4 ms·
> Apple's probably not going to let an app exploiting this zeroday into its App Store... Are you sure about this? I'm far removed from the app store developme
by kevin_nisbet 6y ago
> Apple's probably not going to let an app exploiting this zeroday into its App Store...
Are you sure about this?
I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application??
Sorry, I could be missing something, just curious why this couldn't occur in the app store.
- saagarjha 6y agoI think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.
- yunruse 6y agoIt is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.
- saagarjha 6y agoThat is likely true, but slipping in a call to list_lio would be really easy to do. Even if they had a check for the syscall instruction in this case, you could just ROP your way to libc…
- wolco 6y agoIt would probably kill snapchat and force many groups to other platforms.
- wrkronmiller 6y agoIt’s possible for both to happen. People might switch chat apps in the short term, but reconsider buying an iPhone in the next cycle (esp. if Apple makes a habit of killing off popular apps).