3 ms·
Maybe it's just me, but these aren't what I think of when I hear 0-day. These are serious, but I was guessing remote code execution or sandbox escape. It seems
by alphabettsy 5y ago
Maybe it's just me, but these aren't what I think of when I hear 0-day.
These are serious, but I was guessing remote code execution or sandbox escape. It seems like we're talking about bypassing privacy controls though.
That said, Apple needs to take this much more seriously. They created the program reluctantly and it shows.
- H8crilA 5y agoFYI, 0-day just means "first time made public".
- alphabettsy 5y agoCompletely aware of that. Just a weird perception thing for me.
- tinus_hn 5y agoIt means a vulnerability is made public while there is no patch available. As opposed to releasing the information a number of days after the patch was released.
- cjbprime 5y agoIt doesn't even really mean that anymore. From the blog post here: > I've reported four 0-day vulnerabilities this year They're just using 0-day to mean "a new vulnerability finding disclosed to the vendor privately", which is becoming the new definition of the term.
- gzer0 5y agoFrom an earlier post: This is a boat load of mission critical data. - all contacts, including 3rd party messaging apps, with metadata (interactions, timestamps, other stats) - full address book - whether any app is installed - SSID of connected wifi - medical info - device usage - screen time - device accessories
- alphabettsy 5y agoI must have missed the medical info. I guess I don't consider contacts mission-critical though I definitely would not want them exposed and generally don't give apps access to them.
- soheil 5y agoThere needs to be a distinction between 0-days that make remote code execution possible and those that don't. This is still a pretty damning data leak.
- wwn_se 5y agoThere is a system, cvss scoring https://www.first.org/cvss/specification-document https://www.first.org/cvss/specification-document