4 ms·
The ability to exclude apps or websites from the lockdown seems at the face of it to reintroduce attack surface that lockdown mode is meant to prevent. Countdo
by Arrath 4y ago
The ability to exclude apps or websites from the lockdown seems at the face of it to reintroduce attack surface that lockdown mode is meant to prevent.
Countdown to some 0day no-click exploit that adds an app or service or site to the exclusion list and then proceeds with a further attack?
- Shank 4y ago> Countdown to some 0day no-click exploit that adds an app or service or site to the exclusion list and then proceeds with a further attack? What type of exploit would be able to add something to the exclusion list but not already perform arbitrary code execution and just attack the system directly? This seems incredibly unlikely -- and roundabout, because you'd still have to get the browser to load the page.
- 1f60c 4y agoThe only way I can think of that could work is if an attacker made a website (and convinced the target to visit it) that said something like: > Tap Aa > Disable Lockdown Mode to view News Org secure content Similarly to how malicious Word docs get users to enable macros.