4 ms·

so...as a dumb consumer, how do i protect myself from this?

noident 7y ago
Always promptly install security updates. Other than that, there is no protection from this specific class of vulnerabilities. There are other good security practices a slightly savvier user can follow, like running a soft firewall and installing fewer apps, but they wouldn't mitigate this vulnerability.
- dylan604 7y ago
  This sounds nice in practice, but real world says that there is a greater than zero chance that the quickly released patch can have a negative affect on your device up to bricking the device. As a long time Apple user, I never install version X.0. I wait until at least X.0.1.
  - why-oh-why 7y ago
    I think you’re mistaking the stability of Apple’s x.0 releases as “negative effects” of security patches. x.0 releases do a lot more than patching. Security updates are much smaller and more frequent than even x.x.1 updates
    - dylan604 7y ago
      There are is such thing as a "security patch" for iOS. If they release an update, they are releasing features as well. How quickly we forget the debacle that is iOS13. This was not a smooth deployment[0]: 13.0.0 9/19/19 13.1 9/24/19 13.1.1 9/27/19 13.1.2 9/30/19 13.1.3 10/15/19 I wait a couple of days to make sure updates are not bricking devices. Waiting just a week saw 3 updates and a 4th within 10 days. Some of those updates saw serious crippling of capabilities of the device after the update. [0] https://en.wikipedia.org/wiki/IOS_version_history#iOS_13 https://en.wikipedia.org/wiki/IOS_version_history#iOS_13
      - why-oh-why 7y ago
        Oops, I was talking about macOS releases, not iOS. The numbers don’t match between the two
ehsankia 7y ago
Project Zero usually releases the details 90 days after they've found the exploit, giving hopefully ample time for Apple to patch the bug. So assuming they have, simply being on the latest version means you are safe.
- saagarjha 7y ago
  > This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019). > The vulnerability was first mitigated in iOS 12.4.1, released on August 26, by making the vulnerable code unreachable over iMessage, then fully fixed in iOS 13.2, released on October 28 2019. (From the previous blog post in the series.)
- bigiain 7y ago
  That's also assuming Project Zero found this first...
  - ehsankia 7y ago
    I guess it depends if the question was a more general "how do I project myself from zero day" or "how do I protect myself from this specific zero day". For the latter, yes someone could've been exploiting it in the past, but right now, it's been patched for some months and if you're up to date, you should be safe.
armitron 7y ago
There is no protection against adversaries that have the resources it takes to stockpile exploits like these. Feel good in that you are probably not important enough for them to target you..
- bigiain 7y ago
  I wonder if Jamal Khashoggi considered himself "important enough"? Or his Canadian friend Omar Abdulaziz? https://www.washingtonpost.com/world/middle_east/khashoggi-friend-sues-israeli-firm-over-hacking-he-says-contributed-to-the-journalists-murder/2018/12/03/ddcb28ee-f708-11e8-8642-c9718a256cbd_story.html https://www.washingtonpost.com/world/middle_east/khashoggi-f...
  - armitron 7y ago
    If not, they should have.
crispyporkbites 7y ago
Don't use any machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via computer programming. Assume every electronically programmable device can, has been and will be compromised at now or at some point in the future.

Always promptly install security updates. Other than that, there is no protection from this specific class of vulnerabilities. There are other good security practices a slightly savvier user can follow, like running a soft firewall and installing fewer apps, but they wouldn't mitigate this vulnerability.

dylan604 7y ago
This sounds nice in practice, but real world says that there is a greater than zero chance that the quickly released patch can have a negative affect on your device up to bricking the device. As a long time Apple user, I never install version X.0. I wait until at least X.0.1.
- why-oh-why 7y ago
  I think you’re mistaking the stability of Apple’s x.0 releases as “negative effects” of security patches. x.0 releases do a lot more than patching. Security updates are much smaller and more frequent than even x.x.1 updates
  - dylan604 7y ago
    There are is such thing as a "security patch" for iOS. If they release an update, they are releasing features as well. How quickly we forget the debacle that is iOS13. This was not a smooth deployment[0]: 13.0.0 9/19/19 13.1 9/24/19 13.1.1 9/27/19 13.1.2 9/30/19 13.1.3 10/15/19 I wait a couple of days to make sure updates are not bricking devices. Waiting just a week saw 3 updates and a 4th within 10 days. Some of those updates saw serious crippling of capabilities of the device after the update. [0] https://en.wikipedia.org/wiki/IOS_version_history#iOS_13 https://en.wikipedia.org/wiki/IOS_version_history#iOS_13
    - why-oh-why 7y ago
      Oops, I was talking about macOS releases, not iOS. The numbers don’t match between the two

ehsankia 7y ago

Project Zero usually releases the details 90 days after they've found the exploit, giving hopefully ample time for Apple to patch the bug. So assuming they have, simply being on the latest version means you are safe.

saagarjha 7y ago
> This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019). > The vulnerability was first mitigated in iOS 12.4.1, released on August 26, by making the vulnerable code unreachable over iMessage, then fully fixed in iOS 13.2, released on October 28 2019. (From the previous blog post in the series.)
bigiain 7y ago
That's also assuming Project Zero found this first...
- ehsankia 7y ago
  I guess it depends if the question was a more general "how do I project myself from zero day" or "how do I protect myself from this specific zero day". For the latter, yes someone could've been exploiting it in the past, but right now, it's been patched for some months and if you're up to date, you should be safe.

armitron 7y ago

There is no protection against adversaries that have the resources it takes to stockpile exploits like these. Feel good in that you are probably not important enough for them to target you..

bigiain 7y ago
I wonder if Jamal Khashoggi considered himself "important enough"? Or his Canadian friend Omar Abdulaziz? https://www.washingtonpost.com/world/middle_east/khashoggi-friend-sues-israeli-firm-over-hacking-he-says-contributed-to-the-journalists-murder/2018/12/03/ddcb28ee-f708-11e8-8642-c9718a256cbd_story.html https://www.washingtonpost.com/world/middle_east/khashoggi-f...
- armitron 7y ago
  If not, they should have.

crispyporkbites 7y ago

Don't use any machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via computer programming. Assume every electronically programmable device can, has been and will be compromised at now or at some point in the future.