6 ms·

> The media overhyped the vulnerabilities No, the media underhyped it. It's a remote code execution vulnerability that's triggered by visiting a website.

693471 7y ago
Which to me is a big yawn because as long as we have javascript engines in our browsers this will probably be possible. Browsing websites is basically an RCE anyway.
- saagarjha 7y ago
  The point of a browser's security model is to make it so that "remote code execution" does not mean "arbitrary remote code execution with elevated privileges".
  - 693471 7y ago
    If we really cared we'd only ship data and not code
    - saagarjha 7y ago
      That's assuming that parsers don't have bugs in them.
    - lonelappde 7y ago
      Code is data. There is no technical difference, only human interpretative models.
      - jcranberry 7y ago
        He's obviously talking about shipping only non-executable data.
        693471 7y ago
        Correct
        stordoff 7y ago
        Still, is there a difference? If there is a bug in the parser, trip it and what was once non-executable might be executable.
        allset_ 7y ago
        Yes. Without executable client side code you can't do things like heap spraying.
        saagarjha 7y ago
        Oh, you totally can. You just have to do it by tricking the parser into going it for you.
- minty_phoenix 7y ago
  I remember having been able to jailbreak my iPhone 3GS for a period of time entirely through visiting a website and letting it exploit such vulnerabilities enough to perform the task. Searching for a related article, appears to have been possible on iOS 4.0/4.0.1: https://www.cultofmac.com/53323/jailbreakme-2-0-jailbreaks-iphone-4-3gs-and-3g-on-ios-4-4-0-1-and-ipad-on-ios-3-2-1/ https://www.cultofmac.com/53323/jailbreakme-2-0-jailbreaks-i... Edit: I use ‘letting’ above loosely meaning that the specific website mentioned allowed the visitor to control whether the exploit was actually executed or not.
saagarjha 7y ago
I'm not denying that they're serious vulnerabilities–made especially concerning because it looks like they're the work of a nation state against an ethnic minority–but headlines of "1 billion iPhones hacked" do not convey the issue accurately.
- Someone1234 7y ago
  > headlines of "1 billion iPhones hacked" That wasn't an actual headline though. You can find: "Google Warns 1 Billion Apple Users They May Have Been Attacked." Which is quite different and doesn't conform to your complaint as well.
  - saagarjha 7y ago
    That was a generic headline I condensed from the results of a quick search. Here's one that was the top result for me in DuckDuckGo: https://www.pymnts.com/apple/2019/google-says-billion-apple-users-risk-hack-attacks/ https://www.pymnts.com/apple/2019/google-says-billion-apple-...
    - Someone1234 7y ago
      So you created it, and then used its wording as the focus of your complaint. And your link has the same headline I referenced above, which is quite different in tone and implication.
      - saagarjha 7y ago
        I just read the article I linked a bit more closely, and it's worse than I thought: pretty much everything in it is wrong. > The details of the exploits are being kept a secret They are not. > Four out of the six bugs can trigger a malicious code on an iOS device, and a user doesn’t even need to do anything. Simply sending the message to the phone will execute the code once a person opens and looks at the message. No. The article also fails to mention that the the bugs targeted previous versions of iOS and have been fixed by Apple. And finally, the title makes it clear that "1B Apple users could be hacked", which is categorically false and much closer in meaning to my headline than yours.

693471 7y ago

Which to me is a big yawn because as long as we have javascript engines in our browsers this will probably be possible. Browsing websites is basically an RCE anyway.

saagarjha 7y ago
The point of a browser's security model is to make it so that "remote code execution" does not mean "arbitrary remote code execution with elevated privileges".
- 693471 7y ago
  If we really cared we'd only ship data and not code
  - saagarjha 7y ago
    That's assuming that parsers don't have bugs in them.
  - lonelappde 7y ago
    Code is data. There is no technical difference, only human interpretative models.
    - jcranberry 7y ago
      He's obviously talking about shipping only non-executable data.
      - 693471 7y ago
        Correct
      - stordoff 7y ago
        Still, is there a difference? If there is a bug in the parser, trip it and what was once non-executable might be executable.
        allset_ 7y ago
        Yes. Without executable client side code you can't do things like heap spraying.
        saagarjha 7y ago
        Oh, you totally can. You just have to do it by tricking the parser into going it for you.
minty_phoenix 7y ago
I remember having been able to jailbreak my iPhone 3GS for a period of time entirely through visiting a website and letting it exploit such vulnerabilities enough to perform the task. Searching for a related article, appears to have been possible on iOS 4.0/4.0.1: https://www.cultofmac.com/53323/jailbreakme-2-0-jailbreaks-iphone-4-3gs-and-3g-on-ios-4-4-0-1-and-ipad-on-ios-3-2-1/ https://www.cultofmac.com/53323/jailbreakme-2-0-jailbreaks-i... Edit: I use ‘letting’ above loosely meaning that the specific website mentioned allowed the visitor to control whether the exploit was actually executed or not.

saagarjha 7y ago

I'm not denying that they're serious vulnerabilities–made especially concerning because it looks like they're the work of a nation state against an ethnic minority–but headlines of "1 billion iPhones hacked" do not convey the issue accurately.

Someone1234 7y ago
> headlines of "1 billion iPhones hacked" That wasn't an actual headline though. You can find: "Google Warns 1 Billion Apple Users They May Have Been Attacked." Which is quite different and doesn't conform to your complaint as well.
- saagarjha 7y ago
  That was a generic headline I condensed from the results of a quick search. Here's one that was the top result for me in DuckDuckGo: https://www.pymnts.com/apple/2019/google-says-billion-apple-users-risk-hack-attacks/ https://www.pymnts.com/apple/2019/google-says-billion-apple-...
  - Someone1234 7y ago
    So you created it, and then used its wording as the focus of your complaint. And your link has the same headline I referenced above, which is quite different in tone and implication.
    - saagarjha 7y ago
      I just read the article I linked a bit more closely, and it's worse than I thought: pretty much everything in it is wrong. > The details of the exploits are being kept a secret They are not. > Four out of the six bugs can trigger a malicious code on an iOS device, and a user doesn’t even need to do anything. Simply sending the message to the phone will execute the code once a person opens and looks at the message. No. The article also fails to mention that the the bugs targeted previous versions of iOS and have been fixed by Apple. And finally, the title makes it clear that "1B Apple users could be hacked", which is categorically false and much closer in meaning to my headline than yours.