4 ms·
I believe this is theoretically fixed in Ventura via the mechanism of always checking notarization status upon execution, in which case Apple could publish a no
by mrtesthah 4y ago
I believe this is theoretically fixed in Ventura via the mechanism of always checking notarization status upon execution, in which case Apple could publish a notarization revocation ticket for the old insecure AppleMobileBackup binary to make it inoperable without significant intentional user action.
- scarface74 4y agoAnd that doesn’t help if the entire purpose for the passcode requirement is to keep other actors from backing up your phone.
- gruez 4y agoThat shouldn't be an issue because to start a backup, the computer must be "trusted" which requires you to enter your pin.
- scarface74 4y agoUnless there is a security vulnerability that allows for the host to be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/ https://theevilbit.github.io/posts/cve-2022-32929/
- mrtesthah 4y agoI don't think that page demonstrates how the host itself could be spoofed. Maybe you could show me what you mean.
- benguild 4y agoThe issue may be that the old binary is still able to run.