20 ms·

Am I right in that these were fixed (at least in iOS), some time ago? https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2022

Am I right in that these were fixed (at least in iOS), some time ago? https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2022-42856 https://nvd.nist.gov/vuln/detail/CVE-2021-30900 https://nvd.nist.gov/vuln/detail/CVE-2021-30900

dmix 4y ago
Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions.
- kramerger 4y ago
  > Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions Well, there was that incident with project zero vs Microsoft a while back... Lets hope TAG is better than PZ
  - tptacek 4y ago
    The argument for disclosure prior to patch is stronger in the TAG case (active exploitation) than in the normal PZ case, not weaker.
  - rs_rs_rs_rs_rs 4y ago
    Are you talking about that incident when Google folks decided to make information about a vulnerability public so people can protect themselves while Microsoft were dragging their feet working on a fix?
- illiarian 4y ago
  This reminds of a great thought experiment [1] If you discover an exploitable flaw in pacemakers, do you: - disclose it immediately? This may lead to an increased number of attacks on pacemakers - disclose it to manufacturers, and wait for them to patch things before dicslosing? - if manufacturers are too slow to fix this, or flat out refuse to do anything, do you still disclose? I'd hate to be on the team that needs to make the disclosure decisions and figuring out whether the fallout is worse than just keeping the knowledge hidden. Of course, it's not a pacemaker-level in this particular case, but every time I see exploits and their disclosure, I'm reminded of this. [1] Well, sadly it's not really a thought experiment: https://www.mnemonic.io/resources/blog/uncovering-vulnerabilities-in-pacemakers/ https://www.mnemonic.io/resources/blog/uncovering-vulnerabil...
  - bell-cot 4y ago
    IANAL...but for pacemakers, I'd be tempted to mail the details to the legal department(s) of the manufacturer(s). Registered mail. With a little note about how you received legal advice on your proper course of action in this situation...from a law firm notorious for suing medical device manufacturers.
  - dmix 4y ago
    Not to downplay your thought experiment but Vulnerability disclosure has been debated to death in the infosec community, ad nasuem. Seems like someone always challenges it when it comes up in the press on Twitter where it seems there will never be a hard answer here that will satisfy everyone. The consensus and IMO best solution is follow the standard of disclosing and then waiting a reasonable amount of time before telling the world. But there will always be exceptions to the rule where threat models are different or the tech/business environment is different than fast moving software… like old school medical companies with slow moving fixes for medical devices. The latter seems like it has more responsibility to wait but public pressure on them to move but they also typically have teams of lawyers who are disconnected from infosec/tech reality.
    - bluGill 4y ago
      I'm fine with waiting if the org in question is making progress toward fixing things. It probably takes more than 90 days to do a proper FDA review for a pacemaker fix, and if the update requires surgery after that it could be years. But they need to show reasonable effort to fix all the issues.
  - andrewaylett 4y ago
    Project Zero has a fairly strict 90 day disclosure timeline, in part to avoid having this discussion for the majority of issues. 90 days passes, issue disclosed. But they did recently withhold four disclosures due to the seriousness of the issues: https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html?m=1 https://googleprojectzero.blogspot.com/2023/03/multiple-inte... and not for anything as life-threatening as a pacemaker. It seems that brings the total number of policy exceptions to six. I think one of the keys here is working out your policy in advance, so you've got a robust set of criteria to work from when you need to evaluate a specific case.

dmix 4y ago

Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions.

kramerger 4y ago
> Google’s threat group wouldn’t be blogging about it if it wasn’t fixed, with rare exceptions Well, there was that incident with project zero vs Microsoft a while back... Lets hope TAG is better than PZ
- tptacek 4y ago
  The argument for disclosure prior to patch is stronger in the TAG case (active exploitation) than in the normal PZ case, not weaker.
- rs_rs_rs_rs_rs 4y ago
  Are you talking about that incident when Google folks decided to make information about a vulnerability public so people can protect themselves while Microsoft were dragging their feet working on a fix?
illiarian 4y ago
This reminds of a great thought experiment [1] If you discover an exploitable flaw in pacemakers, do you: - disclose it immediately? This may lead to an increased number of attacks on pacemakers - disclose it to manufacturers, and wait for them to patch things before dicslosing? - if manufacturers are too slow to fix this, or flat out refuse to do anything, do you still disclose? I'd hate to be on the team that needs to make the disclosure decisions and figuring out whether the fallout is worse than just keeping the knowledge hidden. Of course, it's not a pacemaker-level in this particular case, but every time I see exploits and their disclosure, I'm reminded of this. [1] Well, sadly it's not really a thought experiment: https://www.mnemonic.io/resources/blog/uncovering-vulnerabilities-in-pacemakers/ https://www.mnemonic.io/resources/blog/uncovering-vulnerabil...
- bell-cot 4y ago
  IANAL...but for pacemakers, I'd be tempted to mail the details to the legal department(s) of the manufacturer(s). Registered mail. With a little note about how you received legal advice on your proper course of action in this situation...from a law firm notorious for suing medical device manufacturers.
- dmix 4y ago
  Not to downplay your thought experiment but Vulnerability disclosure has been debated to death in the infosec community, ad nasuem. Seems like someone always challenges it when it comes up in the press on Twitter where it seems there will never be a hard answer here that will satisfy everyone. The consensus and IMO best solution is follow the standard of disclosing and then waiting a reasonable amount of time before telling the world. But there will always be exceptions to the rule where threat models are different or the tech/business environment is different than fast moving software… like old school medical companies with slow moving fixes for medical devices. The latter seems like it has more responsibility to wait but public pressure on them to move but they also typically have teams of lawyers who are disconnected from infosec/tech reality.
  - bluGill 4y ago
    I'm fine with waiting if the org in question is making progress toward fixing things. It probably takes more than 90 days to do a proper FDA review for a pacemaker fix, and if the update requires surgery after that it could be years. But they need to show reasonable effort to fix all the issues.
- andrewaylett 4y ago
  Project Zero has a fairly strict 90 day disclosure timeline, in part to avoid having this discussion for the majority of issues. 90 days passes, issue disclosed. But they did recently withhold four disclosures due to the seriousness of the issues: https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html?m=1 https://googleprojectzero.blogspot.com/2023/03/multiple-inte... and not for anything as life-threatening as a pacemaker. It seems that brings the total number of policy exceptions to six. I think one of the keys here is working out your policy in advance, so you've got a robust set of criteria to work from when you need to evaluate a specific case.