3 ms·
From the article - "Owens created a hypothetical attack that gave hackers access to the victim’s files. He said in an interview that it could have hypotheticall
by lostcolony 5y ago
From the article - "Owens created a hypothetical attack that gave hackers access to the victim’s files. He said in an interview that it could have hypothetically allowed hackers to access corporate servers, if the target computer were used by a corporation."
Perhaps Owens is lying. Perhaps this is misleading reporting, or otherwise occluding something. But on the surface of it, it sounds like no user intervention required.
- chongli 5y agoYeah so if he did as he claimed then he achieved the bypass Apple claims to be paying for. Now if Apple is lying and refusing to honour their bug bounty, that is another matter. My point is that just because you can get the user to execute your malicious executable under their user account does not grant you access to all their files, unlike what you would expect with traditional Unix permissions.
- lostcolony 5y agoYour point is taken, but also irrelevant to the specifics laid out in the article. I appreciate that "normally" the user may have to allow access to files and things (I'm not sure I've ever experienced that on a Mac before when installing applications; I installed Sublime and could open and edit files without any user dialogs, but maybe I disabled something, or working through the UI behaves differently or whatever), but the whole point being made is what the hacker says in the article would indicate it should have claimed the bounty.