4 ms·

This should be a showstopper, critical issue. I’m surprised to see this still be in the wild after being posted on Friday of last week.

walrus01 4y ago
Imagine getting still frames of somebody else's bedroom photos or kinky selfies sent to a partner or something similar rendered into your own video. This could be very much like the technical cloud-based version of the fictional Tyler Durden splicing dick pics into single frames of 35mm film movies. Based on what people use phones for these days some sizable percentage of icloud synced photos have to be something you really wouldn't want to get out there to random other icloud users.
- Kenji 4y ago
  Imagine having CSAM inserted in your videos, then getting persecuted for it. Oh wait, they already scan for it, good on them.
  - infogulch 4y ago
    Hm, what if you modified a CSAM video to evade detection (adversarial ML etc), then injected it onto the target's machine with this fun bug, then when the target's computer automatically creates a thumbnail for the video the thumbnail would be automatically flagged.
    - deleted 4y ago
      [deleted]
    - smoldesu 4y ago
      Or just make your own fake/questionable hash collisions with a script Some Guy made on Github: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX
greasyfullfryup 4y ago
I'm not surprised at all. I've reported literal malware in the App Store, with disassembly of the binary, etc. to them and Apple's "security" team did nothing. The inaction wasn't the worst part, it was their complete disinterest and lack of communication. Google is even worse, you can't contact a human. Their app reporting process insisted I create a Google account and report it from within Android's App Store if I expected them to take action. I have better things to do than jump through unnecessary hoops.
- userbinator 4y ago
  IMHO leaking PII is on an entirely different level than "just" malware.

walrus01 4y ago

Imagine getting still frames of somebody else's bedroom photos or kinky selfies sent to a partner or something similar rendered into your own video. This could be very much like the technical cloud-based version of the fictional Tyler Durden splicing dick pics into single frames of 35mm film movies. Based on what people use phones for these days some sizable percentage of icloud synced photos have to be something you really wouldn't want to get out there to random other icloud users.

Kenji 4y ago
Imagine having CSAM inserted in your videos, then getting persecuted for it. Oh wait, they already scan for it, good on them.
- infogulch 4y ago
  Hm, what if you modified a CSAM video to evade detection (adversarial ML etc), then injected it onto the target's machine with this fun bug, then when the target's computer automatically creates a thumbnail for the video the thumbnail would be automatically flagged.
  - deleted 4y ago
    [deleted]
  - smoldesu 4y ago
    Or just make your own fake/questionable hash collisions with a script Some Guy made on Github: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX

greasyfullfryup 4y ago

I'm not surprised at all. I've reported literal malware in the App Store, with disassembly of the binary, etc. to them and Apple's "security" team did nothing. The inaction wasn't the worst part, it was their complete disinterest and lack of communication. Google is even worse, you can't contact a human. Their app reporting process insisted I create a Google account and report it from within Android's App Store if I expected them to take action. I have better things to do than jump through unnecessary hoops.

userbinator 4y ago
IMHO leaking PII is on an entirely different level than "just" malware.