14 ms·
As always with patches to something of this level (if it is indeed Pegasus related say) it's important to note that if this was a rarified targeted-use exploit
by xoa 5y ago
As always with patches to something of this level (if it is indeed Pegasus related say) it's important to note that if this was a rarified targeted-use exploit before it won't stay that way for long. Now that Apple has released a patch for it widespread reverse engineering will begin immediately and it'll only be a matter of time until packaged exploits become part of standard mass-use toolkits. Having a patch ready to deploy is great, but simultaneously means it's all the more important to get it deployed fairly promptly if it's something that could have serious root/remote execution potential.
Though I suppose if this bug can be used for a jailbreak there may be some people who'd actively want to stay on 14.7 as well. It's too bad on iOS Apple forces people to choose between security and control of their own systems and doesn't at least allow a purchase-time option to have the ability to load ones own root signing certificate.
- throwaway4good 5y agoA lot of people don't update or don't update immediately.
- eruleman 5y agothat's what the emoji's are for.
- colejohnson66 5y agoBy default, iOS automatically installs updates after a few days
- ubercow13 5y agoNot if you don't use wifi. In fact it is impossible to install security updates without wifi.
- jaywalk 5y agoThis is 100% incorrect. Updates can be installed via a wired connection to iTunes running on a PC or Mac or over 5G cellular data.
- iaml 5y agoSome of the updates can't be installed via cellular for some reason.
- jaywalk 5y agoCan you link to any proof of that? I haven't seen it.
- iaml 5y agoI just had to connect to wifi for the update to start, the button was greyed out. If you don't trust me on this, I can send you a screenshot when this happens.
- jaywalk 5y agoDo you have the "Allow More Data on 5G" option selected? iOS updates will not be allowed otherwise.
- bamboo2 5y agoThat’s the point.
- jaywalk 5y agoWhat's the point? The post I replied to used the word "impossible" and I pointed out that it's absolutely not impossible.
- iaml 5y agoWait a second, yesterday I misread your comment, is this only available on 5G and not below? What is the reasoning for gating it to newer phones and countries that have that infrastructure, considering my pixel has no issues updating over 4G?
- criddell 5y agoIf you never connect your phone to the internet, you probably don't need to worry about security updates.
- ubercow13 5y agoI am constantly connected to cellular internet, so I probably do.
- swiley 5y agoMany people disable this because: 1) it's really annoying to have your crap moved around without being asked 2) it's often the only way to retain control of your device.
- imoverclocked 5y agoiOS updates are generally pretty well adopted in comparison to other platforms. [1] [2] For reference, iOS 13 was released Sept 19, 2019 [3] [1] https://9to5mac.com/2020/06/19/apple-says-ios-13-is-now-running-on-81-of-all-devices-ipados-adoption-hits-73/ https://9to5mac.com/2020/06/19/apple-says-ios-13-is-now-runn... [2] https://developer.apple.com/support/app-store/ https://developer.apple.com/support/app-store/ [3] https://en.wikipedia.org/wiki/IOS_version_history#iOS_13_/_iPadOS_13 https://en.wikipedia.org/wiki/IOS_version_history#iOS_13_/_i...
- realusername 5y ago> Though I suppose if this bug can be used for a jailbreak there may be some people who'd actively want to stay on 14.7 as well. It's too bad on iOS Apple forces people to choose between security and control of their own systems and doesn't at least allow a purchase-time option to have the ability to load ones own root signing certificate. That exactly why the jailbreak scene has no incentive to share any exploit with Apple and is obfuscating everything. That's not great for security but that's a direct consequence of Apple's policies.
- richardwhiuk 5y agoThere's basically no difference between a jailbreak bug and a 0 day. Both are vulnerabilities in the sandboxing.
- Ajedi32 5y agoCorrect. The issue is that Apple takes security systems designed as a defense against local attackers and uses them as a bulwark against their own customers. Come to think of it, maybe that could be the basis of a right-to-repair law: companies which sell hardware products that restrict functionality or access to those who know some secret value must divulge those secrets to the device owner upon request at the time of purchase. The only issue I can think of with a law like that is that it'd make DRM significantly less effective, though IMO that's not necessarily a bad thing.
- kube-system 5y agoThe customer is the biggest security hole. Most security breaches these days are social-engineered.
- dadver 5y agoSource?
- 5y ago
- refulgentis 5y agotaking note of multiple comments mentioning Pegasus, wanted to flag on the top one: this is very unlikely to be a fix for it. - reported by anonymous researcher - if it is related, this would be the 2nd of 2 bugs that would need fixing. The first is the 0-click escape hatch from the Messages sandbox to calling functions on IOMobileFramebuffer - there is only one bug listed for this release, and it is unlikely Apple would publicly flag #2 of 2 bugs was fixed, but not #1 - extremely tight timeframe from press reports of _a_ bug to a fix deployed, I'd like to think you could get a week turnaround on that, but...in practice, at BigCo, that timeframe would require moving heaven and earth, and yet still choosing to be irresponsible by skipping most of the gates on the release process
- radley 5y ago> it is unlikely Apple would publicly flag #2 of 2 bugs was fixed, but not #1 It's very possible Apple doesn't want to verify that Messages was compromised, particularly if they can blame everything on something obscure.
- ComputerGuru 5y agoThere isn’t a separate “messages” from anything else, that’s an illusion Apple marketing encourages. iOS is a shared-tenancy, general-purpose operating system. A vulnerability in any of the core libraries can affect any of the apps (first party or otherwise) and a hostile or compromised application (first party or otherwise) can compromise the entirety of the device and its data. Whether something is a Messages vulnerability or “something obscure” is just marketing spin.
- kall 5y agoI think the important part is any person can force data onto your device via messages. If that is exploitable, it‘s a huge oroblem. That‘s why people care.
- deleted 5y ago[deleted]
- 5y ago
- kmeisthax 5y agoAFAIK the current exploitable firmware for jailbreaking is 14.3 and I'm genuinely surprised that all these exploits for later versions aren't trickling down into Taurine or unc0ver.
- jbarrs 5y agoThey probably are, and this bug may already have been known. Many jailbreaks are often held back for as many versions as possible, since that can allow the jailbreak to target more iOS versions with a single exploit without Apple quickly blocking it for future versions.
- kmeisthax 5y agoI guess that retroactively justifies my decision to keep my iOS devices on 14.5 at least...
- isodev 5y agoThat really doesn’t sound very ethical though. An exploit can literally put people in danger. Holding back on reporting just so a few enthusiasts can fiddle with parts of their phone nobody intended for them to use is plain irresponsible… even antisocial.
- Matheus28 5y agoIf Apple gave people control over their own hardware, these enthusiasts wouldn't have an incentive to hold onto those exploits
- isodev 5y agoI can’t fully grasp the argument about jail breaking. The device was never intended to be used this way in the first place. The process itself probably also relies on bugs that need to be reported, not harnessed. I own my device without the need to root it, every feature in the brochure is available to me as a user. I understand that around the 90s owning anything with an OS also implied the ability to mess with the box of bolts and circuits that run the OS but that’s no longer the case. At least not when it comes to phones. I mean sure maybe you want a fancy device to play with … get a PCB and do whatever you want with it while your phone is updating.
- Dig1t 5y agoAs unpopular as I think this opinion is, I can't help but agree. If you want a hackable phone there are literally thousands of different Android phones that you can buy for a fraction of the price that you can tweak/hack to your heart's content.
- Stevvo 5y agoThe key difference is with Android you can take responsibility for your own security if you choose; it's a Linux not so different to any other. On iPhone you don't have that option, and you have no way of knowing if your phone was compromised.
- jonny_eh 5y agoBut none work with Apple Watches, nor do they work with iMessage.
- haswell 5y agoThere’s a saying about cake that seems to apply here. Again, there are other options for both. Android wear devices are still a thing, and there are multiple options that aren’t SMS that are available to the Android ecosystem. If you want to live in the Apple ecosystem, that comes with some tradeoffs. Can’t have it both ways.
- npteljes 5y agoJailbreaking is a bug, not a feature. These people need to realize the abusive relationship they have with their phone company and need to decide which way to go forward. Apple never promised to support jailbroken phones, they heavily and openly police modifications from the get-go.
- wallacoloo 5y ago> These people need to realize the abusive relationship they have with their phone company and need to decide which way to go forward. What’s the alternative? I’ve got a Pinephone coming in the mail — which I ordered precisely because of these sort of disagreements between me and Apple/Google — but I really doubt it’ll be useful for anything away from home (GPS, photos, etc).
- npteljes 5y agoNo real alternative currently, as I see it. The main ones track the hell out of you, dark pattern galore, Pine and the other Linux phones are simply not 1.0 yet, and I count AOSP derivatives as aftermarket solutions, because they don't have the engineering power to continue developing the fork, either the AOSP or the hardware, should it come to that. There isn't really a best choice. I personally opted for an older Samsung flagship, LineageOS without G services, and my own cloud at home. And I'm not counting on this being sustainable to be honest. I might go more Stallman later, buy dumber devices with lots of tradeoffs or just give in to the zeitgeist, and buy the shiniest tracking chip. Edit: Kudos for getting the Pine - putting the money where the mouth is something that has at least the potential to change.
- Siira 5y agoAndroid is not that open, either. Running background jobs on Android is severely restricted.
- clairity 5y ago> "It's too bad on iOS Apple forces people to choose between security and control of their own systems..." moreover, one of the critical vulnerabilities from a user's perspective is the network connections that a device makes, nominally on behalf of the user, but really on behalf of privacy-forsaking data harvesters like google and facebook (and even apple themselves, to a certain extent). jailbreaking is one method users can (potentially) regain a modicum of control over their own private information as well as block exfiltration from exploited security vulnerabilities.
- jsjohnst 5y ago> one of the critical vulnerabilities from a user's perspective is the network connections that a device makes, nominally on behalf of the user, but really on behalf of privacy-forsaking data harvesters like google and facebook Apple provides APIs now on stock iOS to allow an app to use a “VPN profile” to implement a firewall blocking outbound connections, but without requiring a remote server (aka the app applies rules locally to outbound connections). The downside is you have to trust Apple to pass their own traffic through the app’s firewall unlike with a JB, but at least that covers the other examples you gave.
- varispeed 5y agoWhat if the exploit has been used by governments? Surely they should give time or offer alternative way of gaining entry?