4 ms·

If you want to reduce your risk to these 0days: 1. Go to Settings > Password & Accounts. Set Fetch New Data to "Manual" and disable "Push". This will ensure th

by dguido 6y ago

If you want to reduce your risk to these 0days: 1. Go to Settings > Password & Accounts. Set Fetch New Data to "Manual" and disable "Push". This will ensure that new mail is only downloaded when you specifically request it, and it will no longer do so automatically. and/or 2. Use Safari or different e-mail clients such as GMail and Outlook. These mail clients are unaffected by the currently disclosed 0days. There's also no word on whether PAC (a new processor security feature available in current model iPhones) affects exploitation of these bugs. You're safer if you're running a device with an A12 CPU or higher (anything newer than an iPhone XS or XR). You can use the iVerify mobile app to get push notifications when new public exploits for iOS come out. The news feed contains specific instructions to mitigate the impact. See more: https://apps.apple.com/us/app/iverify/id1466120520 https://apps.apple.com/us/app/iverify/id1466120520 https://twitter.com/IsMyPhoneHacked/status/1252954457954009088 https://twitter.com/IsMyPhoneHacked/status/12529544579540090...

snazz 6y ago
With the iVerify app, I'm suspicious of any claim that it can detect threats. How would such a thing work on iOS? My understanding of the security model is that it makes that sort of thing very difficult.
- dguido 6y ago
  iVerify uses a variety of methods to detect if the phone has a security issue. Some of them are deterministic and report with complete certainty. For example, the Volexity report about EVIL EYE includes IOCs for the exploit payload and we can detect and report whether that payload exists on your phone. (read that report here: https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/ https://www.volexity.com/blog/2020/04/21/evil-eye-threat-act...) We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. We walk a thin line to write our checks without violating Apple's rules (e.g., no private APIs). It's certainly not foolproof, there are ways that a malware toolkit could avoid iVerify, but it's a great extra seatbelt to wear. It's also extremely effective at determining exposure to an attack immediately after IOCs are released.
  - saagarjha 6y ago
    > We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. Does this differ significantly from existing jailbreak detection tools, like checking for suspicious-looking files on disk, address-space scans for unexpected code and invalid signatures, and lower-level APIs having different behavior?
    - dguido 6y ago
      There's a substantial limit to public knowledge about those methods and APIs. We've been able to discover more of them, and more that work on current versions of iOS than other teams. Those techniques unfortunately go stale very quickly and most of what you find stopped working in iOS 12 or earlier, yet people still rely on them and think they work.
_bxg1 6y ago
> anything newer than an iPhone XS or XR I think you mean an XS, XR, or anything newer

by dguido 6y ago

snazz 6y ago

With the iVerify app, I'm suspicious of any claim that it can detect threats. How would such a thing work on iOS? My understanding of the security model is that it makes that sort of thing very difficult.

dguido 6y ago
iVerify uses a variety of methods to detect if the phone has a security issue. Some of them are deterministic and report with complete certainty. For example, the Volexity report about EVIL EYE includes IOCs for the exploit payload and we can detect and report whether that payload exists on your phone. (read that report here: https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/ https://www.volexity.com/blog/2020/04/21/evil-eye-threat-act...) We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. We walk a thin line to write our checks without violating Apple's rules (e.g., no private APIs). It's certainly not foolproof, there are ways that a malware toolkit could avoid iVerify, but it's a great extra seatbelt to wear. It's also extremely effective at determining exposure to an attack immediately after IOCs are released.
- saagarjha 6y ago
  > We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. Does this differ significantly from existing jailbreak detection tools, like checking for suspicious-looking files on disk, address-space scans for unexpected code and invalid signatures, and lower-level APIs having different behavior?
  - dguido 6y ago
    There's a substantial limit to public knowledge about those methods and APIs. We've been able to discover more of them, and more that work on current versions of iOS than other teams. Those techniques unfortunately go stale very quickly and most of what you find stopped working in iOS 12 or earlier, yet people still rely on them and think they work.

_bxg1 6y ago

> anything newer than an iPhone XS or XR I think you mean an XS, XR, or anything newer