2 ms·
> No (statistically speaking) app producer with any interest in continuing to use the platform would deploy such an exploit even if they had access to it. Exce
by jtbayly 5y ago
> No (statistically speaking) app producer with any interest in continuing to use the platform would deploy such an exploit even if they had access to it.
Except Facebook. Or another behemoth that felt they could weather Apple's wrath if it ever came to it. Or a company that Apple had granted special permission to do this, like they did with Uber.
- pvg 5y agoApple killed a bunch of FB's tracking a few months ago and the story is still making the rounds and is on the front page as we speak. The point isn't that this isn't a serious vulnerability or is somehow unexploitable. It's just that there's a great deal of friction in exploiting it for relatively paltry returns. Nobody is going to get into a spat with Apple and invite regulatory and law enforcement attention to traceably and with undeniable intent steal your contact list. Nobody is going to (like another commented hypothesized) launch a supply chain attack to steal your contact list with this vuln. At that point you'd find a better vuln. This one isn't all that much better than just misleading people into giving you contact list permission. The OP is saying it's somehow worse than drive-by or low-interaction vulns that own up entire devices and have been repeatedly found in the wild. I don't think that holds up.