4 ms·

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices a

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

toxik 7y ago
Absolutely. It is such a disgrace to open society that we have allowed our phones, computers and cars to be so taken over by corporate interest that we cannot even peek inside. NB I heard some infosec research companies actually get rooted phones from Apple with some big caveats.
- shadowtree 7y ago
  That's why Android is far safer. No exploits there.
- qrbLPHiKpiux 7y ago
  This is what the free market chose. People bought these devices en masse and continue to do so. It’s on us - the end user.
  - 345218435 7y ago
    there‘s no better alternative. no, please don‘t tell me about android. that‘s a fucked up mine field altogether. we need to remember that there is no and will never be 100% security. while not open — which is worth nothing to the average user — we get pretty close with ios given all we know.
bobthedino 7y ago
A step in the right direction: Apple recently announced that next year security researchers will have access to special iPhones: https://www.theverge.com/2019/8/8/20756629/apple-iphone-security-research-device-program-vulnerabilities https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...
- Wowfunhappy 7y ago
  I agree this is "a step in the right direction", but if the iPhones are special, would the exploit run on them? I suppose it depends on how "special" they are—do they run standard iOS with normal Safari and actual apps?
  - snazz 7y ago
    I think it just means they can run unsigned code. But yes, I would presume that Safari and the other default apps are present.
    - saagarjha 7y ago
      Production iPhones can do that already. Three phones probably give researchers root access and allow for disabling AMFI, etc.
thebruce87m 7y ago
I hear this a lot, but is it something that actually happens to a meaningful extent on other systems? Does it balance out the fact that black hats (and state sponsored) can find exploits that they would not have found otherwise if they didn’t have the source?
tinus_hn 7y ago
No, it has nothing to do with that. The only difference is that you can’t buy snake-oil virus scanners in the iOS App Store because they can’t even pretend to work.
Spooky23 7y ago
The Apple iOS model has advantages and disadvantages. The issue cited is not a problem unique to the iOS walled garden model. See: CVE-2019-1162 See: CVE-2017-6074

toxik 7y ago

Absolutely. It is such a disgrace to open society that we have allowed our phones, computers and cars to be so taken over by corporate interest that we cannot even peek inside. NB I heard some infosec research companies actually get rooted phones from Apple with some big caveats.

shadowtree 7y ago
That's why Android is far safer. No exploits there.
qrbLPHiKpiux 7y ago
This is what the free market chose. People bought these devices en masse and continue to do so. It’s on us - the end user.
- 345218435 7y ago
  there‘s no better alternative. no, please don‘t tell me about android. that‘s a fucked up mine field altogether. we need to remember that there is no and will never be 100% security. while not open — which is worth nothing to the average user — we get pretty close with ios given all we know.

bobthedino 7y ago

A step in the right direction: Apple recently announced that next year security researchers will have access to special iPhones: https://www.theverge.com/2019/8/8/20756629/apple-iphone-security-research-device-program-vulnerabilities https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...

Wowfunhappy 7y ago
I agree this is "a step in the right direction", but if the iPhones are special, would the exploit run on them? I suppose it depends on how "special" they are—do they run standard iOS with normal Safari and actual apps?
- snazz 7y ago
  I think it just means they can run unsigned code. But yes, I would presume that Safari and the other default apps are present.
  - saagarjha 7y ago
    Production iPhones can do that already. Three phones probably give researchers root access and allow for disabling AMFI, etc.

thebruce87m 7y ago

I hear this a lot, but is it something that actually happens to a meaningful extent on other systems? Does it balance out the fact that black hats (and state sponsored) can find exploits that they would not have found otherwise if they didn’t have the source?

tinus_hn 7y ago

No, it has nothing to do with that. The only difference is that you can’t buy snake-oil virus scanners in the iOS App Store because they can’t even pretend to work.

Spooky23 7y ago

The Apple iOS model has advantages and disadvantages. The issue cited is not a problem unique to the iOS walled garden model. See: CVE-2019-1162 See: CVE-2017-6074