3 ms·
So these could result in a no-click 0day on iOS? Thanks Google for finding and reporting these to Apple. I wonder how often vulnerabilities found by Google Zer
by panpanna 6y ago
So these could result in a no-click 0day on iOS? Thanks Google for finding and reporting these to Apple.
I wonder how often vulnerabilities found by Google Zero were already known and exploited by hackers without anyone noticing.
I mean, GZ is pretty open about their methodology. It doesn't require a rocket scientist to duplicate them with different targets.
- nielsbot 6y agoIf you're talking about state actors, I'd bet real money that they have these and in fact have an infrastructure that makes finding and exploiting them fast and easy.
- panpanna 6y agoI am not even about them, just some regular guy with interest in computer security. Author did this on a Mac mini so no real horsepower required either.
- kevingadd 6y agoThere have been a couple cases where Project Zero ended up identifying and reporting vulnerabilities that were actively being used to target vulnerable audiences (minorities, activists, journalists, etc). Here's one: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... Note that in my example Google says the attacks were not targeted - this is true in the sense that they indiscriminately attacked anyone visiting those websites. Unfortunately the websites selected were specific and it later turned out that this was in fact used to attack some specific targets - journalists and activists, iirc.