5 ms·

This is pretty cool. Imagine what Tik Tok could do from a kid's phone when their parent is working on their laptop, on the LAN.

snazz 4y ago
iOS requires user permission for each app to make local network requests (Settings -> Privacy & Security). So in theory this shouldn’t be possible, unless ByteDance came up with a way to bypass it that made it through Apple’s review process.
- steponlego 4y ago
  You could log into any OS X machine by just pressing enter at the login screen enough times, for over a decade. Apple has trash security and they've stopped even saying what their security updates fix.
  - brookst 4y ago
    That’s not a convincing argument that this VM somehow reflects a LAN based sandbox escape attack.
    - steponlego 4y ago
      It's just a reflection on how Apple's security can't be trusted, regardless of the possible vector. Big companies like Apple need vulnerabilities for deniable intelligence and national security access, but anybody can find and use these to achieve a breach.
  - winterqt 4y ago
    FWIW: 1. That wasn't a bug for "over a decade," as far as I'm aware. It was only introduced with an OS update 2. I could be wrong here, but it required you to already have created a root user with a blank password, which isn't possible unless you know how to trigger another bug that does it.
  - sebazzz 4y ago
    "TikTok requires local network access to <cast to your TV or some other reason>" and there we have it, local network access.
- micromacrofoot 4y ago
  I imagine TikTok could get pretty far simply asking users for permission. A significant number of users would probably allow it. Fortunately watchdogs would probably get it into the news pretty quickly.
lxgr 4y ago
What exactly could it do using a VM that it can’t already do using native JavaScript (or anything that compiles to it) or WASM? Note that the parent article is about the website, not mobile app.
beepbooptheory 4y ago
Tell us, what could it do?
- steponlego 4y ago
  Open a reverse proxy and scan your LAN direct from Beijing for one.

snazz 4y ago

iOS requires user permission for each app to make local network requests (Settings -> Privacy & Security). So in theory this shouldn’t be possible, unless ByteDance came up with a way to bypass it that made it through Apple’s review process.

steponlego 4y ago
You could log into any OS X machine by just pressing enter at the login screen enough times, for over a decade. Apple has trash security and they've stopped even saying what their security updates fix.
- brookst 4y ago
  That’s not a convincing argument that this VM somehow reflects a LAN based sandbox escape attack.
  - steponlego 4y ago
    It's just a reflection on how Apple's security can't be trusted, regardless of the possible vector. Big companies like Apple need vulnerabilities for deniable intelligence and national security access, but anybody can find and use these to achieve a breach.
- winterqt 4y ago
  FWIW: 1. That wasn't a bug for "over a decade," as far as I'm aware. It was only introduced with an OS update 2. I could be wrong here, but it required you to already have created a root user with a blank password, which isn't possible unless you know how to trigger another bug that does it.
- sebazzz 4y ago
  "TikTok requires local network access to <cast to your TV or some other reason>" and there we have it, local network access.
micromacrofoot 4y ago
I imagine TikTok could get pretty far simply asking users for permission. A significant number of users would probably allow it. Fortunately watchdogs would probably get it into the news pretty quickly.

lxgr 4y ago

What exactly could it do using a VM that it can’t already do using native JavaScript (or anything that compiles to it) or WASM? Note that the parent article is about the website, not mobile app.

beepbooptheory 4y ago

Tell us, what could it do?

steponlego 4y ago
Open a reverse proxy and scan your LAN direct from Beijing for one.