5 ms·
Malwarebytes Analysis of Checkm8 iOS Bootrom Exploit
- judge2020 7y agoiPhones are once again a valid theft target, at least for 5+ years while these vulnerable devices are still the norm (and for even longer in non-US countries, i've heard that carriers in India still sell the 6s and 7). The 8 and 8+ are still available on Apple.com, I wonder if we'll see a hardware revision or if they'll prematurely take it off the store.
- bredren 7y agoSeems unlikely they would be taken off the store. It is a relatively new idea that iPhones could be locked on theft at all, right?
- Abishek_Muthian 7y ago>even longer in non-US countries This is often overlooked in discussions about iOS exploits. Although 64-bit exploits gets the limelight for obvious reasons such as the possibility of being valid for current series of Apple devices, older 32-bit devices still being used in non-US countries shouldn't be discounted. Apple devices often cost much higher than US in some of these countries, the difference was even much higher several years back when Apple didn't have dedicated stores in these countries. Case in point : iPhone 5C was supposedly discounted ($550) when compared to iPhone 5S at the time of launch in US. In India, it was around ~$700 at minimum. To put that in perspective, that was a cost for a decent motorcycle in India which a family can use for at-least 20-30 years. iPhone 5C can still perform basic smartphone tasks at ease, although it could be very vulnerable to exploits even for basic browsing[1]. But an average consumer in India, doesn't care much about the updates when their phone gets basic tasks done. [1]:https://news.ycombinator.com/item?id=21062323 https://news.ycombinator.com/item?id=21062323
- kirb 7y agoRelated to this, Apple just began production of iPhone 6s in India, allowing them to sell them for cheaper in India than units they would usually import from China. That’s 2015’s flagship iPhone being produced brand new. So don’t expect older iPhones to go away anytime soon, especially if India is within your target market. Even in first-world countries this is an issue. My employer continues to support iOS 9 in their app because the balance of the cost of continuing to support it versus the cost of losing those customers on an iPhone 4s or iPad 2 is justified. Even if we bump it up, it probably won’t surpass iOS 12 (to continue supporting the iPhone 5s and 6) for several years. I wonder if this means they’ll continue supporting the 6s for longer than other phones, like the 5s which enjoyed 6 years and 6 major iOS releases of support. It feels irresponsible to know there are still millions of instances of a smartphone in active use around the world, that stopped getting security patches. When Apple released GPS fixes for older phones, as well as new updates for the old thin Apple TVs with UI that still looks like iOS 6, and recent iTunes Windows updates (which bundle WebKit and other Apple core frameworks), they didn’t backport any patches for vulnerabilities that are well-known in these older releases. The cost/benefit almost definitely doesn’t add up favorably when their business primarily relies on hardware profit margins, I know, but it still seems like a responsible thing to do. https://9to5mac.com/2018/06/26/iphone-6s-production-india/ https://9to5mac.com/2018/06/26/iphone-6s-production-india/ https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
- Abishek_Muthian 7y ago>but it still seems like a responsible thing to do. Especially, when advertising privacy & security as a premium selling point.
- Fnoord 7y ago> Related to this, Apple just began production of iPhone 6s in India So Apple is knowingly selling a device with a publicly known hardware vulnerability. Apple is very much aware of the vulnerability because them fixing it is what caused the vulnerability to become exploited.
- 7y ago
- jokowueu 7y agoBut they have always been a theft target . They are sold for parts
- judge2020 7y agoParts are less valuable compared to the cost of iPhones in the second-hand market. IIRC, logic boards can lose a lot of their value when they're locked with an Apple ID.
- KibbutzDalia 7y agoApple specifically uses the words “secure by design” on their website. That’s a lie.
- alphabettsy 7y agoDo you have any proof they designed it to be insecure?
- mastazi 7y agoParent is saying that X is not true and your reply is “do you have proof that Y is true”?
- close04 7y agoNo, parent just confuses "design" with "implementation", and asserts that "secure by design" (even if taken as more than a marketing slogan) implies 0 bugs. The logic is flawed, the conclusion is wrong, and the presentation is needlessly aggressive. Their comment history just confirms this.
- mastazi 7y agoClearly parent is not suggesting that Apple designs are intentionally insecure. Your response is as much needlessly aggressive as parent’s comment.
- umvi 7y agoI remember Apple's marketing in 2005: "I'm a Mac." "And I'm a PC. Achoo!" "What's wrong PC?" "I have a cold." "Huh, too bad. Macs don't get viruses." "You never have any security vulnerabilities that get exploited?" "Nope. Macs just work." The End
- deleted 7y ago[deleted]
- 7y ago
- acd 7y agoGood news from an open source point of view for the iphone boot loader. This opens up the possibility for example to boot Linux on Iphones.
- dvcrn 7y agoWhy would you want to do that?
- panpanna 7y agoThis is Hacker News. Why wouldn't you?
- rvz 7y agoOther than dual-booting Android on the iPhone, I fail to see any other credibly useful reason to run the Linux kernel or some Linux distro on an iDevice. To each to their own I guess.
- simonmales 7y agoI have a gifted iPad 2 collecting dust. IMHO the hardware is quite capable. Meaning that it would be a very convenient headless server with its own UPS. Similarly to custom ROMs for Android breath new life in non supported devices, I believe running Linux on an old iDevice would be simple way to get perfectly good hardware doing something again.
- yladiz 7y agoAs someone who doesn’t really know much about this, I wonder, would it be possible for iOS to understand (not prevent or fix) that this exploit has occurred and if so what benefits would there be to know?