8 ms·

All it's doing is POSTing the contents of /private/var/mobile/Library/SMS/sms.db to a server. You can't get an app into the app store that haz the required per

All it's doing is POSTing the contents of /private/var/mobile/Library/SMS/sms.db to a server. You can't get an app into the app store that haz the required permissions to access that file. Solution: Dont install apps outside the app store.

aeternum 7y ago
The permission is within a XML comment so how sure are you that this would be caught as part of app store review? Since apps now auto-update each night any one of your apps could theoretically add this code tonight couldn't they?
- mike_d 7y ago
  Apple knows how entitlements work and scan every release you try to upload for distribution. The app bundle is signed with an Apple signing key when it goes live, so you can't just randomly change the file once it is on the device.
  - saagarjha 7y ago
    Evidently Apple does not know how they work, as their multiple parsers can’t get them right ;)
  - nwsm 7y ago
    If their scan included an XML parser with the same flaw as CFPropertyListCreateWithData, then yes you could get it published without them noticing.
- neximo64 7y ago
  Apple tracks every time you change it and manually reviews it. In even more sophisticated means after what Uber did.
  - saagarjha 7y ago
    Note that Uber was given that entitlement by Apple. It was explicitly granted an exception to use a private entitlement (which is in of itself unusual) and then submit such an app to the App Store.
  - aeternum 7y ago
    Apple's XML parsers apparently are not catching this due to the comment trick. So the security relies on a human catching it. There are many ways to hide text from a human, IE padding it out with whitespace, character encoding tricks, etc.
soulofmischief 7y ago
That's not a real solution when we know Apple's walled garden is so restrictive.
- kennywinker 7y ago
  I've used iOS for over a decade without needing to install apps outside of the app store. I would guess that the vast majority of iOS users share that experience. I understand you might be frustrated by those limitations, but to say "hold off on this until it's fixed" seems pretty reasonable. It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall.
  - soulofmischief 7y ago
    "hold off on this until it's fixed" is definitely reasonable. However, that's not what OP said. OP said, "Dont install apps outside the app store." That reminds me of the kind of apologetic advice I get from the Microsoft community when dealing with Windows' strange behavior and anti-user choices. > It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall. You're conflating two separate issues. Microsoft has a certification program for Windows programs, Linux has extremely nuanced permissions, SELinux, etc. This has been solved elsewhere but the walled garden of iOS is deliberately ill-designed and is not a robust solution.
    - oarsinsync 7y ago
      As a technical user, I share in your frustrations. iOS may be more secure out of the box, but it's an all-or-nothing solution. Either you take what they give you and put your faith in the almighty Apple, or you break out and have no protection at all. Unlike other platforms, where there is a range of options to us, where if we work hard enough, we can make our platform more secure, while still maintaining our freedom to do as we please, because we know what we're doing. That said, I remain grateful that there's at least one mass consumer facing platform that is secure by default and user friendly. For the vast majority of the world, this is more valuable than the ability to tinker. For me personally, it ends up being a toss up. I lament my restrictions, but I'm grateful for the significantly reduced amount of technical support I'm required to do now compared to the (good|bad|^$) old days when a PC / laptop was everyone's primary computing device.
jackjeff 7y ago
You’re missing the point: - AppStore or not, you should not be able to access this file in an app. The exploit (plist parsing bug) is about breaking out of the sandbox and getting the permission to access system files (and much more!). - Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially. Or maybe I should have said “was”. Best case scenario Apple would retroactively check for naughty plist files in Apps submitted to the AppStore present and past, and ban developers that used the same hack. That being said, this is reactive and the damage would already be done. This hack is not using a private API or doing something that Apple would have caught during App review. Even the system file path could be obfuscated (or downloaded from Internet later on). So “don’t install apps outside the App Store” did not really help in this case.
- objclxt 7y ago
  > Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially. That's not accurate, the entitlements parsing logic on the App Store submission system has always caught this, it's the client side parsing that doesn't. You can't submit an app to the store that uses this exploit, because the store will reject it as having invalid entitlements.
  - jannes 7y ago
    Do you know if TestFlight uses the same entitlements parsing logic? It may have been possible to exploit users' devices through beta versions.
    - saagarjha 7y ago
      TestFlight apps are uploaded to App Store Connect as well.
  - jackjeff 7y ago
    Indeed. I was wrong to assume Apple would not have yet another XML Parser somewhere else :) In that case it would only work with side loaded Apps signed with enterprise and developer certificates. I stand corrected. That being said I wonder... since we have two parsers on the device and one in submission process, if a more clever variant of this bug would have worked... I guess we will never know. For sure that parser is rock solid now.
madeofpalk 7y ago
> You can't get an app into the app store that haz the required permissions to access that file The one thing that was never clear to me was whether Apps were able to be submitted to the store with this buggy entitlesments file.
BiteCode_dev 7y ago
That's a terrible solution. Giving full control to one company of the thing that can be published, discovered an install is a receipe for all what's wrong with monocultures. Don't get me wrong, the app store is a fine service. And that it's the default experience for beginners is a reasonable compromise. But assuming it as the only channel is like a hospital refusing to heal people that eat processed meat because WHO declared it carcinogen.

aeternum 7y ago

The permission is within a XML comment so how sure are you that this would be caught as part of app store review? Since apps now auto-update each night any one of your apps could theoretically add this code tonight couldn't they?

mike_d 7y ago
Apple knows how entitlements work and scan every release you try to upload for distribution. The app bundle is signed with an Apple signing key when it goes live, so you can't just randomly change the file once it is on the device.
- saagarjha 7y ago
  Evidently Apple does not know how they work, as their multiple parsers can’t get them right ;)
- nwsm 7y ago
  If their scan included an XML parser with the same flaw as CFPropertyListCreateWithData, then yes you could get it published without them noticing.
neximo64 7y ago
Apple tracks every time you change it and manually reviews it. In even more sophisticated means after what Uber did.
- saagarjha 7y ago
  Note that Uber was given that entitlement by Apple. It was explicitly granted an exception to use a private entitlement (which is in of itself unusual) and then submit such an app to the App Store.
- aeternum 7y ago
  Apple's XML parsers apparently are not catching this due to the comment trick. So the security relies on a human catching it. There are many ways to hide text from a human, IE padding it out with whitespace, character encoding tricks, etc.

soulofmischief 7y ago

That's not a real solution when we know Apple's walled garden is so restrictive.

kennywinker 7y ago
I've used iOS for over a decade without needing to install apps outside of the app store. I would guess that the vast majority of iOS users share that experience. I understand you might be frustrated by those limitations, but to say "hold off on this until it's fixed" seems pretty reasonable. It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall.
- soulofmischief 7y ago
  "hold off on this until it's fixed" is definitely reasonable. However, that's not what OP said. OP said, "Dont install apps outside the app store." That reminds me of the kind of apologetic advice I get from the Microsoft community when dealing with Windows' strange behavior and anti-user choices. > It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall. You're conflating two separate issues. Microsoft has a certification program for Windows programs, Linux has extremely nuanced permissions, SELinux, etc. This has been solved elsewhere but the walled garden of iOS is deliberately ill-designed and is not a robust solution.
  - oarsinsync 7y ago
    As a technical user, I share in your frustrations. iOS may be more secure out of the box, but it's an all-or-nothing solution. Either you take what they give you and put your faith in the almighty Apple, or you break out and have no protection at all. Unlike other platforms, where there is a range of options to us, where if we work hard enough, we can make our platform more secure, while still maintaining our freedom to do as we please, because we know what we're doing. That said, I remain grateful that there's at least one mass consumer facing platform that is secure by default and user friendly. For the vast majority of the world, this is more valuable than the ability to tinker. For me personally, it ends up being a toss up. I lament my restrictions, but I'm grateful for the significantly reduced amount of technical support I'm required to do now compared to the (good|bad|^$) old days when a PC / laptop was everyone's primary computing device.

jackjeff 7y ago

You’re missing the point: - AppStore or not, you should not be able to access this file in an app. The exploit (plist parsing bug) is about breaking out of the sandbox and getting the permission to access system files (and much more!). - Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially. Or maybe I should have said “was”. Best case scenario Apple would retroactively check for naughty plist files in Apps submitted to the AppStore present and past, and ban developers that used the same hack. That being said, this is reactive and the damage would already be done. This hack is not using a private API or doing something that Apple would have caught during App review. Even the system file path could be obfuscated (or downloaded from Internet later on). So “don’t install apps outside the App Store” did not really help in this case.

objclxt 7y ago
> Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially. That's not accurate, the entitlements parsing logic on the App Store submission system has always caught this, it's the client side parsing that doesn't. You can't submit an app to the store that uses this exploit, because the store will reject it as having invalid entitlements.
- jannes 7y ago
  Do you know if TestFlight uses the same entitlements parsing logic? It may have been possible to exploit users' devices through beta versions.
  - saagarjha 7y ago
    TestFlight apps are uploaded to App Store Connect as well.
- jackjeff 7y ago
  Indeed. I was wrong to assume Apple would not have yet another XML Parser somewhere else :) In that case it would only work with side loaded Apps signed with enterprise and developer certificates. I stand corrected. That being said I wonder... since we have two parsers on the device and one in submission process, if a more clever variant of this bug would have worked... I guess we will never know. For sure that parser is rock solid now.

madeofpalk 7y ago

> You can't get an app into the app store that haz the required permissions to access that file The one thing that was never clear to me was whether Apps were able to be submitted to the store with this buggy entitlesments file.

BiteCode_dev 7y ago

That's a terrible solution. Giving full control to one company of the thing that can be published, discovered an install is a receipe for all what's wrong with monocultures. Don't get me wrong, the app store is a fine service. And that it's the default experience for beginners is a reasonable compromise. But assuming it as the only channel is like a hospital refusing to heal people that eat processed meat because WHO declared it carcinogen.