4 ms·

Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conver

by mmsc 3y ago

Always a smile when I see my blog posted on hn:) To answer three questions: 1) this was not reported in the context of any bug bounty[0], and the total conversation between me and Apple is 4 emails (1: hello do you plan to fix this? 2: can you reproduce this on the newest ios17? 3: no. 4: if you are able to reproduce it on ios17 let us know) 2) exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript 3) the iPhone 6s and 15.8 are still seemingly supported by Apple. [0] and you won’t find me on any bug bounty websites except for where I try to get contact with humans, see https://joshua.hu/slack-is-broken-with-noscript https://joshua.hu/slack-is-broken-with-noscript

denysvitali 3y ago
Getting in touch with an human is generally "easy": getting in touch with an engineer isn't. It's sad that one has to open a bug bounty request to get an engineer to look into an issue like the one you described in your linked blog post.
asabla 3y ago
It,'s always a fun and interesting read when your posts hit HN. How much time would you estimate goes into researching? And do you have any pointers for someone which want to dip their toes into this vast sea of exploration?
- mmsc 3y ago
  This wasn't really my "finding" per-se (the original vulnerability was from June, after all), it was just something that came into my eyes and I thought it would be interesting to discuss the implications and some perceptions I have based on it. >And do you have any pointers for someone which want to dip their toes into this vast sea of exploration? Can you expand on what you mean by this exactly? I got into security by accident when I was a child and have never followed any type of routine when it comes to learning. Probably the only pointer that may help is: take something that you know and use often (some piece of software) and ask "what if?" or "why can't I or someone do X?" ¯\_(ツ)_/¯
y7 3y ago
> exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript Things that are obvious to you may be non-obvious to other people, including the readers of your blog.
- br0wnr1c3 3y ago
  In the context of their blog post, it's assumed that the reader has some knowledge of web technologies — if you can print data to your own webpage, you can also exfiltrate it. It's not reasonable to expect the author to explain _every_ underlying technology involved since that was likely not the scope of the post.
oefrha 3y ago
You didn’t answer the biggest question: being able to read /etc/passwd does not imply being able to read any of the sensitive files listed under “What files could somebody steal? Well, there’s always:”. Did you actually test any of those?
- mmsc 3y ago
  I only tested passwd at the time and I don’t currently have access to the 6s to test the other files. I can report back whenever I get access to that phone again.
CodeWriter23 3y ago
Welcome to HN, in as gentle a way possible I refute this statement > Apple continues to support nearly-decade-old devices like the iPhone 6S, which and iOS 15.8 is still powering those devices, seemingly with official Apple support, with the latest update from October the 25th, which addressed some security vulnerabilities. With: try to update your Apple Watch with a device running the latest iOS 16
- mmsc 3y ago
  https://ibb.co/fn84p09 https://ibb.co/fn84p09 This photo was taken the day the blog post was published.
  - CodeWriter23 3y ago
    And yet, I am still unable to update my Apple Watch with the latest iOS 16. iOS 17 is now required. iOS 17 is also required to rent a movie on my Apple TV. So, to the author's assertion that "Apple does a good job supporting old hardware", they may give some security patches but interoperability between current and previous versions is seemingly deliberately broken.

by mmsc 3y ago

denysvitali 3y ago

Getting in touch with an human is generally "easy": getting in touch with an engineer isn't. It's sad that one has to open a bug bounty request to get an engineer to look into an issue like the one you described in your linked blog post.

asabla 3y ago

It,'s always a fun and interesting read when your posts hit HN. How much time would you estimate goes into researching? And do you have any pointers for someone which want to dip their toes into this vast sea of exploration?

mmsc 3y ago
This wasn't really my "finding" per-se (the original vulnerability was from June, after all), it was just something that came into my eyes and I thought it would be interesting to discuss the implications and some perceptions I have based on it. >And do you have any pointers for someone which want to dip their toes into this vast sea of exploration? Can you expand on what you mean by this exactly? I got into security by accident when I was a child and have never followed any type of routine when it comes to learning. Probably the only pointer that may help is: take something that you know and use often (some piece of software) and ask "what if?" or "why can't I or someone do X?" ¯\_(ツ)_/¯

y7 3y ago

> exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript Things that are obvious to you may be non-obvious to other people, including the readers of your blog.

br0wnr1c3 3y ago
In the context of their blog post, it's assumed that the reader has some knowledge of web technologies — if you can print data to your own webpage, you can also exfiltrate it. It's not reasonable to expect the author to explain _every_ underlying technology involved since that was likely not the scope of the post.

oefrha 3y ago

You didn’t answer the biggest question: being able to read /etc/passwd does not imply being able to read any of the sensitive files listed under “What files could somebody steal? Well, there’s always:”. Did you actually test any of those?

mmsc 3y ago
I only tested passwd at the time and I don’t currently have access to the 6s to test the other files. I can report back whenever I get access to that phone again.

CodeWriter23 3y ago

Welcome to HN, in as gentle a way possible I refute this statement > Apple continues to support nearly-decade-old devices like the iPhone 6S, which and iOS 15.8 is still powering those devices, seemingly with official Apple support, with the latest update from October the 25th, which addressed some security vulnerabilities. With: try to update your Apple Watch with a device running the latest iOS 16

mmsc 3y ago
https://ibb.co/fn84p09 https://ibb.co/fn84p09 This photo was taken the day the blog post was published.
- CodeWriter23 3y ago
  And yet, I am still unable to update my Apple Watch with the latest iOS 16. iOS 17 is now required. iOS 17 is also required to rent a movie on my Apple TV. So, to the author's assertion that "Apple does a good job supporting old hardware", they may give some security patches but interoperability between current and previous versions is seemingly deliberately broken.