6 ms·

Interesting that they’re mentioned as only being exploited on Intel. Has anyone seen whether that’s because the attacker only targeted that platform or is it ac

by acdha 2y ago

Interesting that they’re mentioned as only being exploited on Intel. Has anyone seen whether that’s because the attacker only targeted that platform or is it actually stopped by something like pointer protection?

dataflow 2y ago
It might just be that the only machines they have information about are Intel? It doesn't say how many data points they have, but if it's only a handful then it's not at all surprising.
- acdha 2y ago
  That’s what I was wondering: if this is like some of those Citizen Lab reports it might simply be that they have a small number of targeted individuals who noticed something and reported it.
justinclift 2y ago
Doesn't seem to completely line up that they're rushing out iOS updates (ie for phones, etc) for something they're saying they've only confirmed on Intel cpus. Unless they're assuming it's exploitable on Apple Silicon as well, or are being extra careful just in case.
- 2muchcoffeeman 2y ago
  There must be millions of Intel Macs still around. Why wouldn’t they update it?
  - shepherdjerred 2y ago
    The parent comment said that Apple is rushing iOS updates. iOS is the operating system for iPhones which use Apple Silicon rather than Intel processors.
  - wannacboatmovie 2y ago
    Well for starters, they stopped providing any updates for many perfectly functional Intel Macs years ago for no other reason than planned obsolescence. A side effect of the "they make both the hardware and software that's why it's better" paradigm. Things like OpenCore Legacy Patcher prove it's possible; they just don't want to. I don't think anyone feels entitled to new features in perpetuity. Security updates only would be fine thank you. Don't tell me the richest company in the world can't pay for a couple of developers who just want to rest and vest to take care of and test the legacy platforms. A cushy job and you keep the customers happy. Ironically the best way to stay safe on these computers is to install Windows or Linux.
    - StressedDev 2y ago
      Software needs longer support life cycles in general. I find it frustrating that organizations do not support operating systems, hardware, and applications for at least 10 years. Note Apple is one of the better organizations on this. Consumer router companies are notorious for shipping unpatched software. Here is what I would like to see: 1. All hardware and software should come with a highly visible end of support date. 2. All hardware and software should notify people when it is no longer receiving security patches. It should also explain to users why running unpatched software or hardware is dangerous.
      - wannacboatmovie 2y ago
        To my knowledge Apple has never published EOL or support dates in the future. Someone correct me if something has changed in the last few years.
        wtallis 2y ago
        https://support.apple.com/en-us/102772 https://support.apple.com/en-us/102772 outlines "vintage" and "obsolete" status for hardware products, with a few exceptions. I'm not aware of a similarly straightforward criteria or comprehensive list for software support periods.
- oddevan 2y ago
  > Unless they're... being extra careful just in case. That's where my money is.
  - ajross 2y ago
    Or they just don't know. Full analysis of an exploit usually takes days to weeks. It's possible it's only exploitable on x86, but equally possible that only the x86 version of the payload was discovered in the wild.
    - 486sx33 2y ago
      Rosetta2 runs an x86 exploit? Doesn’t explain iOS but still sounds interesting!
      - deleted 2y ago
        [deleted]
  - ruthmarx 2y ago
    Why? Putting a lot of stock in Apple's various protections?
- tedunangst 2y ago
  It's not unheard of for exploits to target two or more bugs.
- bigiain 2y ago
  > Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Is kinda weasel-wordy, if you read it with sufficient cynicism. Its doesn't rule out them also being aware of reports (or actual instances) of it being exploited on iOS or Apple silicon Macs. It _might_ actually mean "Apple could not deny in a lawsuit that it's been sent a report of this being exploited on Intel Macs."
  - duxup 2y ago
    Or they’re just not able to confirm it everywhere but feel the code change is necessary regardless? I’ve certainly addressed a potential issue with code that I thought might have occurred even when I couldn’t confirm it with 100% certainty. A detailed analysis / testing and confirmation that provides certainty may take longer than addressing code.
  - brookst 2y ago
    If you read it with enough cynicism, it doesn’t rule out Apple having actual knowledge that it was exploited to steal every last bit of information from every Mac, iPhone, iPad, iPod, Apple TV, and Apple II ever produced.
  - kafrofrite 2y ago
    Most probably what Apple means is that since their codebase is shared, the vulnerability exists across devices. This does not mean that the vulnerability is actively exploited in iOS nor that it will not be actively exploited as part of some other campaign.
- saagarjha 2y ago
  This just means the bug is in WebKit and they shipped the fix to every platform.
- initplus 2y ago
  Will be an underlying safety issue in some system library, but they have only seen "in the wild" exploits targeting Intel. "Defence in depth" - better to push the bugfix to all than to scrutinize ARM security features to understand if an exploit is possible there as well.
- SoftTalker 2y ago
  Sometimes problems manifest differently on different architectures. It's one of the advantages of building for more than just one: it shakes out bugs. Doesn't mean you don't fix the root issue in all builds. Apple for the most part has one codebase that they build for their different architectures. They've been doing this since the NeXT days when they supported Motorola, Intel, Sparc, and maybe a couple of other architectures.
ngneer 2y ago
I came to ask this very question. Could be an Intel hardware bug, but then we would see an advisory from Intel. So, it must be a different issue. Apple probably did not realize that their advisory implicates Intel components rather than Apple components.

by acdha 2y ago

dataflow 2y ago

It might just be that the only machines they have information about are Intel? It doesn't say how many data points they have, but if it's only a handful then it's not at all surprising.

acdha 2y ago
That’s what I was wondering: if this is like some of those Citizen Lab reports it might simply be that they have a small number of targeted individuals who noticed something and reported it.

justinclift 2y ago

Doesn't seem to completely line up that they're rushing out iOS updates (ie for phones, etc) for something they're saying they've only confirmed on Intel cpus. Unless they're assuming it's exploitable on Apple Silicon as well, or are being extra careful just in case.

2muchcoffeeman 2y ago
There must be millions of Intel Macs still around. Why wouldn’t they update it?
- shepherdjerred 2y ago
  The parent comment said that Apple is rushing iOS updates. iOS is the operating system for iPhones which use Apple Silicon rather than Intel processors.
- wannacboatmovie 2y ago
  Well for starters, they stopped providing any updates for many perfectly functional Intel Macs years ago for no other reason than planned obsolescence. A side effect of the "they make both the hardware and software that's why it's better" paradigm. Things like OpenCore Legacy Patcher prove it's possible; they just don't want to. I don't think anyone feels entitled to new features in perpetuity. Security updates only would be fine thank you. Don't tell me the richest company in the world can't pay for a couple of developers who just want to rest and vest to take care of and test the legacy platforms. A cushy job and you keep the customers happy. Ironically the best way to stay safe on these computers is to install Windows or Linux.
  - StressedDev 2y ago
    Software needs longer support life cycles in general. I find it frustrating that organizations do not support operating systems, hardware, and applications for at least 10 years. Note Apple is one of the better organizations on this. Consumer router companies are notorious for shipping unpatched software. Here is what I would like to see: 1. All hardware and software should come with a highly visible end of support date. 2. All hardware and software should notify people when it is no longer receiving security patches. It should also explain to users why running unpatched software or hardware is dangerous.
    - wannacboatmovie 2y ago
      To my knowledge Apple has never published EOL or support dates in the future. Someone correct me if something has changed in the last few years.
      - wtallis 2y ago
        https://support.apple.com/en-us/102772 https://support.apple.com/en-us/102772 outlines "vintage" and "obsolete" status for hardware products, with a few exceptions. I'm not aware of a similarly straightforward criteria or comprehensive list for software support periods.
oddevan 2y ago
> Unless they're... being extra careful just in case. That's where my money is.
- ajross 2y ago
  Or they just don't know. Full analysis of an exploit usually takes days to weeks. It's possible it's only exploitable on x86, but equally possible that only the x86 version of the payload was discovered in the wild.
  - 486sx33 2y ago
    Rosetta2 runs an x86 exploit? Doesn’t explain iOS but still sounds interesting!
    - deleted 2y ago
      [deleted]
- ruthmarx 2y ago
  Why? Putting a lot of stock in Apple's various protections?
tedunangst 2y ago
It's not unheard of for exploits to target two or more bugs.
bigiain 2y ago
> Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Is kinda weasel-wordy, if you read it with sufficient cynicism. Its doesn't rule out them also being aware of reports (or actual instances) of it being exploited on iOS or Apple silicon Macs. It _might_ actually mean "Apple could not deny in a lawsuit that it's been sent a report of this being exploited on Intel Macs."
- duxup 2y ago
  Or they’re just not able to confirm it everywhere but feel the code change is necessary regardless? I’ve certainly addressed a potential issue with code that I thought might have occurred even when I couldn’t confirm it with 100% certainty. A detailed analysis / testing and confirmation that provides certainty may take longer than addressing code.
- brookst 2y ago
  If you read it with enough cynicism, it doesn’t rule out Apple having actual knowledge that it was exploited to steal every last bit of information from every Mac, iPhone, iPad, iPod, Apple TV, and Apple II ever produced.
- kafrofrite 2y ago
  Most probably what Apple means is that since their codebase is shared, the vulnerability exists across devices. This does not mean that the vulnerability is actively exploited in iOS nor that it will not be actively exploited as part of some other campaign.
saagarjha 2y ago
This just means the bug is in WebKit and they shipped the fix to every platform.
initplus 2y ago
Will be an underlying safety issue in some system library, but they have only seen "in the wild" exploits targeting Intel. "Defence in depth" - better to push the bugfix to all than to scrutinize ARM security features to understand if an exploit is possible there as well.
SoftTalker 2y ago
Sometimes problems manifest differently on different architectures. It's one of the advantages of building for more than just one: it shakes out bugs. Doesn't mean you don't fix the root issue in all builds. Apple for the most part has one codebase that they build for their different architectures. They've been doing this since the NeXT days when they supported Motorola, Intel, Sparc, and maybe a couple of other architectures.

ngneer 2y ago

I came to ask this very question. Could be an Intel hardware bug, but then we would see an advisory from Intel. So, it must be a different issue. Apple probably did not realize that their advisory implicates Intel components rather than Apple components.