2 ms·

> 1. The bug lets you download contacts. Nothing else. As you've said, no one's going to pay six figures for a bug that lets you get someone's contacts from Gam

> 1. The bug lets you download contacts. Nothing else. As you've said, no one's going to pay six figures for a bug that lets you get someone's contacts from GameCenter. If this was even slightly more abstract and didn't specifically deal with just GameCenter, I could see it being valuable for companies that do phone-to-phone transfers, for example, because you could download someone's contacts from a locked device. This isn't that, though. I, the evil overlord, would very much like to know who is ratting out my secret initiatives to those nosy journalists. Maybe some of them don't keep a good information hygiene and will download my simple but quite addictive game? At least I get to know some names and addresses.

tptacek 5y ago
It's not just that it's contact data; I agree, exposing contact databases is a big deal, and that this (as depicted) is a significant bug. It's that to accomplish that with this bug, you have to install a malicious app from the app store. That is a very high hurdle towards operationalizing the bug, especially since, as I said elsewhere, Apple does API-level surveillance of apps in the app store.
- WesolyKubeczek 5y ago
  But isn't it the reason malicious actors buy legit apps made by small shops to insert what at best is adware/spyware into something that is useful and made a name for itself already? Or make useless copycats, as Kosta Eleftheriou proved already is a way of choice in the iOS App Store.
  - akerl_ 5y ago
    The reason attackers buy or compromise existing apps is exactly because they want to sidestep the hurdle of tricking people into downloading their malicious app. Using an existing app gives you access to the existing users.
  - tptacek 5y ago
    I'm not saying you can't do anything with this bug, just that it's much harder to do something with it than with a drive by vulnerability. It is a little surprising to me that Apple's bounty sort of implies they'll pay so much for a bug like this.

tptacek 5y ago

It's not just that it's contact data; I agree, exposing contact databases is a big deal, and that this (as depicted) is a significant bug. It's that to accomplish that with this bug, you have to install a malicious app from the app store. That is a very high hurdle towards operationalizing the bug, especially since, as I said elsewhere, Apple does API-level surveillance of apps in the app store.

WesolyKubeczek 5y ago
But isn't it the reason malicious actors buy legit apps made by small shops to insert what at best is adware/spyware into something that is useful and made a name for itself already? Or make useless copycats, as Kosta Eleftheriou proved already is a way of choice in the iOS App Store.
- akerl_ 5y ago
  The reason attackers buy or compromise existing apps is exactly because they want to sidestep the hurdle of tricking people into downloading their malicious app. Using an existing app gives you access to the existing users.
- tptacek 5y ago
  I'm not saying you can't do anything with this bug, just that it's much harder to do something with it than with a drive by vulnerability. It is a little surprising to me that Apple's bounty sort of implies they'll pay so much for a bug like this.