4 ms·

> When Google approached us, we were already in the process of fixing the exploited bugs. If Apple already knew about the flaw, then why did they never notify

> When Google approached us, we were already in the process of fixing the exploited bugs. If Apple already knew about the flaw, then why did they never notify those affected?

AceJohnny2 7y ago
Who was affected? The flaw was distributed through a website. They can infer from the contents of the website who was the likely target audience, but they don't know who visited the website and got hacked.
- jedberg 7y ago
  Unless they had a way to test if a phone had been hacked and distributed that along with the patch. It's quite possible that they had pretty good telemetry on the extent of the exploit. I agree that they should have told those who were affected, but perhaps they did?
  - AceJohnny2 7y ago
    > It's quite possible that they had pretty good telemetry on the extent of the exploit. Why would they? This is Apple, one of their selling points is how they don't have fingers in your phone
    - jedberg 7y ago
      There are a ton of places in iOs that report back to Apple. When you first set up the phone it asks if you want to "share your usage". You also agree to let them have stats on how long you use each app as part of the app store agreement. Apple's selling point is that they don't make money selling your private data (or transitive access to it) to third parties, but they don't make any claims about not doing it themselves. I don't see anything that would preclude them from installing some telemetry for this specific attack. And I think it would be perfectly justified in the name of security too.
      - saagarjha 7y ago
        > I don't see anything that would preclude them from installing some telemetry for this specific attack. Why can't an exploit just disable this?
- robmccoll 7y ago
  The content and tone of the article gave me the impression that they believe they know the scope of exploited devices. This implies knowing something about which devices were exploited or at the very least which subset of devices were vulnerable where the majority weren't. attack was narrowly focused, not a broad-based exploit of iPhones “en masse” “mass exploitation” ... This was never the case. If they don't, then they really shouldn't be making claims that the exploit wasn't widespread. They really don't know one way or the other. Otherwise, they could have notified those that were vulnerable / exploited.
deleted 7y ago
[deleted]
godelski 7y ago
Probably because it was a nation state actor that produces a lot of iPhones attacking a minority group.
mojuba 7y ago
A simple restart with an OS update would be sufficient for those affected, so no need to do anything extra, at least how I understood the exploit in question.
duxup 7y ago
Did they know who was affected?

> When Google approached us, we were already in the process of fixing the exploited bugs. If Apple already knew about the flaw, then why did they never notify those affected?

AceJohnny2 7y ago

Who was affected? The flaw was distributed through a website. They can infer from the contents of the website who was the likely target audience, but they don't know who visited the website and got hacked.

jedberg 7y ago
Unless they had a way to test if a phone had been hacked and distributed that along with the patch. It's quite possible that they had pretty good telemetry on the extent of the exploit. I agree that they should have told those who were affected, but perhaps they did?
- AceJohnny2 7y ago
  > It's quite possible that they had pretty good telemetry on the extent of the exploit. Why would they? This is Apple, one of their selling points is how they don't have fingers in your phone
  - jedberg 7y ago
    There are a ton of places in iOs that report back to Apple. When you first set up the phone it asks if you want to "share your usage". You also agree to let them have stats on how long you use each app as part of the app store agreement. Apple's selling point is that they don't make money selling your private data (or transitive access to it) to third parties, but they don't make any claims about not doing it themselves. I don't see anything that would preclude them from installing some telemetry for this specific attack. And I think it would be perfectly justified in the name of security too.
    - saagarjha 7y ago
      > I don't see anything that would preclude them from installing some telemetry for this specific attack. Why can't an exploit just disable this?
robmccoll 7y ago
The content and tone of the article gave me the impression that they believe they know the scope of exploited devices. This implies knowing something about which devices were exploited or at the very least which subset of devices were vulnerable where the majority weren't. attack was narrowly focused, not a broad-based exploit of iPhones “en masse” “mass exploitation” ... This was never the case. If they don't, then they really shouldn't be making claims that the exploit wasn't widespread. They really don't know one way or the other. Otherwise, they could have notified those that were vulnerable / exploited.

deleted 7y ago

[deleted]

godelski 7y ago

Probably because it was a nation state actor that produces a lot of iPhones attacking a minority group.

mojuba 7y ago

A simple restart with an OS update would be sufficient for those affected, so no need to do anything extra, at least how I understood the exploit in question.

duxup 7y ago

Did they know who was affected?