4 ms·

I'm with you. I think these cheap, Apple-bashing blogs want to make this into a bigger deal but there are a few things that don't add up to make this the huge i

I'm with you. I think these cheap, Apple-bashing blogs want to make this into a bigger deal but there are a few things that don't add up to make this the huge issue they think it is: 1. The bug lets you download contacts. Nothing else. As you've said, no one's going to pay six figures for a bug that lets you get someone's contacts from GameCenter. If this was even slightly more abstract and didn't specifically deal with just GameCenter, I could see it being valuable for companies that do phone-to-phone transfers, for example, because you could download someone's contacts from a locked device. This isn't that, though. 2. Nowhere in the article, or even the original tweet, does Apple acknowledge or state that he was the person that initially found the bug. They just confirmed that the bug exists and asked him to keep it confidential. It's entirely possible that the reason for the delay is because someone discovered a lower-level bug that rolled up to this and it's a bit less clear-cut who is owed the credit for the fix that they released. They're not just going to go around and pay everyone who claims to have found a bug. They have to verify it and make sure that it's not something they've already discovered through another report or on their own. 3. Sometimes this stuff just takes time. When you're dealing with codebases that as large as this, changing a small thing to fix a bug can unintentionally break a bunch of other things. It's not always a simple matter of "this small piece is broken and is completely independent of everything else". We have no idea if this is or isn't one of those cases because we don't really know much about it (and for good reason).

WesolyKubeczek 5y ago
> 1. The bug lets you download contacts. Nothing else. As you've said, no one's going to pay six figures for a bug that lets you get someone's contacts from GameCenter. If this was even slightly more abstract and didn't specifically deal with just GameCenter, I could see it being valuable for companies that do phone-to-phone transfers, for example, because you could download someone's contacts from a locked device. This isn't that, though. I, the evil overlord, would very much like to know who is ratting out my secret initiatives to those nosy journalists. Maybe some of them don't keep a good information hygiene and will download my simple but quite addictive game? At least I get to know some names and addresses.
- tptacek 5y ago
  It's not just that it's contact data; I agree, exposing contact databases is a big deal, and that this (as depicted) is a significant bug. It's that to accomplish that with this bug, you have to install a malicious app from the app store. That is a very high hurdle towards operationalizing the bug, especially since, as I said elsewhere, Apple does API-level surveillance of apps in the app store.
  - WesolyKubeczek 5y ago
    But isn't it the reason malicious actors buy legit apps made by small shops to insert what at best is adware/spyware into something that is useful and made a name for itself already? Or make useless copycats, as Kosta Eleftheriou proved already is a way of choice in the iOS App Store.
    - akerl_ 5y ago
      The reason attackers buy or compromise existing apps is exactly because they want to sidestep the hurdle of tricking people into downloading their malicious app. Using an existing app gives you access to the existing users.
    - tptacek 5y ago
      I'm not saying you can't do anything with this bug, just that it's much harder to do something with it than with a drive by vulnerability. It is a little surprising to me that Apple's bounty sort of implies they'll pay so much for a bug like this.

WesolyKubeczek 5y ago

> 1. The bug lets you download contacts. Nothing else. As you've said, no one's going to pay six figures for a bug that lets you get someone's contacts from GameCenter. If this was even slightly more abstract and didn't specifically deal with just GameCenter, I could see it being valuable for companies that do phone-to-phone transfers, for example, because you could download someone's contacts from a locked device. This isn't that, though. I, the evil overlord, would very much like to know who is ratting out my secret initiatives to those nosy journalists. Maybe some of them don't keep a good information hygiene and will download my simple but quite addictive game? At least I get to know some names and addresses.

tptacek 5y ago
It's not just that it's contact data; I agree, exposing contact databases is a big deal, and that this (as depicted) is a significant bug. It's that to accomplish that with this bug, you have to install a malicious app from the app store. That is a very high hurdle towards operationalizing the bug, especially since, as I said elsewhere, Apple does API-level surveillance of apps in the app store.
- WesolyKubeczek 5y ago
  But isn't it the reason malicious actors buy legit apps made by small shops to insert what at best is adware/spyware into something that is useful and made a name for itself already? Or make useless copycats, as Kosta Eleftheriou proved already is a way of choice in the iOS App Store.
  - akerl_ 5y ago
    The reason attackers buy or compromise existing apps is exactly because they want to sidestep the hurdle of tricking people into downloading their malicious app. Using an existing app gives you access to the existing users.
  - tptacek 5y ago
    I'm not saying you can't do anything with this bug, just that it's much harder to do something with it than with a drive by vulnerability. It is a little surprising to me that Apple's bounty sort of implies they'll pay so much for a bug like this.