?

pilif 7y ago
no
- eljefe900 7y ago
  Apple has definitely accommodated the Chinese government’s desires before: https://9to5mac.com/2018/05/19/apple-cracking-down-on-callkit-apps-in-china-app-store-due-to-government-regulation/ https://9to5mac.com/2018/05/19/apple-cracking-down-on-callki...
  - pilif 7y ago
    During the San Bernardino case, they have said multiple times that they cannot install software without the user entering their password. And even if you assume a publicly traded company lying outright, what do you think is more likely: then silently backdooring the phones of people in Hongkong or pretending to have accidentally unpatched a vulnerability, hoping people would update to that OS in order for pretty obvious exploits being able to run? If I was as evil as you make Apple out to be I would sure as hell do the former.
UweSchmidt 7y ago
No need for a tinfoil hat or this specific vulnerability. Any number of backdoors can be introduced with any update for any operating system or app. Generally governments around the world want backdoors and information from companies and companies generally comply.
- pilif 7y ago
  Last time this happened to Apple they fought it tooth-and-nail and at least from what the public knows they were victorious and did not have to add a backdoor.

nikisweeting 7y ago

I'm just thankful for a working jailbreak on the latest version with no "Please update your iOS beta version" popup. It's like a dream come true.

nathancahill 7y ago
Absolutely incredible to have a jailbreak on the latest signed version of iOS.

userbinator 7y ago

The saddest thing about this is the article presents jailbreaking as an entirely negative thing, while the comments offer a more balanced opinion.

draw_down 7y ago
I’m ok with security vulnerabilities being portrayed negatively!
auiya 7y ago
For most end-users it is. It allows any compromise of the device to elevate to root privileges.

pier25 7y ago

I've never understood why iOS isn't more like macOS. There aren't really any technical reasons why this couldn't be. It's common for the security argument to be used to justify Apple's practices, but Mac users have been perfectly fine installing third party apps such as Transmit, Adobe Photoshop, or even Google Chrome from outside of Apple's walled garden. I've been using macOS since 2007 and I've never had a virus or any security problem, nor anyone else I know using a Mac. From my dev colleagues to my 70 year old mother in law or my 15 year old nephew. It seems to me the only real arguments for Apple's walled garden are economical.

kgwxd 7y ago
There will likely be a day when it's very difficult to install anything you want on macOS. Same with Windows. They keep trying really hard to make it happen but, for now, people keep pushing back even harder. For me, the fact that they're even trying is enough to leave.
TacticalTable 7y ago
Market share is an appreciable concern here. Macs haven't been more than 20% of the market for a long time. iPhones are a much larger market share, especially among affluent users. I don't think we'd see any widespread viruses, but there would certainly be a ton of people losing their financial info from their own irresponsibility.
- pier25 7y ago
  So your argument is that because there are more users it needs to be more secure?
  - mattdanger 7y ago
    I think the argument is that if an OS has a tiny market share then it tends to be more open to 3rd party developers as a way to increase market share. MacOS used to be a more developer friendly.
  - TacticalTable 7y ago