7 ms·

About the security content of iOS 15.2.1 and iPadOS 15.2.1

86 points by shantara 5y ago

xoa 5y ago
Ars amongst a number of others had an article covering this [0] last week. Not that trivial to exploit but sounded relatively nasty if it was triggered, so better late than never. Though HomeKit overall has been a pretty significant disappointment and definitely feels like one of those semi-afterthought type of Apple projects at this point. Important enough or with enough internal sway to not get dropped outright, but not enough to get any serious effort either. Like the Mac Pro maybe, though that one is even more disappointing. So I wonder how many people make much use of it, let alone share with others. ---- 0: https://arstechnica.com/information-technology/2022/01/5-months-on-apple-has-yet-to-fix-ios-bug-that-sends-devices-into-a-crash-spiral/ https://arstechnica.com/information-technology/2022/01/5-mon...
- mason55 5y ago
  > Though HomeKit overall has been a pretty significant disappointment and definitely feels like one of those semi-afterthought type of Apple projects at this point. It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. My random pet peeve is HomeKit garage door controls in CarPlay. If you have multiple garage doors and they are both in HomeKit, you can only see one of your garage doors in CarPlay, and there's not even a way to choose which garage door you see. We have two garage doors but only use one for cars. I wanted to have them both set up as HomeKit devices so that I could see status and get alerts if I left the second one open, but CarPlay decided that it wanted to use the second door, the one I don't use for cars. The only way to get CarPlay to pick the correct door was to completely disable HomeKit on my other garage door.
  - radicaldreamer 5y ago
    This is the same story with Siri...
  - xoa 5y ago
    >It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. Yeah, and strategically it seems pretty important too. Even more so since that area is an important aspect to the future value of not just existing stuff like their watch or siri, but future wearables like AR. And it seems like something that should mesh fairly well with Apple's core competencies and business (unlike, for example, a frigging car). It's also an area with massive privacy and security concerns which should also be a natural extension of some of their efforts. Yet somehow it's just an unpleasant mess. Simultaneously too limiting and yet awkward to work with or troubleshoot. And even stranger, they've put real effort recently into power user automation stuff with their Shortcuts/Automation/Automator items. Guess we're seeing the classic shadow cast by internal organizational politics, power, and attention that's all out of view. May just be another aspect of Apple's organizational structure, which is excellent at singular vertical efforts but mediocre at multitasking.
  - travisgriggs 5y ago
    > It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. This is usually a sign that the MBAs are taking over and playing software developers via spec driven development, the actual software artisans having been reduced to a transpiling transfer function. I don't have any contacts inside of Apple these days; it would be interesting to hear whether developers on the inside are feeling this is the case.
    - wronglebowski 5y ago
      Wouldn't they just be pushing the channel to get the fees from certification? Like the made for iPod/iPhone program? The way I see it Apple believes they are entitled to a percentage of all things in life. They can't sell Home automation as a service yet but they can certainly make up some of the cost by gouging their partners to join the ecosystem.
    - deleted 5y ago
      [deleted]
    - KarlKemp 5y ago
      That’s a good example of self-reinforcing stereotypes or, maybe, correlation without causation. Apple projects get a big team, launch, and then tend to languish because the team moved on to the next thing. “Business types” have little to do with it: as far as we can tell, more or less nothing is happening. That’s not the outcome of a bad strategy, which tends more towards lots of activity with little usefulness. The possible correlation could come from the fact that when development is more or less suspended, the tech people hand over to business because that’s all that is supposed to happen from here on. HomeKit has -art era and customers just like iTunes or the App Store, so it often operates like an ongoing business rather than a software project. There have also been several instances of projects languishing where we know tech people were still in control: Scott Forstall alone ran Siri, Maps, the App Store and iTunes at times where they each saw stagnation at best.
  - lloeki 5y ago
    > My random pet peeve Mine is as follows: The complete inability to set light tint or brightness/turn on or off lights for a whole room at once, except via Siri, but Siri can't set lights to "warm white", only colours (and only if you have colour bulbs, warm<->cool adjustable ones don't count as "colour"). Actually you CAN turn off per room, but doing so requires going to a select room page which is an atrocious experience, who in their right mine swipes through half a dozen pages until they stumble on the right one? Oh, and if you thought about setting backgrounds to identify them quicker, well the backgrounds don't sync across devices. Ah, but they finally added the list of rooms to the menu that is under the top left "home" icon (obviously, that's a menu, right? not to be confused with the bottom left "home" icon which is not), which is not just cramp-inducing to get to, it's also that you can't reorder the room list: creation order or GTFO. Let's not talk about automations which are ridiculously underpowered (whether going through Home or Shortcuts, which are two entirely segregate worlds): every time I have a nice, useful idea it's outright impossible to implement, e.g turn on a given light on a scene/event but turn it off after 10min. Like, a 10min timer is seemingly impossible to implement by the Apple team in any shape or form (as is the "Set wallpaper" action, as a matter of fact) (Apparently some people hacked stuff like setting a timer or an alarm or something and having a second shortcut run on that event. I didn't even try because if I wanted to indulge in such contraptions I would play The Incredible Machine.) Oh, and BTW Adaptive Lighting won't work with my otherwise perfectly adjustable bulbs along the required axis, because reasons. > But the software side, the part that the user actually interacts with, seems so under thought. Have you even tried the Home app on macOS? It's an absolute joke, you so obviously have to emulate touch events with a pointing device it's as usable to save your life as navigating a 3D file manager on Unix. Ah, and so the macOS app is basically the iOS through Catalyst right? So why is it absolutely impossible to set my Mac mini to be a Home Hub, but it is for my iPad which is a) not always home and b) on battery, so may fall out of energy? PS: yes, I tried Home Assistant, which is a nice piece of work, but it's also prone to breakage on updates, and either "develop through a UI" (which doesn't scale) or "mold into the framework and become a contributor" (which is way out of balance). So I've been hacking at CoAP on Ruby and implementing the IKEA Tradfri protocol so that I can have some stupid simple Ruby scripts running on a machine and achieve what I want: circadian lighting (which is a lookup curve plus set the values to only lights that are currently ON) and a couple of dead simple automations (each being about five lines, tops).
- paxys 5y ago
  Mac App Store met a similar fate. Lots of developers published there because Apple asked them to, but it is an afterthought for both developers and users. I think the biggest problem with HomeKit is that for most people the primary UI for their smart home is a connected speaker, but a $150-$300 HomePod isn't something you can scatter all over your house the same way as a $20 Echo.
  - wlesieutre 5y ago
    There's only one HomePod anymore and it's $100 (unless we're talking about non-US pricing). Still more than an Echo, but a lot more reasonable than the original HomePod was.
    - Matheus28 5y ago
      > There's only one HomePod anymore Which is a shame, the original one has such good sound quality for its size
      - jakeva 5y ago
        Even doubly so, since at least for some of us they were bricked somehow recently. I had two. One is flashing the volume buttons and is unresponsive otherwise. I can't even replace it without going to ebay and paying double. https://www.reddit.com/r/HomePod/comments/g3lm0e/flashing_volume_lights_of_doom/ https://www.reddit.com/r/HomePod/comments/g3lm0e/flashing_vo...
        after_care 5y ago
        It was a really good upgrade to make the power for HomePod minis be usb-c so there is some data connection. I am hoping for a HomePod2 (or HomePod pro?) that has the same usb-c connection.
  - lotsofpulp 5y ago
    >I think the biggest problem with HomeKit is that for most people the primary UI for their smart home is a connected speaker The iPhone, Watch, iPad, or laptop can all do the same thing as HomePod speakers.
petecooper 5y ago
>CVE-2022-22588 Wow. 12 days into 2022 and we're already up to 22k CVEs filed. Edit: I was wrong. Thanks @minhazm and @geofft.
- geofft 5y ago
  CVEs are allocated to major users (vendors, distros, etc.) in blocks, so this might just be the 88th CVE from whoever has the 22500-23000 block or whatever.
- deleted 5y ago
  [deleted]
- minhazm 5y ago
  606 in 2022 so far according to: https://www.cvedetails.com/vulnerability-list/year-2022/vulnerabilities.html https://www.cvedetails.com/vulnerability-list/year-2022/vuln...
  - iqanq 5y ago
    606 in 13 days is appalling though
    - op00to 5y ago
      Why? Would you rather hide the problem?
webinvest 5y ago
There was only 1 Denial of Service bug patched. No where as many exploits patched as in prior versions: https://news.ycombinator.com/item?id=29198901 https://news.ycombinator.com/item?id=29198901
p49k 5y ago
Background: https://trevorspiniolas.com/doorlock/doorlock.html https://trevorspiniolas.com/doorlock/doorlock.html
- hosteur 5y ago
  This should be the article linked in the story.
  - Operyl 5y ago
    That article was discussed at length already, the current linked page is the conclusion from Apple (not mentioned on the article from GP).
Syonyk 5y ago
Dear Apple: User-set name strings are not trusted data. Even if you filter on submission, people will find ways around it. This is the second "User can set the name of a device to a string that screws things up badly" bug in recent history. The other one was the "You can set your AirTag name to cross site scripting tags" one.
- ripa 5y ago
  there was also the WiFi name where it would disable the iPhone's WiFi. https://www.macrumors.com/2021/06/20/ios-bug-network-name-disable-wifi-iphones/ https://www.macrumors.com/2021/06/20/ios-bug-network-name-di...
- _jal 5y ago
  Renaming your phone also triggered the Log4Shell vuln at one point. https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sms-log4shell-log4j-exploit-researchers-test https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sm...
  - throw10920 5y ago
    This is a good point - here, the victim wouldn't have been the user, but Apple themselves, illustrating that (occasionally, not always) being lax with security can come and bite you (instead of just your users).
    - olliej 5y ago
      They weren’t lax with security, they updated as quickly as every other major company did. They were caught out by the same zero day as everyone else. The whole point of a “zero day” is that people don’t know about it ahead of time.
      - throw10920 5y ago
        Deploying unaudited code is being lax with security.
emptybottle 5y ago
It's a shame there isn't an alternate software path for iOS devices that have aged out of security updates. I have an iPad whose hardware has life left in it, but as time goes on it's more and more it's worrisome to run a connected device without security updates.
- bxparks 5y ago
  Yeah, I have an iPad4 that looks like it's brand new. I bought it for my mom, she treated it like a baby for a few years, then returned it to me. It is stuck on iPadOS 10.3.3. It now sits on a shelf, running Yahoo Weather and nothing else. What a waste of a perfectly good hardware.
  - musicale 5y ago
    It's too bad. Apple hardware tends to last a lot longer than the software. At least my iPad Air 2 from 2014 is still getting updates.
  - knolan 5y ago
    That’s a nine year old tablet. It’s far from useless just because it runs iOS 10. My partner’s mother has an old iPad mini from the same year and it’s perfect for FaceTime calls. It’s basically an iPad 2 SoC. I wouldn’t do any personal banking on it however.
    - 2muchcoffeeman 5y ago
      My mom still uses my iPad 2. 11 years. It must have stopped receiving updates a couple of years ago. But they won’t upgrade. The only reason they upgraded their phones was that their storage ran out and they wanted more pictures of their grandkids.
      - prawn 5y ago
        Our oldest of five iPads is an original from 2010 which maxes out at iOS 5.1.1, mostly used by our youngest child. It's very clunky and limited. Anyone in the house older than 4yo doesn't really tolerate it. Hopefully given its limited use (no browsing, etc) any security risk is minimised?
Copernicron 5y ago
Does anyone know what's going on with iOS 14? I didn't upgrade because Apple said it would still be supported but there hasn't been any news in quite a while.
egberts1 5y ago
That’s why i always have HomeKit disabled but it’s the damn Apple upgrade or power cycle that keeps flipping it BACK on.
- op00to 5y ago
  You “always” have HomeKit disabled because of an undisclosed security hole in iOS?

86 points by shantara 5y ago

xoa 5y ago

Ars amongst a number of others had an article covering this [0] last week. Not that trivial to exploit but sounded relatively nasty if it was triggered, so better late than never. Though HomeKit overall has been a pretty significant disappointment and definitely feels like one of those semi-afterthought type of Apple projects at this point. Important enough or with enough internal sway to not get dropped outright, but not enough to get any serious effort either. Like the Mac Pro maybe, though that one is even more disappointing. So I wonder how many people make much use of it, let alone share with others. ---- 0: https://arstechnica.com/information-technology/2022/01/5-months-on-apple-has-yet-to-fix-ios-bug-that-sends-devices-into-a-crash-spiral/ https://arstechnica.com/information-technology/2022/01/5-mon...

mason55 5y ago
> Though HomeKit overall has been a pretty significant disappointment and definitely feels like one of those semi-afterthought type of Apple projects at this point. It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. My random pet peeve is HomeKit garage door controls in CarPlay. If you have multiple garage doors and they are both in HomeKit, you can only see one of your garage doors in CarPlay, and there's not even a way to choose which garage door you see. We have two garage doors but only use one for cars. I wanted to have them both set up as HomeKit devices so that I could see status and get alerts if I left the second one open, but CarPlay decided that it wanted to use the second door, the one I don't use for cars. The only way to get CarPlay to pick the correct door was to completely disable HomeKit on my other garage door.
- radicaldreamer 5y ago
  This is the same story with Siri...
- xoa 5y ago
  >It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. Yeah, and strategically it seems pretty important too. Even more so since that area is an important aspect to the future value of not just existing stuff like their watch or siri, but future wearables like AR. And it seems like something that should mesh fairly well with Apple's core competencies and business (unlike, for example, a frigging car). It's also an area with massive privacy and security concerns which should also be a natural extension of some of their efforts. Yet somehow it's just an unpleasant mess. Simultaneously too limiting and yet awkward to work with or troubleshoot. And even stranger, they've put real effort recently into power user automation stuff with their Shortcuts/Automation/Automator items. Guess we're seeing the classic shadow cast by internal organizational politics, power, and attention that's all out of view. May just be another aspect of Apple's organizational structure, which is excellent at singular vertical efforts but mediocre at multitasking.
- travisgriggs 5y ago
  > It's strange because they have clearly spent a LOT of time pushing partner channel development and certification. But the software side, the part that the user actually interacts with, seems so under thought. This is usually a sign that the MBAs are taking over and playing software developers via spec driven development, the actual software artisans having been reduced to a transpiling transfer function. I don't have any contacts inside of Apple these days; it would be interesting to hear whether developers on the inside are feeling this is the case.
  - wronglebowski 5y ago
    Wouldn't they just be pushing the channel to get the fees from certification? Like the made for iPod/iPhone program? The way I see it Apple believes they are entitled to a percentage of all things in life. They can't sell Home automation as a service yet but they can certainly make up some of the cost by gouging their partners to join the ecosystem.
  - deleted 5y ago
    [deleted]
  - KarlKemp 5y ago
    That’s a good example of self-reinforcing stereotypes or, maybe, correlation without causation. Apple projects get a big team, launch, and then tend to languish because the team moved on to the next thing. “Business types” have little to do with it: as far as we can tell, more or less nothing is happening. That’s not the outcome of a bad strategy, which tends more towards lots of activity with little usefulness. The possible correlation could come from the fact that when development is more or less suspended, the tech people hand over to business because that’s all that is supposed to happen from here on. HomeKit has -art era and customers just like iTunes or the App Store, so it often operates like an ongoing business rather than a software project. There have also been several instances of projects languishing where we know tech people were still in control: Scott Forstall alone ran Siri, Maps, the App Store and iTunes at times where they each saw stagnation at best.
- lloeki 5y ago
  > My random pet peeve Mine is as follows: The complete inability to set light tint or brightness/turn on or off lights for a whole room at once, except via Siri, but Siri can't set lights to "warm white", only colours (and only if you have colour bulbs, warm<->cool adjustable ones don't count as "colour"). Actually you CAN turn off per room, but doing so requires going to a select room page which is an atrocious experience, who in their right mine swipes through half a dozen pages until they stumble on the right one? Oh, and if you thought about setting backgrounds to identify them quicker, well the backgrounds don't sync across devices. Ah, but they finally added the list of rooms to the menu that is under the top left "home" icon (obviously, that's a menu, right? not to be confused with the bottom left "home" icon which is not), which is not just cramp-inducing to get to, it's also that you can't reorder the room list: creation order or GTFO. Let's not talk about automations which are ridiculously underpowered (whether going through Home or Shortcuts, which are two entirely segregate worlds): every time I have a nice, useful idea it's outright impossible to implement, e.g turn on a given light on a scene/event but turn it off after 10min. Like, a 10min timer is seemingly impossible to implement by the Apple team in any shape or form (as is the "Set wallpaper" action, as a matter of fact) (Apparently some people hacked stuff like setting a timer or an alarm or something and having a second shortcut run on that event. I didn't even try because if I wanted to indulge in such contraptions I would play The Incredible Machine.) Oh, and BTW Adaptive Lighting won't work with my otherwise perfectly adjustable bulbs along the required axis, because reasons. > But the software side, the part that the user actually interacts with, seems so under thought. Have you even tried the Home app on macOS? It's an absolute joke, you so obviously have to emulate touch events with a pointing device it's as usable to save your life as navigating a 3D file manager on Unix. Ah, and so the macOS app is basically the iOS through Catalyst right? So why is it absolutely impossible to set my Mac mini to be a Home Hub, but it is for my iPad which is a) not always home and b) on battery, so may fall out of energy? PS: yes, I tried Home Assistant, which is a nice piece of work, but it's also prone to breakage on updates, and either "develop through a UI" (which doesn't scale) or "mold into the framework and become a contributor" (which is way out of balance). So I've been hacking at CoAP on Ruby and implementing the IKEA Tradfri protocol so that I can have some stupid simple Ruby scripts running on a machine and achieve what I want: circadian lighting (which is a lookup curve plus set the values to only lights that are currently ON) and a couple of dead simple automations (each being about five lines, tops).
paxys 5y ago
Mac App Store met a similar fate. Lots of developers published there because Apple asked them to, but it is an afterthought for both developers and users. I think the biggest problem with HomeKit is that for most people the primary UI for their smart home is a connected speaker, but a $150-$300 HomePod isn't something you can scatter all over your house the same way as a $20 Echo.
- wlesieutre 5y ago
  There's only one HomePod anymore and it's $100 (unless we're talking about non-US pricing). Still more than an Echo, but a lot more reasonable than the original HomePod was.
  - Matheus28 5y ago
    > There's only one HomePod anymore Which is a shame, the original one has such good sound quality for its size
    - jakeva 5y ago
      Even doubly so, since at least for some of us they were bricked somehow recently. I had two. One is flashing the volume buttons and is unresponsive otherwise. I can't even replace it without going to ebay and paying double. https://www.reddit.com/r/HomePod/comments/g3lm0e/flashing_volume_lights_of_doom/ https://www.reddit.com/r/HomePod/comments/g3lm0e/flashing_vo...
      - after_care 5y ago
        It was a really good upgrade to make the power for HomePod minis be usb-c so there is some data connection. I am hoping for a HomePod2 (or HomePod pro?) that has the same usb-c connection.
- lotsofpulp 5y ago
  >I think the biggest problem with HomeKit is that for most people the primary UI for their smart home is a connected speaker The iPhone, Watch, iPad, or laptop can all do the same thing as HomePod speakers.

petecooper 5y ago

>CVE-2022-22588 Wow. 12 days into 2022 and we're already up to 22k CVEs filed. Edit: I was wrong. Thanks @minhazm and @geofft.

geofft 5y ago
CVEs are allocated to major users (vendors, distros, etc.) in blocks, so this might just be the 88th CVE from whoever has the 22500-23000 block or whatever.
deleted 5y ago
[deleted]
minhazm 5y ago
606 in 2022 so far according to: https://www.cvedetails.com/vulnerability-list/year-2022/vulnerabilities.html https://www.cvedetails.com/vulnerability-list/year-2022/vuln...
- iqanq 5y ago
  606 in 13 days is appalling though
  - op00to 5y ago
    Why? Would you rather hide the problem?

webinvest 5y ago

There was only 1 Denial of Service bug patched. No where as many exploits patched as in prior versions: https://news.ycombinator.com/item?id=29198901 https://news.ycombinator.com/item?id=29198901

p49k 5y ago

Background: https://trevorspiniolas.com/doorlock/doorlock.html https://trevorspiniolas.com/doorlock/doorlock.html

hosteur 5y ago
This should be the article linked in the story.
- Operyl 5y ago
  That article was discussed at length already, the current linked page is the conclusion from Apple (not mentioned on the article from GP).

Syonyk 5y ago

Dear Apple: User-set name strings are not trusted data. Even if you filter on submission, people will find ways around it. This is the second "User can set the name of a device to a string that screws things up badly" bug in recent history. The other one was the "You can set your AirTag name to cross site scripting tags" one.

ripa 5y ago
there was also the WiFi name where it would disable the iPhone's WiFi. https://www.macrumors.com/2021/06/20/ios-bug-network-name-disable-wifi-iphones/ https://www.macrumors.com/2021/06/20/ios-bug-network-name-di...
_jal 5y ago
Renaming your phone also triggered the Log4Shell vuln at one point. https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sms-log4shell-log4j-exploit-researchers-test https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sm...
- throw10920 5y ago
  This is a good point - here, the victim wouldn't have been the user, but Apple themselves, illustrating that (occasionally, not always) being lax with security can come and bite you (instead of just your users).
  - olliej 5y ago
    They weren’t lax with security, they updated as quickly as every other major company did. They were caught out by the same zero day as everyone else. The whole point of a “zero day” is that people don’t know about it ahead of time.
    - throw10920 5y ago
      Deploying unaudited code is being lax with security.

emptybottle 5y ago

It's a shame there isn't an alternate software path for iOS devices that have aged out of security updates. I have an iPad whose hardware has life left in it, but as time goes on it's more and more it's worrisome to run a connected device without security updates.

bxparks 5y ago
Yeah, I have an iPad4 that looks like it's brand new. I bought it for my mom, she treated it like a baby for a few years, then returned it to me. It is stuck on iPadOS 10.3.3. It now sits on a shelf, running Yahoo Weather and nothing else. What a waste of a perfectly good hardware.
- musicale 5y ago
  It's too bad. Apple hardware tends to last a lot longer than the software. At least my iPad Air 2 from 2014 is still getting updates.
- knolan 5y ago
  That’s a nine year old tablet. It’s far from useless just because it runs iOS 10. My partner’s mother has an old iPad mini from the same year and it’s perfect for FaceTime calls. It’s basically an iPad 2 SoC. I wouldn’t do any personal banking on it however.
  - 2muchcoffeeman 5y ago
    My mom still uses my iPad 2. 11 years. It must have stopped receiving updates a couple of years ago. But they won’t upgrade. The only reason they upgraded their phones was that their storage ran out and they wanted more pictures of their grandkids.
    - prawn 5y ago
      Our oldest of five iPads is an original from 2010 which maxes out at iOS 5.1.1, mostly used by our youngest child. It's very clunky and limited. Anyone in the house older than 4yo doesn't really tolerate it. Hopefully given its limited use (no browsing, etc) any security risk is minimised?

Copernicron 5y ago

Does anyone know what's going on with iOS 14? I didn't upgrade because Apple said it would still be supported but there hasn't been any news in quite a while.

egberts1 5y ago

That’s why i always have HomeKit disabled but it’s the damn Apple upgrade or power cycle that keeps flipping it BACK on.

op00to 5y ago
You “always” have HomeKit disabled because of an undisclosed security hole in iOS?