9 ms·

Spyware vendors use 0-days and n-days against Android, iOS and Chrome

205 points by satoshiiii 4y ago

varenc 4y ago
Is there any indication if iOS’s Lockdown Mode[0] would have stopped these exploit chains? [0] https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650
- Gaelan 4y ago
  Yes (from the Google blog post linked elsewhere in the thread): > CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation). Lockdown mode disables the Webkit JIT.
- jeroenhd 4y ago
  It's worth mentioning that most of security measures are also possible in the Chromium engine in case you're running that. I use Bromite (Chromium fork) on my phone which has the option to run with JIT disabled by default, which would've been how Lockdown Mode would stop this exploit. Very rarely do I click the permissions popup to enable it again, mostly for games and demos requiring WASM or depending on heavy Javascript.
CubsFan1060 4y ago
Am I right in that these were fixed (at least in iOS), some time ago? https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2021-30900 https://nvd.nist.gov/vuln/detail/CVE-2021-30900
- dmix 4y ago
  Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions.
  - kramerger 4y ago
    > Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions Well, there was that incident with project zero vs Microsoft a while back... Lets hope TAG is better than PZ
    - tptacek 4y ago
      The argument for disclosure prior to patch is stronger in the TAG case (active exploitation) than in the normal PZ case, not weaker.
    - rs_rs_rs_rs_rs 4y ago
      Are you talking about that incident when Google folks decided to make information about a vulnerability public so people can protect themselves while Microsoft were dragging their feet working on a fix?
  - illiarian 4y ago
    This reminds of a great thought experiment [1] If you discover an exploitable flaw in pacemakers, do you: - disclose it immediately? This may lead to an increased number of attacks on pacemakers - disclose it to manufacturers, and wait for them to patch things before dicslosing? - if manufacturers are too slow to fix this, or flat out refuse to do anything, do you still disclose? I'd hate to be on the team that needs to make the disclosure decisions and figuring out whether the fallout is worse than just keeping the knowledge hidden. Of course, it's not a pacemaker-level in this particular case, but every time I see exploits and their disclosure, I'm reminded of this. [1] Well, sadly it's not really a thought experiment: https://www.mnemonic.io/resources/blog/uncovering-vulnerabilities-in-pacemakers/ https://www.mnemonic.io/resources/blog/uncovering-vulnerabil...
    - bell-cot 4y ago
      IANAL...but for pacemakers, I'd be tempted to mail the details to the legal department(s) of the manufacturer(s). Registered mail. With a little note about how you received legal advice on your proper course of action in this situation...from a law firm notorious for suing medical device manufacturers.
sbuccini 4y ago
Can we change the link to the official blog post, which has more details? https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/ https://blog.google/threat-analysis-group/spyware-vendors-us...
- sieabahlpark 4y ago
  How will the poor authors of the bleepingcomputers website eat and feed their families if we rob them of their ad money for blogspam?
- dang 4y ago
  Yes. Changed from https://www.bleepingcomputer.com/news/security/google-finds-more-android-ios-zero-days-used-to-install-spyware/ https://www.bleepingcomputer.com/news/security/google-finds-... now. Thanks!
hospitalJail 4y ago
A hardware exploit on one browser and a web based exploit are not even on the same level. Instead of lumping all of Android, just name the brands with hardware issues. IMO its clickbait. I don't use both the phones listed and the web browser listed. But hey, they got me to click. I'm already getting desensitized.
- illiarian 4y ago
  > Instead of lumping all of Android, just name the brands with hardware issues "Pixel, Samsung, Xiaomi, Oppo and others". So, roughly 90-99% of the Android market
  - brutusurp 4y ago
    Exactly this.
- kramerger 4y ago
  Am I correct that this does not apply to Qualcomm? That would mean it's limited to some Samsumg phones and random Chinese chipset, but Samsung is pretty good at swift security updates so I am confused why this one wasn't deployed on time.
nixcraft 4y ago
From the https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/ https://blog.google/threat-analysis-group/spyware-vendors-us... > In November 2022, TAG discovered exploit chains with 0-days affecting Android and iOS that were delivered via bit.ly links sent over SMS to users located in Italy, Malaysia and Kazakhstan. When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website. You can harden your iPhone/iOS from a cyberattack with Lockdown Mode[0]. It blocks those clickable links and removes many other attack vectors https://support.apple.com/en-gb/guide/iphone/iph049680987/ios https://support.apple.com/en-gb/guide/iphone/iph049680987/io... However, I'm unsure if an attacker could bypass Lockdown Mode with additional bugs on iOS. [0] https://support.apple.com/en-sg/HT212650 https://support.apple.com/en-sg/HT212650
- ikekkdcjkfke 4y ago
  Think i clicked a fake video on twitter going to a bit.ly domain not long ago
userbinator 4y ago
This is another one of those cases that seems to be completely nullified by keeping JS off by default and whitelisting it only on sites you really trust. But of course the biggest spyware company in the world relies on the same to track its users.
- userbinator 4y ago
  It's amusing to see the Google sympathisers attempt to deflect observations of the truth. You can't brainwash everyone, and the more you try, the more we'll resist.
Hizonner 4y ago
[flagged]
deleted 4y ago
[deleted]
agloe_dreams 4y ago
[flagged]
- prdonahue 4y ago
  Who cares if there’s a marketing component to it? P0’s efforts make the Internet more secure for everyone. ETA: They also need to draw attention sometimes to slow actors in addressing the fixes.
- Arnt 4y ago
  No, the official policy is that that team is to poke at anything that's used together with Google, which is ~everything. It started as a result of someone using a security bug in other software to gain privileged access to Google. You have a phone. People use the same phone together with a Google service and a security-related bug in the phone could be used to e.g. steal your Google password, therefore the phone's software is in-scope, no matter who made it or what it runs. I see the sense of it, but it's weird to me too. What's not used together with Google? That's such a wide scope. But it's not a matter of security or marketing, the weirdness is in the wide usage. Kudos to Google for working on it.
  - agloe_dreams 4y ago
    Exactly. A few months (or was it a year?) ago they had a 0-day on iOS that was fixed and made a huge stink about it and it all just read like marketing for a Pixel. It's a wide net that I'm still glad they do...just weird. IT does make me wonder...what...don't..they report? Why wouldn't they hold a few smaller items back, focus a little more on iOS exploits? It's just a "Be aware of the source" thought. Still a net positive.
    - chatmasta 4y ago
      They find plenty of bugs in their own devices too. And it's not like they aren't responsibly disclosing to Apple. But I'd be curious how strictly their 90 day disclosure policy applies to Google products, and if they are more willing to grant some leeway when a fix isn't pushed in time...
flanbiscuit 4y ago
> When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website. So at least this is not a 0-click exploit I'm an Android Pixel (5a) user, how does this affect me... > The Android exploit chain targeted users on phones with an ARM GPU according to Wikipedia, my Pixel 5a has an Adreno 620 GPU made by Qualcomm so looks like I'm safe there. Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based. > running Chrome versions prior to 106. Current Chrome for Android version on my phone is 111.0.5563.116. The earliest version of Chrome for Android version 106 I can find is late Sept 2022[1], so not super long ago but it was at least fixed back in Sept. > Note, Pixel devices with the 2023-01-05 security update are protected against both exploit chains in this blog. My last security update was 2023-03-05 (and I mentioned my Chrome version above) so I'm protected > Chrome users updated to at least version 108.0.5359 are also protected. So which is it? affects users of Chrome prior to 106 yet you need to be on Chrome 108 to be protected? This is a bit confusing. Looks like Chrome for Android v108.0.5359.x was released late November 2022[2]. Just needed to do that for peace of mind. I understand that Google wouldn't be posting this if they hadn't at released a fix for this and handled their Pixel phones. I really wish there was some kind of database where I can look up a phone model and see a list of exploits and whether they have been patched or not, at least when they are hardware and/or OS related. 0. https://developer.arm.com/Tools%20and%20Software/Arm%20Mobile%20Studio#Supported-Devices https://developer.arm.com/Tools%20and%20Software/Arm%20Mobil... 1. https://chromereleases.googleblog.com/2022/09/chrome-for-android-update_01538182103.html https://chromereleases.googleblog.com/2022/09/chrome-for-and... 2. https://chromereleases.googleblog.com/2022/11/chrome-for-android-update_29.html https://chromereleases.googleblog.com/2022/11/chrome-for-and...
- wccrawford 4y ago
  It could be that Chrome 106 on OS 2023-01-05 are protected, or just Chrome 108 on any OS is protected. Or it could be sloppy reporting.
ar9av 4y ago
[flagged]
ocal5 4y ago
So, Safe in Chrome since November 2022 Safe in Ios since November 2021
- dylan604 4y ago
  My recollection of the Android universe is that not all updates are equally available/supported leaving devices out of date. Is this still the case, or has the provider/devices/OS ecosystem improved? Also, what is the install rate of these updates? Just because an update is available does not mean that it is deployed.
  - lern_too_spel 4y ago
    On Android, Chrome updates without a device restart, unlike WebKit on iOS, and updates are faster to roll out.
    - kccqzy 4y ago
      Yes! As someone using both iOS and Android I cannot believe how Apple still requires a lengthy update process for those critical security updates. On my Pixel phone, installing the update is no slower than a regular restart. Users care about how long the downtime is for software updates. Make it faster, Apple.
    - initplus 4y ago
      Slower to update, but fixed 12 months earlier. Pick you poison...
neodypsis 4y ago
This is convincing me that iOS users should enable Lockdown Mode, irrespective of whom they may be.
- Syonyk 4y ago
  Yes. 100%. Do it, don't look back. Disable it on a per-website basis if needed, but... largely, I simply accept that I don't need to do those things I can't do with it on. I've been running Lockdown on my iOS devices since before iOS 16 came out (I installed the betas to play with it). The only actual annoyances I've found in practical, regular, daily use: - Lots of websites use webfonts for icons. Those don't render, and you get empty "No font glyph" boxes instead for various arrows and icons. It's not a big deal in regular use. - If someone sends you an animated gif as a MMS message (maybe iMessage too), it won't actually animate. Nothing of value is lost. - The latest from "that guy" won't work, because there's no WebGL support for Javascript animations of watches, bicycles, cameras, etc. Given that the JS is non-obfuscated, I don't mind disabling Lockdown for his site. - Some websites still use image formats that don't render, but this is far better than it was even six months ago when Lockdown was fresh and new. Otherwise... I've eliminated an awful lot of actively exploited interfaces for almost no loss in functionality.
  - neodypsis 4y ago
    > Otherwise... I've eliminated an awful lot of actively exploited interfaces for almost no loss in functionality. Cool. That's good to hear, thanks for sharing your experience!
  - guffins 4y ago
    This is my experience exactly. I’ll add to the list of inconveniences: - hyperlinks in iMessage/SMS aren’t clickable (but they can still be copied/pasted) - installed apps that use JavaScript in their interfaces can have the same issues as websites (but you can turn Lockdown off for apps as well, if needed) Overall worthwhile. Something about these “inconveniences” also gives me a sort of psychological disconnection from my phone that I personally find to be very healthy. Similar to how I felt limiting myself to F-Droid in my Android days.
eunos 4y ago
> location and install .IPA files ??? Did they mean APK file?
- mig39 4y ago
  IPA files are the iOS version of APK, I think.
- a_worried_user 4y ago
  [dead]
kvetching 4y ago
This is the real threat of these large AI models. They will revolutionize the ability to find vulnerabilities. Especially if we achieve AGI.
- kibwen 4y ago
  If we have AGI capable of finding vulnerabilities, then we can just ask the AGI to design a system so secure that even the AGI cannot find any vulnerabilities.
  - walterbell 4y ago
    Some vulnerabilities have their own supply chain and incentives.
  - varunjain99 4y ago
    It will be an interesting race... I do think that it'll be easier to find vulnerabilities than to design systems that are provably secure. It's like evaluating a function f(x) vs finding the values of x for which f(x) = 0.
- lima 4y ago
  They will revolutionize the ability to find and fix vulnerabilities. Threat actors can already afford expensive security researchers today. It removes some of the asymmetry.
- KeplerBoy 4y ago
  i worry more about GPT-assisted social engineering.
- tptacek 4y ago
  Writing programs to automatically find bugs is a pursuit almost as old as compilers, and the models used to do that in modern static/symbolic analysis tools are much more sophisticated than an LLM's next-token generator.
a_worried_user 4y ago
[dead]
bobse 4y ago
[flagged]
hrrtyyuuhggg 4y ago
n-days. you mean "known and disclosed issues which we choose not to make fixes available to 80% of our clients so we can sell more disposable pocket computers."
- hrrtyyuuhggg 4y ago
  damn some of these are bugs fixed in 2021. there's easy money to be made just exploiting published mobile phone vulnerabilities! they won't be abandoned and won't be patched! ... who thought splitting ownership and consequences of not updating software was a good idea? being a black hat is almost too tempting today.
  - Zuiii 4y ago
    > who thought splitting ownership and consequences of not updating software was a good idea? You can't because companies refuse to let customers own and control their devices. Because we can't control them, we can't patch them up. I have a 15 year-old PC that's still running today. It's fully patched up because its vendor gives me enough control to do so. There should be laws that ban device manufacturers from building or bundling software. Something like Bell Laboratories' breakup, but applied industry-wide.
IG_Semmelweiss 4y ago
what about firefox ?
hulitu 4y ago
Captain obvious strikes again.
psychphysic 4y ago
> These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house. I wonder what this means? Why does it matter if the nation couldn't make the tool themselves? I might be reading into it. But is there an idea that technological sophistication itself imbues morals? And these unsophisticated nations are amoral? Or maybe even a might is right mindset? I'm surely reading too much into this but for whatever reason it stood out to me.
- mhoad 4y ago
  This might not be clear if you don’t normally have any interaction with this kind of “policy” friendly language but it’s making a point that it’s falling into the hands of particularly authoritarian governments who use it to target political enemies, journalists and human rights types and that they certainly didn’t have that capability domestically until someone packaged it up and sold it to them. They seem to be acknowledging some parallels to this kind of scenario as to the nuclear proliferation problem and that many governments aren’t ok with irresponsible sellers who will put these things in the hands of anyone with money.

205 points by satoshiiii 4y ago

Is there any indication if iOS’s Lockdown Mode[0] would have stopped these exploit chains? [0] https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650

Gaelan 4y ago
Yes (from the Google blog post linked elsewhere in the thread): > CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation). Lockdown mode disables the Webkit JIT.
jeroenhd 4y ago
It's worth mentioning that most of security measures are also possible in the Chromium engine in case you're running that. I use Bromite (Chromium fork) on my phone which has the option to run with JIT disabled by default, which would've been how Lockdown Mode would stop this exploit. Very rarely do I click the permissions popup to enable it again, mostly for games and demos requiring WASM or depending on heavy Javascript.

CubsFan1060 4y ago

Am I right in that these were fixed (at least in iOS), some time ago? https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2021-30900 https://nvd.nist.gov/vuln/detail/CVE-2021-30900

dmix 4y ago
Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions.
- kramerger 4y ago
  > Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions Well, there was that incident with project zero vs Microsoft a while back... Lets hope TAG is better than PZ
  - tptacek 4y ago
    The argument for disclosure prior to patch is stronger in the TAG case (active exploitation) than in the normal PZ case, not weaker.
  - rs_rs_rs_rs_rs 4y ago
    Are you talking about that incident when Google folks decided to make information about a vulnerability public so people can protect themselves while Microsoft were dragging their feet working on a fix?
- illiarian 4y ago
  This reminds of a great thought experiment [1] If you discover an exploitable flaw in pacemakers, do you: - disclose it immediately? This may lead to an increased number of attacks on pacemakers - disclose it to manufacturers, and wait for them to patch things before dicslosing? - if manufacturers are too slow to fix this, or flat out refuse to do anything, do you still disclose? I'd hate to be on the team that needs to make the disclosure decisions and figuring out whether the fallout is worse than just keeping the knowledge hidden. Of course, it's not a pacemaker-level in this particular case, but every time I see exploits and their disclosure, I'm reminded of this. [1] Well, sadly it's not really a thought experiment: https://www.mnemonic.io/resources/blog/uncovering-vulnerabilities-in-pacemakers/ https://www.mnemonic.io/resources/blog/uncovering-vulnerabil...
  - bell-cot 4y ago
    IANAL...but for pacemakers, I'd be tempted to mail the details to the legal department(s) of the manufacturer(s). Registered mail. With a little note about how you received legal advice on your proper course of action in this situation...from a law firm notorious for suing medical device manufacturers.

sbuccini 4y ago

Can we change the link to the official blog post, which has more details? https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/ https://blog.google/threat-analysis-group/spyware-vendors-us...

sieabahlpark 4y ago
How will the poor authors of the bleepingcomputers website eat and feed their families if we rob them of their ad money for blogspam?
dang 4y ago
Yes. Changed from https://www.bleepingcomputer.com/news/security/google-finds-more-android-ios-zero-days-used-to-install-spyware/ https://www.bleepingcomputer.com/news/security/google-finds-... now. Thanks!

hospitalJail 4y ago

A hardware exploit on one browser and a web based exploit are not even on the same level. Instead of lumping all of Android, just name the brands with hardware issues. IMO its clickbait. I don't use both the phones listed and the web browser listed. But hey, they got me to click. I'm already getting desensitized.

illiarian 4y ago
> Instead of lumping all of Android, just name the brands with hardware issues "Pixel, Samsung, Xiaomi, Oppo and others". So, roughly 90-99% of the Android market
- brutusurp 4y ago
  Exactly this.
kramerger 4y ago
Am I correct that this does not apply to Qualcomm? That would mean it's limited to some Samsumg phones and random Chinese chipset, but Samsung is pretty good at swift security updates so I am confused why this one wasn't deployed on time.

nixcraft 4y ago

From the https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/ https://blog.google/threat-analysis-group/spyware-vendors-us... > In November 2022, TAG discovered exploit chains with 0-days affecting Android and iOS that were delivered via bit.ly links sent over SMS to users located in Italy, Malaysia and Kazakhstan. When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website. You can harden your iPhone/iOS from a cyberattack with Lockdown Mode[0]. It blocks those clickable links and removes many other attack vectors https://support.apple.com/en-gb/guide/iphone/iph049680987/ios https://support.apple.com/en-gb/guide/iphone/iph049680987/io... However, I'm unsure if an attacker could bypass Lockdown Mode with additional bugs on iOS. [0] https://support.apple.com/en-sg/HT212650 https://support.apple.com/en-sg/HT212650

ikekkdcjkfke 4y ago
Think i clicked a fake video on twitter going to a bit.ly domain not long ago

userbinator 4y ago

This is another one of those cases that seems to be completely nullified by keeping JS off by default and whitelisting it only on sites you really trust. But of course the biggest spyware company in the world relies on the same to track its users.

userbinator 4y ago
It's amusing to see the Google sympathisers attempt to deflect observations of the truth. You can't brainwash everyone, and the more you try, the more we'll resist.

Hizonner 4y ago

[flagged]

deleted 4y ago

[deleted]

agloe_dreams 4y ago

[flagged]

prdonahue 4y ago
Who cares if there’s a marketing component to it? P0’s efforts make the Internet more secure for everyone. ETA: They also need to draw attention sometimes to slow actors in addressing the fixes.
Arnt 4y ago
No, the official policy is that that team is to poke at anything that's used together with Google, which is ~everything. It started as a result of someone using a security bug in other software to gain privileged access to Google. You have a phone. People use the same phone together with a Google service and a security-related bug in the phone could be used to e.g. steal your Google password, therefore the phone's software is in-scope, no matter who made it or what it runs. I see the sense of it, but it's weird to me too. What's not used together with Google? That's such a wide scope. But it's not a matter of security or marketing, the weirdness is in the wide usage. Kudos to Google for working on it.
- agloe_dreams 4y ago
  Exactly. A few months (or was it a year?) ago they had a 0-day on iOS that was fixed and made a huge stink about it and it all just read like marketing for a Pixel. It's a wide net that I'm still glad they do...just weird. IT does make me wonder...what...don't..they report? Why wouldn't they hold a few smaller items back, focus a little more on iOS exploits? It's just a "Be aware of the source" thought. Still a net positive.
  - chatmasta 4y ago
    They find plenty of bugs in their own devices too. And it's not like they aren't responsibly disclosing to Apple. But I'd be curious how strictly their 90 day disclosure policy applies to Google products, and if they are more willing to grant some leeway when a fix isn't pushed in time...

flanbiscuit 4y ago

> When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website. So at least this is not a 0-click exploit I'm an Android Pixel (5a) user, how does this affect me... > The Android exploit chain targeted users on phones with an ARM GPU according to Wikipedia, my Pixel 5a has an Adreno 620 GPU made by Qualcomm so looks like I'm safe there. Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based. > running Chrome versions prior to 106. Current Chrome for Android version on my phone is 111.0.5563.116. The earliest version of Chrome for Android version 106 I can find is late Sept 2022[1], so not super long ago but it was at least fixed back in Sept. > Note, Pixel devices with the 2023-01-05 security update are protected against both exploit chains in this blog. My last security update was 2023-03-05 (and I mentioned my Chrome version above) so I'm protected > Chrome users updated to at least version 108.0.5359 are also protected. So which is it? affects users of Chrome prior to 106 yet you need to be on Chrome 108 to be protected? This is a bit confusing. Looks like Chrome for Android v108.0.5359.x was released late November 2022[2]. Just needed to do that for peace of mind. I understand that Google wouldn't be posting this if they hadn't at released a fix for this and handled their Pixel phones. I really wish there was some kind of database where I can look up a phone model and see a list of exploits and whether they have been patched or not, at least when they are hardware and/or OS related. 0. https://developer.arm.com/Tools%20and%20Software/Arm%20Mobile%20Studio#Supported-Devices https://developer.arm.com/Tools%20and%20Software/Arm%20Mobil... 1. https://chromereleases.googleblog.com/2022/09/chrome-for-android-update_01538182103.html https://chromereleases.googleblog.com/2022/09/chrome-for-and... 2. https://chromereleases.googleblog.com/2022/11/chrome-for-android-update_29.html https://chromereleases.googleblog.com/2022/11/chrome-for-and...

wccrawford 4y ago
It could be that Chrome 106 on OS 2023-01-05 are protected, or just Chrome 108 on any OS is protected. Or it could be sloppy reporting.

ar9av 4y ago

[flagged]

ocal5 4y ago

So, Safe in Chrome since November 2022 Safe in Ios since November 2021

dylan604 4y ago
My recollection of the Android universe is that not all updates are equally available/supported leaving devices out of date. Is this still the case, or has the provider/devices/OS ecosystem improved? Also, what is the install rate of these updates? Just because an update is available does not mean that it is deployed.
- lern_too_spel 4y ago
  On Android, Chrome updates without a device restart, unlike WebKit on iOS, and updates are faster to roll out.
  - kccqzy 4y ago
    Yes! As someone using both iOS and Android I cannot believe how Apple still requires a lengthy update process for those critical security updates. On my Pixel phone, installing the update is no slower than a regular restart. Users care about how long the downtime is for software updates. Make it faster, Apple.
  - initplus 4y ago
    Slower to update, but fixed 12 months earlier. Pick you poison...

neodypsis 4y ago

This is convincing me that iOS users should enable Lockdown Mode, irrespective of whom they may be.

Syonyk 4y ago
Yes. 100%. Do it, don't look back. Disable it on a per-website basis if needed, but... largely, I simply accept that I don't need to do those things I can't do with it on. I've been running Lockdown on my iOS devices since before iOS 16 came out (I installed the betas to play with it). The only actual annoyances I've found in practical, regular, daily use: - Lots of websites use webfonts for icons. Those don't render, and you get empty "No font glyph" boxes instead for various arrows and icons. It's not a big deal in regular use. - If someone sends you an animated gif as a MMS message (maybe iMessage too), it won't actually animate. Nothing of value is lost. - The latest from "that guy" won't work, because there's no WebGL support for Javascript animations of watches, bicycles, cameras, etc. Given that the JS is non-obfuscated, I don't mind disabling Lockdown for his site. - Some websites still use image formats that don't render, but this is far better than it was even six months ago when Lockdown was fresh and new. Otherwise... I've eliminated an awful lot of actively exploited interfaces for almost no loss in functionality.
- neodypsis 4y ago
  > Otherwise... I've eliminated an awful lot of actively exploited interfaces for almost no loss in functionality. Cool. That's good to hear, thanks for sharing your experience!
- guffins 4y ago
  This is my experience exactly. I’ll add to the list of inconveniences: - hyperlinks in iMessage/SMS aren’t clickable (but they can still be copied/pasted) - installed apps that use JavaScript in their interfaces can have the same issues as websites (but you can turn Lockdown off for apps as well, if needed) Overall worthwhile. Something about these “inconveniences” also gives me a sort of psychological disconnection from my phone that I personally find to be very healthy. Similar to how I felt limiting myself to F-Droid in my Android days.

eunos 4y ago

> location and install .IPA files ??? Did they mean APK file?

mig39 4y ago
IPA files are the iOS version of APK, I think.
a_worried_user 4y ago
[dead]

kvetching 4y ago

This is the real threat of these large AI models. They will revolutionize the ability to find vulnerabilities. Especially if we achieve AGI.

kibwen 4y ago
If we have AGI capable of finding vulnerabilities, then we can just ask the AGI to design a system so secure that even the AGI cannot find any vulnerabilities.
- walterbell 4y ago
  Some vulnerabilities have their own supply chain and incentives.
- varunjain99 4y ago
  It will be an interesting race... I do think that it'll be easier to find vulnerabilities than to design systems that are provably secure. It's like evaluating a function f(x) vs finding the values of x for which f(x) = 0.
lima 4y ago
They will revolutionize the ability to find and fix vulnerabilities. Threat actors can already afford expensive security researchers today. It removes some of the asymmetry.
KeplerBoy 4y ago
i worry more about GPT-assisted social engineering.
tptacek 4y ago
Writing programs to automatically find bugs is a pursuit almost as old as compilers, and the models used to do that in modern static/symbolic analysis tools are much more sophisticated than an LLM's next-token generator.

a_worried_user 4y ago

[dead]

bobse 4y ago

[flagged]

hrrtyyuuhggg 4y ago

n-days. you mean "known and disclosed issues which we choose not to make fixes available to 80% of our clients so we can sell more disposable pocket computers."

hrrtyyuuhggg 4y ago
damn some of these are bugs fixed in 2021. there's easy money to be made just exploiting published mobile phone vulnerabilities! they won't be abandoned and won't be patched! ... who thought splitting ownership and consequences of not updating software was a good idea? being a black hat is almost too tempting today.
- Zuiii 4y ago
  > who thought splitting ownership and consequences of not updating software was a good idea? You can't because companies refuse to let customers own and control their devices. Because we can't control them, we can't patch them up. I have a 15 year-old PC that's still running today. It's fully patched up because its vendor gives me enough control to do so. There should be laws that ban device manufacturers from building or bundling software. Something like Bell Laboratories' breakup, but applied industry-wide.

IG_Semmelweiss 4y ago

what about firefox ?

hulitu 4y ago

Captain obvious strikes again.

psychphysic 4y ago

> These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house. I wonder what this means? Why does it matter if the nation couldn't make the tool themselves? I might be reading into it. But is there an idea that technological sophistication itself imbues morals? And these unsophisticated nations are amoral? Or maybe even a might is right mindset? I'm surely reading too much into this but for whatever reason it stood out to me.

mhoad 4y ago
This might not be clear if you don’t normally have any interaction with this kind of “policy” friendly language but it’s making a point that it’s falling into the hands of particularly authoritarian governments who use it to target political enemies, journalists and human rights types and that they certainly didn’t have that capability domestically until someone packaged it up and sold it to them. They seem to be acknowledging some parallels to this kind of scenario as to the nuclear proliferation problem and that many governments aren’t ok with irresponsible sellers who will put these things in the hands of anyone with money.