2 ms·

I think you're confused.

• downrightmike 5y ago
  iOS WiFi SSID bug. I think it's worth reinforcing first the critical security principle Bruce Schneier captured when he wrote that: "Attacks always get better. They never get worse." Okay. Recall last month Apple iOS WiFi SSID bug that we had fun talking about. That was the one security researcher Carl Schou tweeted: "After joining my personal WiFi with the SSID '%p%s%s%s%s%n,' my iPhone permanently disabled its WiFi functionality. Neither rebooting nor changing SSID fixes it." And of course that led to the discovery that they had not sanitized the SSID string prior to presenting it to a function, you know, some version of printf which was interpreting those percent things as things to be expanded and looking for parameters on the stack or from the caller that weren't there, thus causing a crash. And the concern was, as Bruce points out, attacks always get better. So maybe this could be leveraged into such an attack. https://www.grc.com/sn/sn-828.txt https://www.grc.com/sn/sn-828.txt https://twitter.com/vm_call/status/1405937492642123782?lang=en https://twitter.com/vm_call/status/1405937492642123782?lang=...
  • tantalor 5y ago
    And what does it have to do with dependency injection? This article is not about printf