6 ms·
Apple Confirms Zero-Day Attacks Hitting macOS Systems
- rswail 2y agoInteresting that I had a security update for iOS (18.1.1) and a Safari update for MacOS (still running Sonoma)
- hrvstr 2y agoHmm, may I ask what version you are running now? I am on Sonoma too and don't see any updates. The apple support page lists macOS Sonoma 14.7.1 as the most recent version released on 28 Oct 2024. https://support.apple.com/en-us/100100 https://support.apple.com/en-us/100100
- rswail 2y agoI had an update for Safari, not Sonoma. The update to Safari was 18.1.1 according to softwareupdate --history
- acdha 2y agoInteresting that they’re mentioned as only being exploited on Intel. Has anyone seen whether that’s because the attacker only targeted that platform or is it actually stopped by something like pointer protection?
- dataflow 2y agoIt might just be that the only machines they have information about are Intel? It doesn't say how many data points they have, but if it's only a handful then it's not at all surprising.
- acdha 2y agoThat’s what I was wondering: if this is like some of those Citizen Lab reports it might simply be that they have a small number of targeted individuals who noticed something and reported it.
- justinclift 2y agoDoesn't seem to completely line up that they're rushing out iOS updates (ie for phones, etc) for something they're saying they've only confirmed on Intel cpus. Unless they're assuming it's exploitable on Apple Silicon as well, or are being extra careful just in case.
- 2muchcoffeeman 2y agoThere must be millions of Intel Macs still around. Why wouldn’t they update it?
- shepherdjerred 2y agoThe parent comment said that Apple is rushing iOS updates. iOS is the operating system for iPhones which use Apple Silicon rather than Intel processors.
- wannacboatmovie 2y agoWell for starters, they stopped providing any updates for many perfectly functional Intel Macs years ago for no other reason than planned obsolescence. A side effect of the "they make both the hardware and software that's why it's better" paradigm. Things like OpenCore Legacy Patcher prove it's possible; they just don't want to. I don't think anyone feels entitled to new features in perpetuity. Security updates only would be fine thank you. Don't tell me the richest company in the world can't pay for a couple of developers who just want to rest and vest to take care of and test the legacy platforms. A cushy job and you keep the customers happy. Ironically the best way to stay safe on these computers is to install Windows or Linux.
- StressedDev 2y agoSoftware needs longer support life cycles in general. I find it frustrating that organizations do not support operating systems, hardware, and applications for at least 10 years. Note Apple is one of the better organizations on this. Consumer router companies are notorious for shipping unpatched software. Here is what I would like to see: 1. All hardware and software should come with a highly visible end of support date. 2. All hardware and software should notify people when it is no longer receiving security patches. It should also explain to users why running unpatched software or hardware is dangerous.
- ngneer 2y agoI came to ask this very question. Could be an Intel hardware bug, but then we would see an advisory from Intel. So, it must be a different issue. Apple probably did not realize that their advisory implicates Intel components rather than Apple components.
- timeon 2y agoDoes this affect Firefox/Chrome on macOS?
- deleted 2y ago[deleted]
- bigiain 2y agoI'd guess yes, since they're both (due to Apple rules) basically wrappers around webkit and JavaScriptCore. (Modulo the possible hint that this is just an Intel-based Mac systems problem)
- Jtsummers 2y ago> I'd guess yes, since they're both (due to Apple rules) basically wrappers around webkit and JavaScriptCore. That is not true for macOS which is what GP asked about.
- mdavidn 2y agoWhile that is true on iOS, macOS has no such restriction on Firefox or Chrome.
- pram 2y agomacOS != iOS, Firefox uses Gecko.
- alphabetting 2y ago>The vulnerabilities, credited to Google’s TAG (Threat Analysis Group) Do they find these by monitoring the brokers of zero days or analyzing devices of people who are being targeted?
- wutwutwat 2y agolittle of column a, little of column b they also have insane peering and backbone network infra, run one of the largest cloud providers, host basically everyone's email, documents, and file storage, chat, app store, and have a native browser installed I'm sure they have many different signals they can look at to see compromised type behavior differing from the profile they have on you
- ledoge 2y agoThere's actually a very recent talk about this! https://www.youtube.com/watch?v=2zrcemxCg4Y https://www.youtube.com/watch?v=2zrcemxCg4Y
- tonfa 2y agoI also found a recent article: https://www.nzz.ch/english/googles-spyware-hunters-track-state-sponsored-malware-ld.1845068 https://www.nzz.ch/english/googles-spyware-hunters-track-sta...
- myHNAccount123 2y agoI suspect firebase crashlytics is the source of many
- xorcist 2y agoBoth, but also a lot of original research. They are public about this.
- grupthink 2y agoI have a perfectly functional iPad 5 that no longer receives software updates. It'd be cool if Apple would at least give it security updates, or allow alternative browser engines that don't have this vulnerability. If my iPad gets pwned, my day is going to suck.
- wannacboatmovie 2y ago[flagged]
- deleted 2y ago[deleted]
- stephen_g 2y agoIt's probably because the first bit isn't really true (iPads have a longer supported life than many Android tablets, for example I updated my 2018 iPad Pro with the most recent iPadOS 18.1.1 including this security fix earlier today). And given that the silly joke falls flat. The iPad 5 in question from the OP supports iPadOS 16 and that last got a security update in August of this year. So if it hasn't got an update today then possibly the vulnerability was only introduced in iOS / iPadOS 17.
- saagarjha 2y agoI can assure you that the toilet paper is much more comfortable than dollar bills.
- brookst 2y agoMeta meta: comments making vague complaints about other comments being downvoted, typically get downvoted.
- Jtsummers 2y agoiPadOS 16 was at least updated 3 months ago (August) so there's a chance you could still get a security update if it's applicable to that version. iPadOS 15 was updated in July. https://en.wikipedia.org/wiki/IPadOS_version_history https://en.wikipedia.org/wiki/IPadOS_version_history
- consumerx 2y agothat's why you turn on Lockdown Mode or swap to Linux completely :)
- leoh 2y agoI have got to believe that there are some nasty zero days for linux
- proxynoproxy 2y agoThe advantage of everyone running the same software and hardware platform is that you can concentrate on hardening that one system. The disadvantage is that vulnerability is universal. The advantage of everyone running a disparate environment of many of different libraries and binaries is that vulnerability is likely unique. The disadvantage is there are many more opportunities for the researcher to find vulnerability in the mess. Choose your poison, the only secure system is powered down.
- notactuallyben 2y agoVulnerabilities in the Linux kernel would have a similar impact to a macOS kernel bug. It’s a myth that “more eyes means more secure” for OSS ;-) - it can be true, but often that’s not the reason
- microtonal 2y agoI love Linux, but this is really a cheap shot. Out of the box, desktop security is much better on the Mac. Slim boot ROM in place of UEFI (which can be backdoored), no always-running Intel ME/AMD PSP, fully verified boot chain, sealed system volumes, heavy use of a secure enclave to protect secrets, mandatory sandboxing for App Store apps, malware checks through XProtect, limited access of apps to key folders (Desktop, Documents, iCloud Drive), limited access to privacy-sensitive devices (camera, mic), etc. Linux will get there, but currently macOS is much more secure as a desktop.
- vetinari 2y ago
- consumerx 2y ago[flagged]
- tgv 2y agoAnd what's your advice when there's a threat for Linux?
- TheRealNGenius 2y ago[dead]
- deleted 2y ago[deleted]
- pjmlp 2y ago[flagged]
- Cumpiler69 2y ago[flagged]
- tim333 2y agogosh, 18 years ago https://youtu.be/sdF5IsyOxU4 https://youtu.be/sdF5IsyOxU4
- TekMol 2y agoThe article sounds like it also applies to iOS The company urged users across the Apple ecosystem to apply the urgent iOS 18.1.1, macOS Sequoia 15.1.1 and the older iOS 17.7.2. And that it is web based maliciously crafted web content may lead to arbitrary code execution Has this happened before? That iPhones had a security hole that could be exploited over the web?
- e28eta 2y agoAbsolutely. I don’t follow the scene, but early in the iphone’s product life I distinctly remember a web-based jailbreak, where you loaded a page and then you could ‘slide to jailbreak’. I don’t know if user action was strictly required, or if it was a UX thing.
- TekMol 2y agoShouldn't that lead to a massive amount of iPhones being broken into? If not, why? If so, what happened to all those phones? I never hear stories like "My iPhone was broken into and this happened: ..."
- TheDong 2y agoWhy would it? Do you regularly visit "hot-iphone-porn-apps.info" and other untrusted sites? Do you expect sites you do visit, like "google.com" or such, are going to serve up malware? Do you expect hackers who build these very labor-intensive exploit chains will want to try and hit as many low-value targets as possible, leading to apple patching the exploit quickly, or to try and hit high-value targets only so it's not noticed by apple as quickly and can be used against more high-value targets to make more money in total than doing a "spray and pray" with it? What thought process do you think would lead to using the exploit against as many people as possible vs selling it to zerodium.com or a similar company for more money than you can get from spraying, and then zerodium reselling it to israel to hack into the iphones of a few key palestinians?
- TekMol 2y ago
- deleted 2y ago[deleted]