6 ms·
Wait, why does this make iOS better? This breaks the security guarantees I expected from the phone.
by strstr 7y ago
Wait, why does this make iOS better? This breaks the security guarantees I expected from the phone.
- unnouinceput 7y agoI believe he meant in the future versions of iOS. Once this is public Apple can take the necessary steps to patch this on future products. If it wasn't published, then Apple would, guessing here, leave it as is for future products. My 2 cents.
- TAForObvReasons 7y agoNintendo Switch suffered from a similar problem (usb bootrom exploit https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md https://github.com/Qyriad/fusee-launcher/blob/master/report/...) and the company has been watching the homebrew and other communities closely to patch the entire exploit chain as people discover exploits. No doubt the OS and platform is a lot more secure thanks to the community
- arkadiyt 7y agoiOS is such a walled garden that security researchers have a very difficult time gaining low level access on the phone. This has incentivized researchers to keep vulnerabilities they find for themselves rather than disclose them to Apple, so that they can use the vulnerabilities to gain the low level access needed for additional exploration. The Checkm8 author posits that by providing people this access via his exploit, researchers will submit their known vulnerabilities to Apple and make iOS safer.
- erichurkman 7y agoComing next year: pre-rooted devices specifically for security research, though likely with well established groups. https://thenextweb.com/apple/2019/08/08/apple-announces-developer-iphones-with-root-access-for-security-research/ https://thenextweb.com/apple/2019/08/08/apple-announces-deve...
- vuln 7y agoSurely you mean nation state actors.
- Thorrez 7y agoWhy do you believe that? Apple made quite a lot of news by refusing to unlock the iPhone 5C from the San Bernardino shooting. Helping nation state actors find vulnerabilities would be contrary to their previous actions.
- sambe 7y agoNot really. Helping nation state (any) actors gain access to user data would be contrary to their previous actions. Helping experts research vulnerabilities is a calculated risk that the good guys will reveal bugs at a similar rate or faster than the bad guys, whilst also disincentivising the hoarding.
- Thorrez 7y agoI don't understand. vuln seemed to be suggesting Apple would give pre-jailbroken devices to governments to find vulnerabilities with instead of giving them to established white hat researchers. I don't see how that would help good guys reveal bugs.
- webninja 7y agoIt means bug bounty hunters can jailbreak any version of their phone to turn it into a listening honeypot. Then they can take it to China, let the PRC re-exploit it, record the new exploit, then sell the exploit to Apple for $1 Million Dollars and retire in the Bahamas. You wouldn’t be able to turn your iPhone into a honeypot without this otherwise.