19 ms·

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh

> By 1 AM, I had sent Apple a POC and my analysis. > Still, I'm very happy that Apple patched this issue in a timely manner once the exploit became public. Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue? Apple's probably not going to let an app exploiting this zeroday into its App Store and sideloading is difficult; it's very unlikely someone malicious is going to trick people into installing malware that uses this exploit. It sounds to me like Apple is purposefully limiting consumer freedom by actively trying to prevent jailbreaking.

curiousgal 6y ago
I 100% agree but then again, people choose to buy those products so..
bzb3 6y ago
There are lots of ways apps can run arbitrary code, so stopping them via the app store is not feasible. Myself I'm happy my phone is safer.
kevin_nisbet 6y ago
> Apple's probably not going to let an app exploiting this zeroday into its App Store... Are you sure about this? I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application?? Sorry, I could be missing something, just curious why this couldn't occur in the app store.
- saagarjha 6y ago
  I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.
  - yunruse 6y ago
    It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.
    - saagarjha 6y ago
      That is likely true, but slipping in a call to list_lio would be really easy to do. Even if they had a check for the syscall instruction in this case, you could just ROP your way to libc…
    - wolco 6y ago
      It would probably kill snapchat and force many groups to other platforms.
      - wrkronmiller 6y ago
        It’s possible for both to happen. People might switch chat apps in the short term, but reconsider buying an iPhone in the next cycle (esp. if Apple makes a habit of killing off popular apps).
aSockPuppeteer 6y ago
It’s always a snake eating it’s tail scenario with jailbreaking. Apple takes popular tweaks and integrates them with the next IOS. Side-loading isn’t that bad but the method keeps changing...Usually for the better. Jail breaking cuts into their profit a small amount because the community is small. https://www.reddit.com/r/jailbreak https://www.reddit.com/r/jailbreak The benefits are very much worth it though. Most have had iOS 13 features since iOS 11/12. They have iOS 14 features now. Then there are other features that may not be released ever but people find them invaluable. Ex: Per app specific Firewall per website. (Block tracking/ads) -Disable apps ability to spy on your clipboard. -Disable apps from accessing things you do not want them to but still launch. -Themes, so many options: remove your status bar or put new things there. -Custom widgets -Detailed wifi, phone information -Download old versions of apps because the company broke something. -Detailed phone/memory/cpu info -Terminal access. Those are just a few off the top of my head.
- BEEdwards 6y ago
  Or you could just buy an android and not worry about it. Not even to fan boy, but half of those are things that android did from the go and the rest have been added or are generally easy to do.
  - zaptrem 6y ago
    But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, and (for the most part) rock solid and extremely efficient OS.
    - Wingman4l7 6y ago
      You better hope they don't ever bring their premium-priced laptop "hardware quality" to their phones -- failing GPUs, failing monitor ribbon cables, failing keyboards...
      - paulmd 6y ago
        ipad pros are already there, they're so thin they can arrive bent right out of the box. ipads and iphones are amazing hardware in every other respect but Apple really needs to chill with the ultra-thin fetish. (same goes for their PC hardware, but the hardware is not particularly amazing there.)
olliej 6y ago
Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.
- saagarjha 6y ago
  Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…
  - djrogers 6y ago
    If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.
    - saagarjha 6y ago
      The problem is not running arbitrary code, but running arbitrary code without informed consent. Malware runs without consent. Apple's solution for iOS is removing the ability to run anything completely, bypassing the need to figure out how to obtain consent.
      - jsjohnst 6y ago
        > bypassing the need to figure out how to obtain consent How do you propose getting “informed” consent from an audience who doesn’t care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn’t seem the least bit a solved problem anywhere.
        saagarjha 6y ago
        It's not an easy problem! But Apple should work on solving it–they have already put in some effort in this direction on macOS, although they have their hands tied behind their back there because they're going from unrestrictive → restrictive and such changes usually break things and make people angry. On iOS they pretty much have a "clean slate" with which to start with. Usually, solutions in this area generally have a couple of characteristics: the first is that the "secure" case is generally useful for 95+% of people, to the point that they might not even know that there are other "modes" that are more permissive. The second is putting surmountable but significant barriers in place to prevent disabling these features, in an attempt to prevent casual/unintentional deactivation. Strange key combinations that lead to scary text and wiping the device seem to be fairly effective in keeping out people who cannot give informed consent. And a third is allowing a user-specified root of trust: for example, one can imagine an iPhone that is every bit as secure as any other iPhone today because I have enabled all the security features, but it's using my keys to attest against instead of Apple's. There's a lot of interesting work being done in this area: one I personally like is Chromebooks, which have the dual purpose of being secure, "locked-down" devices for general consumer use, but also for being useful for development work. And there we're seeing interesting solutions such as using KVM to run an isolated Linux, developer mode, write protect screws, …
ehsankia 6y ago
The second paragraph of the article covers this: > I wanted to find the vulnerability used in unc0ver and report it to Apple quickly in order to demonstrate that obfuscating an exploit does little to prevent the bug from winding up in the hands of bad actors.
- stefan_ 6y ago
  Maybe this should read "that obfuscating an exploit does little to prevent the bug from winding up in the hands of a talented full time security researcher". Of course if he was this talented, surely he would routinely diff new kernel versions and realize the old bug had been reintroduced before having to rediscover it in a jailbreak?
  - ueouieodue 6y ago
    I'd make sure I had a solid foundational basis before calling anyone on the PZ team untalented ;) He abused the jailbreak to cause a crash. A talented researcher would try that before diffing kernel binaries.
  - ehsankia 6y ago
    > talented full time security researcher If a single security researcher can de-obfuscate it in under a day, then a nation state with huge funding can too. Maybe not in a day, but eventually.
draw_down 6y ago
Well, either you think security vulns are bad or you don’t. I think they’re bad, just kinda crazy like that I suppose.
lilyball 6y ago
The existence of jailbreaking fundamentally breaks the security of the device. It means any malicious app that manages to get on your device can turn into a full system compromise. It means any RCE can as well.
- realusername 6y ago
  It always depends on which side of "security" we're talking about. You could argue that not having access to security tweaks & not being able to see what's going on because the OS is so locked down is a security issue in itself which can be solved by jailbreaking. Currently, sharing security issues with Apple is a guaranteed that the tooling you are using to get access to your device won't work anymore, there's definitely an bad incentive to not report security flaws at the moment.
  - tptacek 6y ago
    That's right, which is why we called it "jailbreaking" in the 1990s when someone got mad at you on IRC and jailbroke your machine and stole your mail spool. I mean, jailbroke your mail spool. I take your point, which is that jailbreaking is good if what you want is to run random unapproved code on your machine. But you didn't seriously engage with the comment you rebutted, because it is also true that jailbreak prevention prevents persistent kernel compromise --- is in fact a predicate for preventing persistent kernel compromise --- which is a thing that really does happen; in fact, it's far more relevant to the overwhelming majority of Apple users than running unapproved code is.
    - realusername 6y ago
      I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine. To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter control on apps you also need to be jailbroken. I mean, you get the point. Any action you could do regarding security requires you to be jailbroken first.
swiley 6y ago
> unless you disable auto-updates and tap "Later" on every update notification Some of us do that for this exact reason. I wish there was a way for me to just pick software to give root to though, this is way less secure.
- the_pwner224 6y ago
  This is how it works on Android. Generally on a rooted phone you have a 'manager' like Magisk or Superuser. The first time an application tries to use root, the manager makes a popup and allows you to grant permission temporarily or forever.

curiousgal 6y ago

I 100% agree but then again, people choose to buy those products so..

bzb3 6y ago

There are lots of ways apps can run arbitrary code, so stopping them via the app store is not feasible. Myself I'm happy my phone is safer.

kevin_nisbet 6y ago

> Apple's probably not going to let an app exploiting this zeroday into its App Store... Are you sure about this? I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application?? Sorry, I could be missing something, just curious why this couldn't occur in the app store.

saagarjha 6y ago
I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.
- yunruse 6y ago
  It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.
  - saagarjha 6y ago
    That is likely true, but slipping in a call to list_lio would be really easy to do. Even if they had a check for the syscall instruction in this case, you could just ROP your way to libc…
  - wolco 6y ago
    It would probably kill snapchat and force many groups to other platforms.
    - wrkronmiller 6y ago
      It’s possible for both to happen. People might switch chat apps in the short term, but reconsider buying an iPhone in the next cycle (esp. if Apple makes a habit of killing off popular apps).

aSockPuppeteer 6y ago

It’s always a snake eating it’s tail scenario with jailbreaking. Apple takes popular tweaks and integrates them with the next IOS. Side-loading isn’t that bad but the method keeps changing...Usually for the better. Jail breaking cuts into their profit a small amount because the community is small. https://www.reddit.com/r/jailbreak https://www.reddit.com/r/jailbreak The benefits are very much worth it though. Most have had iOS 13 features since iOS 11/12. They have iOS 14 features now. Then there are other features that may not be released ever but people find them invaluable. Ex: Per app specific Firewall per website. (Block tracking/ads) -Disable apps ability to spy on your clipboard. -Disable apps from accessing things you do not want them to but still launch. -Themes, so many options: remove your status bar or put new things there. -Custom widgets -Detailed wifi, phone information -Download old versions of apps because the company broke something. -Detailed phone/memory/cpu info -Terminal access. Those are just a few off the top of my head.

BEEdwards 6y ago
Or you could just buy an android and not worry about it. Not even to fan boy, but half of those are things that android did from the go and the rest have been added or are generally easy to do.
- zaptrem 6y ago
  But then we miss out on Apple's hardware quality, industry-crushing A-Series processors, and (for the most part) rock solid and extremely efficient OS.
  - Wingman4l7 6y ago
    You better hope they don't ever bring their premium-priced laptop "hardware quality" to their phones -- failing GPUs, failing monitor ribbon cables, failing keyboards...
    - paulmd 6y ago
      ipad pros are already there, they're so thin they can arrive bent right out of the box. ipads and iphones are amazing hardware in every other respect but Apple really needs to chill with the ultra-thin fetish. (same goes for their PC hardware, but the hardware is not particularly amazing there.)

olliej 6y ago

Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use. Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn’t some magical mechanism by which a jailbreak exploit isn’t exploitable but anyone else.

saagarjha 6y ago
Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…
- djrogers 6y ago
  If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.
  - saagarjha 6y ago
    The problem is not running arbitrary code, but running arbitrary code without informed consent. Malware runs without consent. Apple's solution for iOS is removing the ability to run anything completely, bypassing the need to figure out how to obtain consent.
    - jsjohnst 6y ago
      > bypassing the need to figure out how to obtain consent How do you propose getting “informed” consent from an audience who doesn’t care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn’t seem the least bit a solved problem anywhere.
      - saagarjha 6y ago
        It's not an easy problem! But Apple should work on solving it–they have already put in some effort in this direction on macOS, although they have their hands tied behind their back there because they're going from unrestrictive → restrictive and such changes usually break things and make people angry. On iOS they pretty much have a "clean slate" with which to start with. Usually, solutions in this area generally have a couple of characteristics: the first is that the "secure" case is generally useful for 95+% of people, to the point that they might not even know that there are other "modes" that are more permissive. The second is putting surmountable but significant barriers in place to prevent disabling these features, in an attempt to prevent casual/unintentional deactivation. Strange key combinations that lead to scary text and wiping the device seem to be fairly effective in keeping out people who cannot give informed consent. And a third is allowing a user-specified root of trust: for example, one can imagine an iPhone that is every bit as secure as any other iPhone today because I have enabled all the security features, but it's using my keys to attest against instead of Apple's. There's a lot of interesting work being done in this area: one I personally like is Chromebooks, which have the dual purpose of being secure, "locked-down" devices for general consumer use, but also for being useful for development work. And there we're seeing interesting solutions such as using KVM to run an isolated Linux, developer mode, write protect screws, …

ehsankia 6y ago

The second paragraph of the article covers this: > I wanted to find the vulnerability used in unc0ver and report it to Apple quickly in order to demonstrate that obfuscating an exploit does little to prevent the bug from winding up in the hands of bad actors.

stefan_ 6y ago
Maybe this should read "that obfuscating an exploit does little to prevent the bug from winding up in the hands of a talented full time security researcher". Of course if he was this talented, surely he would routinely diff new kernel versions and realize the old bug had been reintroduced before having to rediscover it in a jailbreak?
- ueouieodue 6y ago
  I'd make sure I had a solid foundational basis before calling anyone on the PZ team untalented ;) He abused the jailbreak to cause a crash. A talented researcher would try that before diffing kernel binaries.
- ehsankia 6y ago
  > talented full time security researcher If a single security researcher can de-obfuscate it in under a day, then a nation state with huge funding can too. Maybe not in a day, but eventually.

draw_down 6y ago

Well, either you think security vulns are bad or you don’t. I think they’re bad, just kinda crazy like that I suppose.

lilyball 6y ago

The existence of jailbreaking fundamentally breaks the security of the device. It means any malicious app that manages to get on your device can turn into a full system compromise. It means any RCE can as well.

realusername 6y ago
It always depends on which side of "security" we're talking about. You could argue that not having access to security tweaks & not being able to see what's going on because the OS is so locked down is a security issue in itself which can be solved by jailbreaking. Currently, sharing security issues with Apple is a guaranteed that the tooling you are using to get access to your device won't work anymore, there's definitely an bad incentive to not report security flaws at the moment.
- tptacek 6y ago
  That's right, which is why we called it "jailbreaking" in the 1990s when someone got mad at you on IRC and jailbroke your machine and stole your mail spool. I mean, jailbroke your mail spool. I take your point, which is that jailbreaking is good if what you want is to run random unapproved code on your machine. But you didn't seriously engage with the comment you rebutted, because it is also true that jailbreak prevention prevents persistent kernel compromise --- is in fact a predicate for preventing persistent kernel compromise --- which is a thing that really does happen; in fact, it's far more relevant to the overwhelming majority of Apple users than running unapproved code is.
  - realusername 6y ago
    I don't really have the same opinion on this, I consider the obscurity of the platform a security issue by itself. At the end of the day, remote jailbreak exploits are pretty rare nowadays so you need to have a real access to the machine. To have an idea if an app is sharing your data you need to be jailbroken, to have an idea of what is being sent from your device you need to be jailbroken, to force a stricter control on apps you also need to be jailbroken. I mean, you get the point. Any action you could do regarding security requires you to be jailbroken first.

swiley 6y ago

> unless you disable auto-updates and tap "Later" on every update notification Some of us do that for this exact reason. I wish there was a way for me to just pick software to give root to though, this is way less secure.

the_pwner224 6y ago
This is how it works on Android. Generally on a rooted phone you have a 'manager' like Magisk or Superuser. The first time an application tries to use root, the manager makes a popup and allows you to grant permission temporarily or forever.