6 ms·

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should b

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.

nerdbaggy 7y ago
Apple isn’t really known for doing recalls until they absolutely have to
- dylan604 7y ago
  "Take the number of 'iPhones' in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." A modified version of the movie quote to fit the discussion
  - giancarlostoro 7y ago
    "the movie quote" = Fight Club, since yes, there's people who have not seen that movie, but we don't talk about that.
- xvector 7y ago
  Which makes sense too. If Apple was negligent in the security space and these flaws were common then I would be all for a recall. But Apple clearly has not been negligent in this space and they really have put forth best effort.
wklauss 7y ago
> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).
- dguido 7y ago
  It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
  - deleted 7y ago
    [deleted]
  - justicz 7y ago
    Ha, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume down -> power, not sure if that works at a lower level.
    - kvakil 7y ago
      Seems likely that the hard reset works on a lower level as it works even if the phone is hung.
    - dguido 7y ago
      Yes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.
      - justicz 7y ago
        I’m a little confused, which part of my comment would require persistence? I was suggesting a lulzy payload that would prevent the user from _actually_ restarting their device by changing the behavior of the power button. As a means of bypassing the “just restart your phone every time you use it” countermeasure.
n1000 7y ago
With roughly 1 billion iOS devices in use that might be an expensive recall.
Angostura 7y ago
You're talking about 100s of millions of devices - I can see why Apple would prefer not.

nerdbaggy 7y ago

Apple isn’t really known for doing recalls until they absolutely have to

dylan604 7y ago
"Take the number of 'iPhones' in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." A modified version of the movie quote to fit the discussion
- giancarlostoro 7y ago
  "the movie quote" = Fight Club, since yes, there's people who have not seen that movie, but we don't talk about that.
xvector 7y ago
Which makes sense too. If Apple was negligent in the security space and these flaws were common then I would be all for a recall. But Apple clearly has not been negligent in this space and they really have put forth best effort.

wklauss 7y ago

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

dguido 7y ago
It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
- deleted 7y ago
  [deleted]
- justicz 7y ago
  Ha, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume down -> power, not sure if that works at a lower level.
  - kvakil 7y ago
    Seems likely that the hard reset works on a lower level as it works even if the phone is hung.
  - dguido 7y ago
    Yes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.
    - justicz 7y ago
      I’m a little confused, which part of my comment would require persistence? I was suggesting a lulzy payload that would prevent the user from _actually_ restarting their device by changing the behavior of the power button. As a means of bypassing the “just restart your phone every time you use it” countermeasure.

n1000 7y ago

With roughly 1 billion iOS devices in use that might be an expensive recall.

Angostura 7y ago

You're talking about 100s of millions of devices - I can see why Apple would prefer not.