News for hackers. Stuff that matters.

A comment on Getting root with benign AppStore apps.

Re:Getting root with benign AppStore apps by saagarjha on Tuesday June 04, 2019 @10:41AM (#20095448)
> it’s a good idea to double check if the App is compiled with the library-validation option (flag=0x200). That would mean that the OS will verify if all dylibs are signed or not

Actually, library validation will check if the binary is signed with the same team ID.

> I signed up with a new Apple ID for the Apple developer program just because I had the fear that they will ban me, once I introduce an app that can be used for private escalation. In fact they didn’t.

Apple has a history of going after people who try to find holes in the App Store’s security model. This was a huge gamble; they could have your life quite miserable if they figured out who was behind this.

[ Parent | on HN ]
Re:Getting root with benign AppStore apps by floatingatoll on Tuesday June 04, 2019 @11:41AM (#20096042)
He had an open unpublished conversation with Apple Security and notified them of his own published app, so “if they figured out who” seems inapplicable here.
[ Parent | on HN ]
Re:Getting root with benign AppStore apps by saagarjha on Tuesday June 04, 2019 @06:58PM (#20100055)
Yes, hence why it was a gamble. There was a significant chance that they’d go after him after he told them he put an exploitable app on the App Store.
[ Parent | on HN ]