5 ms·
Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everythin
by canofbars 6y ago
Apple needs to do a serious architecture of how its own apps work. Its clearly unacceptable that their own apps are not sandboxed to the same level as everything else. If its not possible to implement all of imessage with the public APIs then they need to find a way to expose those private APIs publicly in a safe way.
imessage and facetime have been a constant source of exploits.
- jojobas 6y agoThey didn't build themselves a tiered walled garden to be on an equal footing with others, either capability or speed-wise.
- grezql 6y agoI wonder if this weakens their "security" argument in the appstore walled garden case.
- mhh__ 6y agoIt seems like a fairly slam dunk argument that at very least they can't be trusted to do it of their own accord.
- mhh__ 6y agoThis is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.
- lemonspat 6y agoI look at the “Apple cares about privacy” as a qualified “more than them other OS &mobile firms”, not “enough that you should blindly trust us”. No one’s security is perfect
- coddle-hark 6y agoIncluding your own! A big part of opsec is putting systems in place that mitigate dangerous but unavoidable human behaviour.
- canofbars 6y agoApples security model seems to mostly be based on fixing issues fast and pushing them out to almost all users. That means the only people at risk are those worth burning a brand new exploit on. The average consumer is pretty safe.
- verroq 6y agoWhen it come to security (and literally everything else), don't even both with with the "trust" part and skip directly to "verify".
- amluto 6y agoIt’s not just the lack of sandboxing — iMessage uses language-level serialization of object graphs. This design is never suitable for sending across privilege boundaries. Apple should replace the format with a reasonable wire format. If this requires updates to apps that integrate with iMessage or breaks interoperability with older iOS versions, so be it.
- SV_BubbleTime 6y agoCan you explain a bit? Are you saying they send messages as Swift objects/structures directly? Instead of a serialization like JSON/CBOR/Proto/Proprietary/etc?
- toyg 6y agoI don’t expect anything as old and critical as iMessage is written on Swift. Chances are it’s all Objective C underneath.
- saagarjha 6y agoI hear that parts of the app have been rewritten in Swift: https://twitter.com/5aelo/status/1340995243320205313 https://twitter.com/5aelo/status/1340995243320205313
- amluto 6y agoSearch through https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html https://googleprojectzero.blogspot.com/2019/08/the-fully-rem... for NSKeyedUnarchiver. This seems to be functionally much like Python’s pickle, Boost.Serialization, Java’s object serialization, etc. These techniques seem clever, and they are genuinely useful for prototyping and for certain applications that inherently have no security concerns, but they are not at all suitable for network use. Fundamentally, for network use, one should define a data format, an API, etc and implement it. Using object serialization is backwards — it’s writing the code and then asking a framework to magically network it, and the result is that it networks it too much. (There are a few systems for writing code and a network protocol simultaneously that treat security as a first-class consideration. The E language comes to mind. I still wouldn’t use E objects to represent data for interoperability reasons if nothing else. But ObjC is not E, and Apple’s design is inexcusable in 2020.)
- iJohnDoe 6y agoApple has never devoted enough care, resources, or money to cybersecurity. It’s just a fact. They’ve also never devoted enough care, resources, or money to network architecture and how important availability is (with fairness, they have improved in this area in the last couple of years due to the major iCloud outages they had). Apple doesn’t hire mainstream IT people and cybersecurity people from the enterprise realms. There is a vast amount of talented people and knowledge they simply ignore because the Apple culture is too hip and cool for that. Steve Jobs is primarily the blame for all the above. He treated the departments and any person that cared about enterprise like dirt. Steve Jobs always said Apple is a consumer company. This philosophy has obviously carried on.
- Quarrelsome 6y agobut which tech companies do devote enough care, resources and money to cybersecurity? I always figured the industry never really rewarded those things over aspects (e.g. time to market).
- marcan_42 6y ago"Cybersecurity" is a meaningless buzzword, but I can give you more specific statement. Which tech companies devote enough care and have competent personnel working on embedded consumer device security? Answer: Apple and Microsoft (Xbox group). (Google is nowhere close because they don't design their own silicon, and the OEMs they rely on are incompetent in this field, so their efforts can only go so far, no amount of hiring competent sec folks will fix that problem).
- jnwatson 6y agoThey absolutely do hire cybersecurity folks from enterprise companies. Source: I know them.
- iJohnDoe 6y agoThat is wonderful news. Thanks for the update.
- 6y ago
- tbodt 6y agoiMessage is not being attacked because it's not as sandboxed as other apps. It's being attacked because it's accessible with zero clicks. For an attack like this you need to chain an iMessage exploit with an LPE, and the LPE can be launched from any other app.
- ronnier 6y agoLPE. What is an LPE?
- pertymcpert 6y agoNot sure, but it might mean Local Privilege Escalation. It’s one thing to take control of the iMessage process, it’s another to then gain kernel level access.
- saagarjha 6y agoYes, it means local privilege escalation.
- saagarjha 6y agoIn this case it might not be necessary to escalate privileges, as iMessage itself may have been the target.
- aex 6y agoiOS and macOS don’t allow to delete many of their apps. Why on earth I have to have iMessage if I don’t use it?
- neop1x 6y agoIt is hard to read and impossible to send an SMS on iPad without activating iMessage. I don't understand why this hasn't been considered anti-competitive behavior already. It is completely normal to send and receive SMS messages on Android tablets...