4 ms·

All of this is a failing of the OS layer which should manage permissions not stores.

kelnos 5y ago
Exactly. There shouldn't be a private API to get your phone number. There should be a public API, and calling it should request permission from the user. Of course, the app can refuse to function if you deny it...
- jdavis703 5y ago
  But I wouldn’t want the settings app for example to pop up a bunch of dialogs asking for permission to enable various private APIs.
  - Jcowell 5y ago
    Exactly. Come in HN. You’re smart. If you give the average user numerous pop up boxes to click they’re going to be conditioned to click allow no matter what the permission is to get where they need to go. It is not an answer and counter productive.
    - kelnos 5y ago
      Sure, there's a fine line between users actually reading the prompt and making a real choice vs. just tapping "allow" to get it to go away. I feel like "do you want to give this app your phone number?" falls under the former, though. Right there along with "do you want to give this app your location?", which is of course already something users have to allow.
judge2020 5y ago
The OS layer can be compromised - all recent iOS jailbreaks besides ones that rely on checkm8 use a series of userland exploits to break out of the sandbox and gain rootfs access. Nothing is stopping a seemingly innocuous App Store from installing an app that silently jailbreaks the phone in the background to then bypass the OS whitelists that gatekeep these private APIs to Apple-provided apps.
- Drew_ 5y ago
  Also slots nicely under the "failure of an OS" category. Legislation like this forces Apple to actually maintain a good OS lest it be riddled with malware. They seem to be doing fine on macOS they can do the same for iOS.
  - judge2020 5y ago
    Craig Federighi said it himself that the level of malware on MacOS is unacceptable[0]. It's impossible to make a completely secure OS that never has bugs - it's less impossible to create a review system with rules and processes that limits the amount of user-downloaded malware to single-digit numbers. 0: https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
    - Drew_ 5y ago
      Craig Federighi is a very powerful executive doing everything in his power to protect his company's business model. That includes lying as he did in that court. Craig uses a Mac everyday he's fine with it's security.
      - judge2020 5y ago
        I'm sure his MDM-enforced gatekeeper setting is on "Apps downloaded from the App Store" and not in the default position that includes "and identified developers". https://support.apple.com/guide/mdm/security-privacy-payload-settings-mdm61dc030/1/web/1.0#:~:text=Configure%20Gatekeeper%20settings https://support.apple.com/guide/mdm/security-privacy-payload...
heavyset_go 5y ago
When you rely on a gatekeeper for security, it results in problems like the Play Store being the main vector for malware distribution on Android[1], and Apple's App Store distributing 500 million copies of Xcodeghost to users' devices[2]. [1] https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-... [2] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...
- judge2020 5y ago
  Xcodeghost was just another analytics API to Apple, so they didn't care until they were alerted that it was added to apps without the consent of these developers. It was not 'malware' in the sense of enrolling users in a botnet or utilizing private APIs to record the screen without permission.
  - heavyset_go 5y ago
    Lookout Security describes it as malware[2] and as malicious, as does Palo Alto Networks[3], Ars[4], Reuters[5] and The NY Times[6]. From here[1]: > Remote control security risks > XcodeGhost can be remotely controlled via commands sent by an attacker from a Command and control server through HTTP. This data is encrypted using the DES algorithm in ECB mode. Not only is this encryption mode known to be weak, the encryption keys can also be found using reverse engineering. An attacker could perform a man in the middle attack and transmit fake HTTP traffic to the device (to open a dialog box or open specific app for example). > Read and write from clipboard > XcodeGhost is also able, each time an infected app is launched, to store the data written in the iOS clipboard. The malware is also able to modify this data. This can be particularly dangerous if the user uses a password management app. > Hijack opening specific URLs > XcodeGhost is also able to open specific URLs when the infected app is launched. Since Apple iOS and OS X work with Inter-App Communication URL mechanism (e.g. 'whatsapp://', 'Facebook://', 'iTunes://'), the attacker can open any apps installed on the compromised phone or computer, in the case of an infected macOS application. Such mechanism could be harmful with password management apps or even on phishing websites. > Stealing user device information > When the infected app is launched, either by using an iPhone or the simulator inside Xcode, XcodeGhost will automatically collect device information.* > Then the malware will encrypt those data and send it to a command and control server. The server differs from version to version of XcodeGhost; Palo Alto Networks was able to find three server URLs: > http://init.crash-analytics.com http://init.crash-analytics.com, http://init.icloud-diagnostics.com http://init.icloud-diagnostics.com, http://init.icloud-analysis.com http://init.icloud-analysis.com > The last domain was also used in the iOS malware KeyRaider. [1] https://en.wikipedia.org/wiki/XcodeGhost#Behavior_on_infected_devices https://en.wikipedia.org/wiki/XcodeGhost#Behavior_on_infecte... [2] https://blog.lookout.com/blog/2015/09/20/xcodeghost https://blog.lookout.com/blog/2015/09/20/xcodeghost [3] http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/ http://researchcenter.paloaltonetworks.com/2015/09/malware-x... [4] https://arstechnica.com/information-technology/2015/09/apple-scrambles-after-40-malicious-xcodeghost-apps-haunt-app-store/ https://arstechnica.com/information-technology/2015/09/apple... [5] http://www.reuters.com/article/2015/09/20/us-apple-china-malware-idUSKCN0RK0ZB20150920 http://www.reuters.com/article/2015/09/20/us-apple-china-mal... [6] http://www.nytimes.com/2015/09/21/business/apple-confirms-discovery-of-malicious-code-in-some-app-store-products.html http://www.nytimes.com/2015/09/21/business/apple-confirms-di...

Exactly. There shouldn't be a private API to get your phone number. There should be a public API, and calling it should request permission from the user. Of course, the app can refuse to function if you deny it...

jdavis703 5y ago
But I wouldn’t want the settings app for example to pop up a bunch of dialogs asking for permission to enable various private APIs.
- Jcowell 5y ago
  Exactly. Come in HN. You’re smart. If you give the average user numerous pop up boxes to click they’re going to be conditioned to click allow no matter what the permission is to get where they need to go. It is not an answer and counter productive.
  - kelnos 5y ago
    Sure, there's a fine line between users actually reading the prompt and making a real choice vs. just tapping "allow" to get it to go away. I feel like "do you want to give this app your phone number?" falls under the former, though. Right there along with "do you want to give this app your location?", which is of course already something users have to allow.

judge2020 5y ago

The OS layer can be compromised - all recent iOS jailbreaks besides ones that rely on checkm8 use a series of userland exploits to break out of the sandbox and gain rootfs access. Nothing is stopping a seemingly innocuous App Store from installing an app that silently jailbreaks the phone in the background to then bypass the OS whitelists that gatekeep these private APIs to Apple-provided apps.

Drew_ 5y ago
Also slots nicely under the "failure of an OS" category. Legislation like this forces Apple to actually maintain a good OS lest it be riddled with malware. They seem to be doing fine on macOS they can do the same for iOS.
- judge2020 5y ago
  Craig Federighi said it himself that the level of malware on MacOS is unacceptable[0]. It's impossible to make a completely secure OS that never has bugs - it's less impossible to create a review system with rules and processes that limits the amount of user-downloaded malware to single-digit numbers. 0: https://www.cnbc.com/2021/05/19/apples-head-of-software-says-current-level-of-mac-malware-is-not-acceptable.html https://www.cnbc.com/2021/05/19/apples-head-of-software-says...
  - Drew_ 5y ago
    Craig Federighi is a very powerful executive doing everything in his power to protect his company's business model. That includes lying as he did in that court. Craig uses a Mac everyday he's fine with it's security.
    - judge2020 5y ago
      I'm sure his MDM-enforced gatekeeper setting is on "Apps downloaded from the App Store" and not in the default position that includes "and identified developers". https://support.apple.com/guide/mdm/security-privacy-payload-settings-mdm61dc030/1/web/1.0#:~:text=Configure%20Gatekeeper%20settings https://support.apple.com/guide/mdm/security-privacy-payload...

heavyset_go 5y ago

When you rely on a gatekeeper for security, it results in problems like the Play Store being the main vector for malware distribution on Android[1], and Apple's App Store distributing 500 million copies of Xcodeghost to users' devices[2]. [1] https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-... [2] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

judge2020 5y ago
Xcodeghost was just another analytics API to Apple, so they didn't care until they were alerted that it was added to apps without the consent of these developers. It was not 'malware' in the sense of enrolling users in a botnet or utilizing private APIs to record the screen without permission.
- heavyset_go 5y ago
  Lookout Security describes it as malware[2] and as malicious, as does Palo Alto Networks[3], Ars[4], Reuters[5] and The NY Times[6]. From here[1]: > Remote control security risks > XcodeGhost can be remotely controlled via commands sent by an attacker from a Command and control server through HTTP. This data is encrypted using the DES algorithm in ECB mode. Not only is this encryption mode known to be weak, the encryption keys can also be found using reverse engineering. An attacker could perform a man in the middle attack and transmit fake HTTP traffic to the device (to open a dialog box or open specific app for example). > Read and write from clipboard > XcodeGhost is also able, each time an infected app is launched, to store the data written in the iOS clipboard. The malware is also able to modify this data. This can be particularly dangerous if the user uses a password management app. > Hijack opening specific URLs > XcodeGhost is also able to open specific URLs when the infected app is launched. Since Apple iOS and OS X work with Inter-App Communication URL mechanism (e.g. 'whatsapp://', 'Facebook://', 'iTunes://'), the attacker can open any apps installed on the compromised phone or computer, in the case of an infected macOS application. Such mechanism could be harmful with password management apps or even on phishing websites. > Stealing user device information > When the infected app is launched, either by using an iPhone or the simulator inside Xcode, XcodeGhost will automatically collect device information.* > Then the malware will encrypt those data and send it to a command and control server. The server differs from version to version of XcodeGhost; Palo Alto Networks was able to find three server URLs: > http://init.crash-analytics.com http://init.crash-analytics.com, http://init.icloud-diagnostics.com http://init.icloud-diagnostics.com, http://init.icloud-analysis.com http://init.icloud-analysis.com > The last domain was also used in the iOS malware KeyRaider. [1] https://en.wikipedia.org/wiki/XcodeGhost#Behavior_on_infected_devices https://en.wikipedia.org/wiki/XcodeGhost#Behavior_on_infecte... [2] https://blog.lookout.com/blog/2015/09/20/xcodeghost https://blog.lookout.com/blog/2015/09/20/xcodeghost [3] http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/ http://researchcenter.paloaltonetworks.com/2015/09/malware-x... [4] https://arstechnica.com/information-technology/2015/09/apple-scrambles-after-40-malicious-xcodeghost-apps-haunt-app-store/ https://arstechnica.com/information-technology/2015/09/apple... [5] http://www.reuters.com/article/2015/09/20/us-apple-china-malware-idUSKCN0RK0ZB20150920 http://www.reuters.com/article/2015/09/20/us-apple-china-mal... [6] http://www.nytimes.com/2015/09/21/business/apple-confirms-discovery-of-malicious-code-in-some-app-store-products.html http://www.nytimes.com/2015/09/21/business/apple-confirms-di...