News for hackers. Stuff that matters.

A comment on Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak.

Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by lol768 on Wednesday August 21, 2019 @04:18AM (#20755382)
>A third security researcher, Stefan Esser said that people should be careful what apps they download from the App Store right now. "Any such app could have a copy of the jailbreak in it," he wrote on Twitter.

Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..

[ Parent | on HN ]
Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by n1000 on Wednesday August 21, 2019 @05:01AM (#20755584)
> Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..

Well, until now I assumed Apple would test for patched vulnerabilities in new iOS releases too.

[ Parent | on HN ]
Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by 0x0 on Wednesday August 21, 2019 @04:33AM (#20755447)
It's happened before, and it's probably not super easy for Apple to do static binary analysis to determine if an app is going to make exactly the bad syscalls necessary for the jailbreak gated behind an undisclosed trigger functionality.
[ Parent | on HN ]
Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by Flockster on Wednesday August 21, 2019 @04:34AM (#20755454)
Can a review really check for this? Aren't there obfuscation methods and ways to delay the trigger of the exploit? It could wait for a special network package to start the exploit.

For iOS 9.3.3 there even was an app in the App Store, that could jailbreak your phone. (PG Client)

[ Parent | on HN ]
Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by yots on Wednesday August 21, 2019 @04:52AM (#20755542)
Yes, to some extent people should be worried about apps potentially containing exploits, but then again they should be more worried about 0-days than a known vulnerability.
[ Parent | on HN ]
Re:Apple Accidentally Unpatches Vulnerability, Leading to Ne... by oarsinsync on Wednesday August 21, 2019 @07:44AM (#20756393)
> A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software)[0]

Why should a publicly known unpatched vulnerability be a lesser concern than something that you don't know exists?

[0]https://en.wikipedia.org/wiki/Zero-day_(computing)

[ Parent | on HN ]