8 ms·

There's basically no difference between a jailbreak bug and a 0 day. Both are vulnerabilities in the sandboxing.

Ajedi32 5y ago
Correct. The issue is that Apple takes security systems designed as a defense against local attackers and uses them as a bulwark against their own customers. Come to think of it, maybe that could be the basis of a right-to-repair law: companies which sell hardware products that restrict functionality or access to those who know some secret value must divulge those secrets to the device owner upon request at the time of purchase. The only issue I can think of with a law like that is that it'd make DRM significantly less effective, though IMO that's not necessarily a bad thing.
- kube-system 5y ago
  The customer is the biggest security hole. Most security breaches these days are social-engineered.
  - dadver 5y ago
    Source?
    - Godel_unicode 5y ago
      https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/summary-of-findings/ https://www.verizon.com/business/resources/reports/dbir/2021... If we're quibbling, they likely meant plurality as opposed to majority. It's close to an outright majority though.
  - kbenson 5y ago
    > Most security breaches these days are social-engineered. I don't know why people even bother making statements like that here without backing them up, when it's pretty obvious the first response is going to be to request a source. So, source please?
    - kube-system 5y ago
      I made the claim from first-hand experience, but if you'd like third party sources, here's one: https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf https://enterprise.verizon.com/resources/reports/2019-data-b...
      - kbenson 5y ago
        Thank you for the link. FWIW, as I understand it, that indicates that social is neither the majority, nor the most common form of breach, but it is increasing over time. That's the problem with using first hand experience. Unless you're doing a statistical review and your experience is actually collating data, the chance that your experience accurately reflects real world data is wildly dependent on the topic, and with one with as many variables as this, I would expect the chance a statement like that be correct more akin to luck than an correctly inferred results from a relevant subset of data. i.e. What industry you work in, what your actual job is, and what you already know about it is likely to wildly influence what you see. Even someone working in the security industry is likely to see only a subset related to their job/interests.
        Godel_unicode 5y ago
        You should probably go re-examine the summary of findings chart. It's number one as a cause, although not strictly speaking a majority. Also, more to the point, ~85% of breaches were human-involved. https://www.verizon.com/business/dam/img/resources/reports/2021/dbir/section-1-png/Figure%205.png https://www.verizon.com/business/dam/img/resources/reports/2... https://www.verizon.com/business/dam/img/resources/reports/2021/dbir/section-1-png/Figure%207.png https://www.verizon.com/business/dam/img/resources/reports/2... This is a very widely discussed trend in the industry and has been for literally almost a decade. It has lead to the tired trope of the number one hardening recommendation being "get rid of the users" as well as the much more helpful "users can't be expected to participate in their own security, it needs to be done for them transparently".
        5y ago
  - Ajedi32 5y ago
    Probably true, but the solution to that must not be to treat the user like a child unable to make decisions for themself. If a person decides to give up control of their device to another person or organization (like the device manufacturer) fine, but that should be a voluntary decision on the part of the user, not something forced.
    - acdha 5y ago
      What if that person's “decision” was being tricked by a scammer? Or being in an abusive relationship? Or living in a surveillance state? I want people to have more control over devices but there are some non-trivial threats which millions of people face which are currently defanged by things like the OS not allowing malware installs, or hiding the use of various sensors or data access, etc.
      - Ajedi32 5y ago
        So people might make bad decisions, therefore they should not be allowed to make decisions at all? Sure, do everything you can to educate the user on what they're doing and make things as hard as possible for scammers, but ultimately it must be their choice who controls their device, not yours.
        acdha 5y ago
        We don't have absolute freedom in many areas because the law recognizes that the general public either is not capable of making informed decisions when that requires high-levels of skill or when there is a high likelihood of bad outcomes due to malicious actors. For example, if you buy a car there are safety features you cannot turn off without major modifications. Dangerous tools often have safety guards built-in to the design — for example, my blender doesn't say it's my choice whether to keep the spinning blade covered. My bank doesn't say it's my choice whether or not to identify myself when making a withdrawal. For most people, iOS limiting the damage when they get compromised is a huge plus. Removing that entirely in the absolute position is bringing people back a couple of decades ago only now the malware will have access to their most private moments and data 24x7 rather than just their Geocities browsing history. Now, consider what that means for something like unlocking the bootloader. Allowing that means undetectable malware, potentially irrecoverable. There's not really a good way around that and even if you try to inform people at the time they enable it that doesn't help if it's done when the device is out of their control (abusive partner, boss, police, etc.), and every on-screen indicator can be faked by the malware vendor. That leaves options like a physical switch in a prominent location which most people aren't going to want to pay for or see, and are more likely to be used by accident than intentionally.
  - acdha 5y ago
    That's the hard part for all of this: if you are building an unlock mechanism the first question you need to ask is how you build a UI which clearly communicates to a user that they are likely giving control of all of their data, location/camera/microphone, etc. to whatever they're installing. The scammers who push malware under the guise of tech support, free porn/games, etc. are effective enough to compromise millions of people and that's before you get to the question of what it'd look like if a government started pushing access for monitoring. How many people might consider installing something which this guy they met in a coffeeshop says will protect their messages from government surveillance? Now consider how many people might have malware installed by an abusive domestic partner, and where control of the device would extend to hiding the existence of spyware. This is not to say that Apple is acting without self-interest here, only that I think there's really a pretty nasty market failure making it quite difficult to reconcile someone being able to make choices about their device with a fairly high risk of compromise with potentially significant consequences.
    - cmg 5y ago
      > if you are building an unlock mechanism the first question you need to ask is how you build a UI which clearly communicates to a user that they are likely giving control of all of their data, location/camera/microphone, etc. to whatever they're installing. Facebook puts a large "Stop!" warning in the browser console when you try to open developer tools with a link to https://www.facebook.com/selfxss https://www.facebook.com/selfxss. I'd be really curious to see if that's helped to stop such attacks on their side. Full text: "This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or "hack" someone's account, it is a scam and will give them access to your Facebook account."
      - acdha 5y ago
        That’s an interesting question: I’d love to know how effective that’s been.
      - snowwrestler 5y ago
        Facebook themselves convinced teenagers to side-load an iOS app that used Facebook’s enterprise cert to circumvent Apple’s privacy protections. They got caught and Apple revoked the cert, which broke all their internal iOS apps. If Facebook is willing to fool kids into giving up their privacy via side-loading, you can imagine why Apple is nervous about how things would go if anyone could easily do so.
  - squiggleblaz 5y ago
    The security model is wrong. In order to get access to my own data, I have to prove I am who I say I am to someone who doesn't know me from a bar of soap. It makes no sense to blame the user for that.
- martimarkov 5y ago
  I bought an iPhone because of the fact those things are mostly hidden.
- mschuster91 5y ago
  > The only issue I can think of with a law like that is that it'd make DRM significantly less effective, though IMO that's not necessarily a bad thing. I wonder why movie companies these days still insist on shipping DRM garbage. HDCP is broken on a fundamental level, you can grab strippers for about 90€ on ebay, and BD+ is similarly broken. It literally has no purpose other than annoying customers who have rooted their Android phones (Netflix refuses to go above 480p) or want legitimate backups of their bought content.
- joshspankit 5y ago
  It might be worth an additional “paired” law that companies are not allowed to both sell hardware/OS and copyright-protected media. Some of the worst DRM has been because Apple has a vested interest in restricting your ability to use your computer freely.
solarkraft 5y ago
Jailbreaks require 0 days. What’s amazing is that they keep coming out despite the prices being so high and the game already having been played for so long. Just a shame it won’t be in iOS 15.
- Hackbraten 5y ago
  Most exploits used in a jailbreak are developed only after a public patch for the underlying bugs appears. Once the patch is publicly available, an exploit has much less commercial value. (Attackers don’t like having to call their target and tell them not to apply the patch.) It therefore makes sense to donate such exploits for a jailbreak.
IncRnd 5y ago
There is a difference. Not all 0days are jailbreaks. All jailbreaks are unpatched 0days. All tall people are human. Not all humans are tall.
baby 5y ago
There is some difference. Some 0day are exploitable by just sending a text, whereas some jailbreaks are like self reflected xss

Correct. The issue is that Apple takes security systems designed as a defense against local attackers and uses them as a bulwark against their own customers. Come to think of it, maybe that could be the basis of a right-to-repair law: companies which sell hardware products that restrict functionality or access to those who know some secret value must divulge those secrets to the device owner upon request at the time of purchase. The only issue I can think of with a law like that is that it'd make DRM significantly less effective, though IMO that's not necessarily a bad thing.

kube-system 5y ago
The customer is the biggest security hole. Most security breaches these days are social-engineered.
- dadver 5y ago
  Source?
  - Godel_unicode 5y ago
    https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/summary-of-findings/ https://www.verizon.com/business/resources/reports/dbir/2021... If we're quibbling, they likely meant plurality as opposed to majority. It's close to an outright majority though.
- kbenson 5y ago
  > Most security breaches these days are social-engineered. I don't know why people even bother making statements like that here without backing them up, when it's pretty obvious the first response is going to be to request a source. So, source please?
  - kube-system 5y ago
    I made the claim from first-hand experience, but if you'd like third party sources, here's one: https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf https://enterprise.verizon.com/resources/reports/2019-data-b...
    - kbenson 5y ago
      Thank you for the link. FWIW, as I understand it, that indicates that social is neither the majority, nor the most common form of breach, but it is increasing over time. That's the problem with using first hand experience. Unless you're doing a statistical review and your experience is actually collating data, the chance that your experience accurately reflects real world data is wildly dependent on the topic, and with one with as many variables as this, I would expect the chance a statement like that be correct more akin to luck than an correctly inferred results from a relevant subset of data. i.e. What industry you work in, what your actual job is, and what you already know about it is likely to wildly influence what you see. Even someone working in the security industry is likely to see only a subset related to their job/interests.
      - Godel_unicode 5y ago
        You should probably go re-examine the summary of findings chart. It's number one as a cause, although not strictly speaking a majority. Also, more to the point, ~85% of breaches were human-involved. https://www.verizon.com/business/dam/img/resources/reports/2021/dbir/section-1-png/Figure%205.png https://www.verizon.com/business/dam/img/resources/reports/2... https://www.verizon.com/business/dam/img/resources/reports/2021/dbir/section-1-png/Figure%207.png https://www.verizon.com/business/dam/img/resources/reports/2... This is a very widely discussed trend in the industry and has been for literally almost a decade. It has lead to the tired trope of the number one hardening recommendation being "get rid of the users" as well as the much more helpful "users can't be expected to participate in their own security, it needs to be done for them transparently".
        5y ago
- Ajedi32 5y ago
  Probably true, but the solution to that must not be to treat the user like a child unable to make decisions for themself. If a person decides to give up control of their device to another person or organization (like the device manufacturer) fine, but that should be a voluntary decision on the part of the user, not something forced.
  - acdha 5y ago
    What if that person's “decision” was being tricked by a scammer? Or being in an abusive relationship? Or living in a surveillance state? I want people to have more control over devices but there are some non-trivial threats which millions of people face which are currently defanged by things like the OS not allowing malware installs, or hiding the use of various sensors or data access, etc.
    - Ajedi32 5y ago
      So people might make bad decisions, therefore they should not be allowed to make decisions at all? Sure, do everything you can to educate the user on what they're doing and make things as hard as possible for scammers, but ultimately it must be their choice who controls their device, not yours.
      - acdha 5y ago
        We don't have absolute freedom in many areas because the law recognizes that the general public either is not capable of making informed decisions when that requires high-levels of skill or when there is a high likelihood of bad outcomes due to malicious actors. For example, if you buy a car there are safety features you cannot turn off without major modifications. Dangerous tools often have safety guards built-in to the design — for example, my blender doesn't say it's my choice whether to keep the spinning blade covered. My bank doesn't say it's my choice whether or not to identify myself when making a withdrawal. For most people, iOS limiting the damage when they get compromised is a huge plus. Removing that entirely in the absolute position is bringing people back a couple of decades ago only now the malware will have access to their most private moments and data 24x7 rather than just their Geocities browsing history. Now, consider what that means for something like unlocking the bootloader. Allowing that means undetectable malware, potentially irrecoverable. There's not really a good way around that and even if you try to inform people at the time they enable it that doesn't help if it's done when the device is out of their control (abusive partner, boss, police, etc.), and every on-screen indicator can be faked by the malware vendor. That leaves options like a physical switch in a prominent location which most people aren't going to want to pay for or see, and are more likely to be used by accident than intentionally.
- acdha 5y ago
  That's the hard part for all of this: if you are building an unlock mechanism the first question you need to ask is how you build a UI which clearly communicates to a user that they are likely giving control of all of their data, location/camera/microphone, etc. to whatever they're installing. The scammers who push malware under the guise of tech support, free porn/games, etc. are effective enough to compromise millions of people and that's before you get to the question of what it'd look like if a government started pushing access for monitoring. How many people might consider installing something which this guy they met in a coffeeshop says will protect their messages from government surveillance? Now consider how many people might have malware installed by an abusive domestic partner, and where control of the device would extend to hiding the existence of spyware. This is not to say that Apple is acting without self-interest here, only that I think there's really a pretty nasty market failure making it quite difficult to reconcile someone being able to make choices about their device with a fairly high risk of compromise with potentially significant consequences.
  - cmg 5y ago
    > if you are building an unlock mechanism the first question you need to ask is how you build a UI which clearly communicates to a user that they are likely giving control of all of their data, location/camera/microphone, etc. to whatever they're installing. Facebook puts a large "Stop!" warning in the browser console when you try to open developer tools with a link to https://www.facebook.com/selfxss https://www.facebook.com/selfxss. I'd be really curious to see if that's helped to stop such attacks on their side. Full text: "This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or "hack" someone's account, it is a scam and will give them access to your Facebook account."
    - acdha 5y ago
      That’s an interesting question: I’d love to know how effective that’s been.
    - snowwrestler 5y ago
      Facebook themselves convinced teenagers to side-load an iOS app that used Facebook’s enterprise cert to circumvent Apple’s privacy protections. They got caught and Apple revoked the cert, which broke all their internal iOS apps. If Facebook is willing to fool kids into giving up their privacy via side-loading, you can imagine why Apple is nervous about how things would go if anyone could easily do so.
- squiggleblaz 5y ago
  The security model is wrong. In order to get access to my own data, I have to prove I am who I say I am to someone who doesn't know me from a bar of soap. It makes no sense to blame the user for that.
martimarkov 5y ago
I bought an iPhone because of the fact those things are mostly hidden.
mschuster91 5y ago
> The only issue I can think of with a law like that is that it'd make DRM significantly less effective, though IMO that's not necessarily a bad thing. I wonder why movie companies these days still insist on shipping DRM garbage. HDCP is broken on a fundamental level, you can grab strippers for about 90€ on ebay, and BD+ is similarly broken. It literally has no purpose other than annoying customers who have rooted their Android phones (Netflix refuses to go above 480p) or want legitimate backups of their bought content.
joshspankit 5y ago
It might be worth an additional “paired” law that companies are not allowed to both sell hardware/OS and copyright-protected media. Some of the worst DRM has been because Apple has a vested interest in restricting your ability to use your computer freely.

solarkraft 5y ago

Jailbreaks require 0 days. What’s amazing is that they keep coming out despite the prices being so high and the game already having been played for so long. Just a shame it won’t be in iOS 15.

Hackbraten 5y ago
Most exploits used in a jailbreak are developed only after a public patch for the underlying bugs appears. Once the patch is publicly available, an exploit has much less commercial value. (Attackers don’t like having to call their target and tell them not to apply the patch.) It therefore makes sense to donate such exploits for a jailbreak.

IncRnd 5y ago

There is a difference. Not all 0days are jailbreaks. All jailbreaks are unpatched 0days. All tall people are human. Not all humans are tall.

baby 5y ago

There is some difference. Some 0day are exploitable by just sending a text, whereas some jailbreaks are like self reflected xss