4 ms·
> Heck -- unlike Apple, Google distributes nearly all of their apps and even system components through the App Store and still relies on standard user permissio
by realusername 3y ago
> Heck -- unlike Apple, Google distributes nearly all of their apps and even system components through the App Store and still relies on standard user permissioning! You still have to grant Google the same permissions you grant any other app, even though it's "OS level". Imagine Apple authentically asking you for permission when you open a first party app and respecting it!
That's clearly the big difference between both. Who knows what the internal apps are using on iOS, certainly not anything standard. That's also why it's usually the first attack vector on zero days.
- photonerd 3y agoThe reason they’re the first attack vector is that they’re installed by every user. Targeting NicheApp275 is not going to target as many ppl
- realusername 3y agoYeah but that also help that they don't have the same access as any random app. When you manage to get access to iMessage, that's not exactly the same thing as getting access to the sms app on Android.
- saagarjha 3y agoHow so?
- realusername 3y agoOne of them is a core component of the system with access to internal apis and the other one is an sms app.
- saagarjha 3y agoWhich internal APIs does it have access to?
- realusername 3y agoNobody really knows except from a few security researchers? I'm not working at Apple and I can't access the device internals. You can't build a third-party iMessage yourself unlike on Android anyways so there's some system apis somewhere enabling that for sure. There's at least some special security keys, a custom notification system, extended access to device storage and custom wakeup exceptions from what I could deduce myself looking at it. Of course there's for sure more than that but that's at least what's visible.
- saagarjha 3y agoSecurity researcher here. There's not much special here; it's just that nobody has publicly reversed the iMessage protocol.
- photonerd 3y ago> Nobody really knows So that was completely unfounded conjecture on your part then?
- realusername 3y agoGo ahead and prove me wrong then, link me an alternative iMessage client built with the normal apis or even explain how you could even do it. Good luck. I can do that on Android, that's impossible on iOS because it's a custom system app with custom apis.
- scarface_74 3y agoYou mean like the Chrome browser? https://www.securityweek.com/android-security-updates-patches-3-exploited-vulnerabilities/ https://www.securityweek.com/android-security-updates-patche...