4 ms·
Re url redirect: I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks. Re xss: h
by PartiallyTyped 5y ago
Re url redirect:
I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks.
Re xss: how could you a worm in this case go from one airtag to another?
- jameshart 5y agoPassword managers and persistent auth cookies are why getting onto the domain matters. I guess the posited worm would make use of the fact that if an authenticated Apple.com user can inject a payload via marking an air tag as lost and setting its phone number, if that payload runs on an Apple.com page on the victim’s device, it then gets some new apple.com credentials; if the victim also has any airtags, it can mark them as lost and inject the payload into the phone number field. Requires the airtag to be scanned by another airtag owner, obviously, and unclear who would scan their airtag. Overall, a good example of how to think about how viral reproduction methods can lead to very different replication rates depending on population characteristics and behavior.