Siguza

4 ms·

1.
by Siguza 8y ago
I highly doubt this is for IoT advances, nor for internal debugging - because they have both already. The watch, AirPods, all the 40+ processors in an iPhone, the chips in each and every dongle, Apple is way past starting in IoT. AFAIK the
2.
by Siguza 9y ago
Nah, it doesn't fix the actual vuln - it's just that my exploit doesn't work out of the box because the "hid" binary uses a hardware info leak which doesn't work anymore the way I was doing it. If you patched t
3.
by Siguza 9y ago
It's actually neither TOCTOU nor double fetch, it's not checking anything at all, it's just write-then-fetch using shared (untrusted) memory to store trusted information. Sure similar in nature, but not really fitting any com
4.
by Siguza 9y ago
I found it by looking through IOHIDFamily's source, hoping to find a low-hanging fruit affecting iOS. In total? A lot, probably way too much... I had found it in February and started to write an exploit in April. Next to my studies, ex
5.
by Siguza 9y ago
Well, that I don't know...
6.
by Siguza 9y ago
Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it
7.
by Siguza 9y ago
No, their bug bounty only extends to iOS.
8.
by Siguza 9y ago
I had actually submitted to the ZDI, but had written the exploit & write-up in the first place mainly because I like hacking rather than for money. I figured I'd see what offers I'd get anyway, but once I had spent all the tim