You’re missing the point:

- AppStore or not, you should not be able to access this file in an app. The exploit (plist parsing bug) is about breaking out of the sandbox and getting the permission to access system files (and much more!).

- Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially.

Or maybe I should have said “was”. Best case scenario Apple would retroactively check for naughty plist files in Apps submitted to the AppStore present and past, and ban developers that used the same hack. That being said, this is reactive and the damage would already be done.

This hack is not using a private API or doing something that Apple would have caught during App review. Even the system file path could be obfuscated (or downloaded from Internet later on).

So “don’t install apps outside the App Store” did not really help in this case.

> Also. There is nothing stopping someone for using this technique to publish an app in the AppStore officially.

That's not accurate, the entitlements parsing logic on the App Store submission system has always caught this, it's the client side parsing that doesn't.

You can't submit an app to the store that uses this exploit, because the store will reject it as having invalid entitlements.

Indeed. I was wrong to assume Apple would not have yet another XML Parser somewhere else :)

In that case it would only work with side loaded Apps signed with enterprise and developer certificates.

I stand corrected.

That being said I wonder... since we have two parsers on the device and one in submission process, if a more clever variant of this bug would have worked... I guess we will never know. For sure that parser is rock solid now.

> For sure that parser is rock solid now.

I wouldn’t be too sure.

thatsthejoke.jpg

Do you know if TestFlight uses the same entitlements parsing logic? It may have been possible to exploit users' devices through beta versions.

TestFlight apps are uploaded to App Store Connect as well.

> There is nothing stopping someone for using this technique to publish an app in the AppStore officially.

It has not happened though. Only app which has been in the App Store and utilized private entitlements, from what I’ve seen anyway, has been Uber.

That's a terrible solution.

Giving full control to one company of the thing that can be published, discovered an install is a receipe for all what's wrong with monocultures.

Don't get me wrong, the app store is a fine service. And that it's the default experience for beginners is a reasonable compromise.

But assuming it as the only channel is like a hospital refusing to heal people that eat processed meat because WHO declared it carcinogen.

> You can't get an app into the app store that haz the required permissions to access that file

The one thing that was never clear to me was whether Apps were able to be submitted to the store with this buggy entitlesments file.

That's not a real solution when we know Apple's walled garden is so restrictive.

I've used iOS for over a decade without needing to install apps outside of the app store. I would guess that the vast majority of iOS users share that experience. I understand you might be frustrated by those limitations, but to say "hold off on this until it's fixed" seems pretty reasonable.

It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall.

You don't know what apps you're missing if you can't see what apps would exist without the restrictions.

That's like saying "I've rented from Blockbuster Video from over a decade without needing to view videos Blockbuster doesn't carry"

Completely agree. It's also the view that people held regarding blackerries pre-iphone.

A hardware keyboard was essential because the alternative was not an option.

As someone who used to jailbreak, I've definitely found tools in the past in the jailbreak store that were lovely, and a large chunk of those have now wound up in iOS by default too.

I've also since determined that the tradeoff (less security, more features) isn't one I'm still happy to make anymore, so have given up and accepted that I can do what Apple permits, and that's it.

It's not the ideal solution, but the ideal solution doesn't currently exist, and this is the least-bad in my view of the tradeoffs involved.

But we know what's possible because other platforms like android exist.

No, they make it hard on purpose even for hobbyist developers with cumbersome signing process and 7 days limit, as a way to bank on the 99$/year registration.

$99/year is peanuts, that's less than 1 hour of developer time. All it does is prevent spammers from creating a shitload of free accounts.

You're not thinking of programmers from developing countries. It can be several days wage there.

> $99/year is peanuts, that's less than 1 hour of developer time

lol, I wish.

There's a difference between your salary, what you cost to the company, and how much they charge the customer for your time.

Well ... it might not be what a developer is paid, but it's the value a developer creates for a business (experience and training withstanding of course), if you catch my drift.

99 cents a year would stop spammers creating a ton of accounts too

Making it harder also heightens the bar so low-quality or malicious apps don't get in.

"hold off on this until it's fixed" is definitely reasonable. However, that's not what OP said. OP said, "Dont install apps outside the app store." That reminds me of the kind of apologetic advice I get from the Microsoft community when dealing with Windows' strange behavior and anti-user choices.

> It's pretty ironic to hear a complaint about the walled garden, when the only apparent way to solve this "0day" is probably going to be to put up another wall.

You're conflating two separate issues. Microsoft has a certification program for Windows programs, Linux has extremely nuanced permissions, SELinux, etc.

This has been solved elsewhere but the walled garden of iOS is deliberately ill-designed and is not a robust solution.

For me the walled garden of iOS attracts me to the platform. Its apps are relatively safe, stable and curated. Sure, these restrictions might suck for you as a power user. For me, someone who makes phone calls, chats with family, takes pictures and reads the news this is just perfect. I don't need to think a lot about security because the platform thinks about it for me. For you it feels like prison, for me it feels like one thing less to worry about. For you it's ill-designed, for me it's designed for me the consumer.

I'm curious what your definition of robust is.

Not the person you were responding to, but: implements security with fine-grained and system-enforced permissions, not human approval for apps.

One of these methods has a much better track record than the other.

It sucks for me as a power user because I prefer Apple's corporate ethos, but their increasingly quirky UI and no recourse for things like alternative launchers make it an automatic no-go because I can't stand Apple's interfaces. It seems silly to most people but I get physical anxiety from interfaces which don't behave consistently or make me feel claustrophobic, and I've grown tired of relearning iOS every few years. To the point where I'm using hole-ridden Android devices with bags of telemetry by default, but with a consistent launcher I've used for many years and know how to navigate. No hidden UI tricks.

If Apple would allow people like me to control the devices we buy, I would finally have a home in the mobile market.

>but I get physical anxiety from interfaces which don't behave consistently or make me feel claustrophobic

I feel terribly for you. I can't imagine being in my own way so much that Apple's UI would give me physical anxiety.

It's not "in my own way", it's some kind of physical disorder where I legitimately get a sense of panic if things aren't responsive for more than a couple hundred milliseconds when they should be, a great example would be when explorer.exe jams up in Windows and everything severely stutters.

I wish I didn't deal with this but a little sensitivity towards users like me would be nice instead of ironically writing us off as close-minded. I have diagnosed OCD and it's just a facet of that. It can be quite frustrating at times when I'm trying to use an interface and, say, intrusive thoughts lead me to repeating body movements like clicking or picking up and dropping my mouse and next thing I know my browser is closed and I've opened up another program without even realizing. Like it happens all day while I'm working and the more invisible my interface the better. It's not easy to overcome these physical impulses and reactions. I still deal with vocal tics and stuff like that.

That doesn't really sound like an issue with the interface, though. Again, I'm sorry you have to deal with that but you're basically saying that companies need to account for the possibility that someone who clicked the "X" to close a window may not have intended to close the window. That's just crazy talk.

No, that's not what I said. If you want to have this discussion in good faith then let's not mince words.

I said a proper platform allows user control and customization over the interface, providing a way for users to continue using interfaces that make sense to them even if some young engineer at Apple finds a clever new way to shove some functionality into a screen gesture.

This isn't crazy talk. It's exactly how my Linux-based computer and Android-based phone operate and I've been using the same window manager / launcher for over a decade, while the mainstream default ones like Gnome 3 continue to make the strangest and most anti-user design decisions. I just bought a MIUI phone and if I couldn't flash my own Paranoid Android ROM in the coming weeks I would have to return this phone because the UI is bonkers.

I'm not resistant to change, you're resistant to the idea that interfaces don't need to change every three years, or that portable computing devices don't need to place freedom in the hands of the user. You're simply playing devil's advocate.

> do all sorts of crazy cartwheels to satisfy some non-existent need.

OCD is a real thing and is quite debilitating for some. I suggest you read about BFRB's and similar disorders before again blaming me for a physical disorder I have limited control over. Physical therapy only does so much. But that's orthogonal to the fact that I expect a consistent interface on a philosophical level.

> Again, I feel sorry for you. I'm not responding any further but I wish you could get help instead of laying the problem at everyone else

Is this how you feel about users with tourettes, seeing/hearing/motor disabilities, etc. as well? Do you similarly mock them and blame them for their disorders?

I'm not mocking you for your disorder. Your situation is only partially a result of your OCD. The majority of it is self-imposed because you don't seem to know how to use accessibility features of an OS.

As a technical user, I share in your frustrations. iOS may be more secure out of the box, but it's an all-or-nothing solution. Either you take what they give you and put your faith in the almighty Apple, or you break out and have no protection at all.

Unlike other platforms, where there is a range of options to us, where if we work hard enough, we can make our platform more secure, while still maintaining our freedom to do as we please, because we know what we're doing.

That said, I remain grateful that there's at least one mass consumer facing platform that is secure by default and user friendly. For the vast majority of the world, this is more valuable than the ability to tinker.

For me personally, it ends up being a toss up. I lament my restrictions, but I'm grateful for the significantly reduced amount of technical support I'm required to do now compared to the (good|bad|^$) old days when a PC / laptop was everyone's primary computing device.

There's such a simple solution: don't buy an iPhone.

They're not hiding anything from you about their walled garden.

> There's such a simple solution: don't buy an iPhone.

Is there a platform that gives me the freedom to run what I want, provides a decent security model, doesn't spy on everything I do, and if you squint just right, 'just works'?

If not, there is no simple solution, there's just different tradeoffs in a huge pile of poop.

Yeah, I don't understand why this position needs defending. Both Google and Apple's app stores have major problems, and they could learn a little from each other.

That's a real solution because the vast majority of iOS users are already using this solution through their inaction (i.e. never installing anything outside of App Store and not adjusting their phones to be able to install anything outside of App Store), and thus are not vulnerable to this exploit.

It's misleading to call something an "iOS 0day" if actually does not apply to almost every user of iOS.

Apple considers integrity of their entitlements as part of the security model of iPhone. As such, an exploit that allows people to arbitrarily sign applications with restricted entitlements is absolutely a iOS 0 day.

While I agree, the barrier for entry here isn't that big so I'd say it still qualifies.

One of the reasons why it's so restrictive is so developers can't do things like the attack in the article. You can't have the protection Apple offers and also have the freedom to do things the protection protects against. That's a tautology.

Why does apple "protect" me from bit torrent clients but ChromeOS and Android do not?

I haven't tried, but maybe it's difficult to make a sandboxed BitTorrent client?

It’s a legal thing. Creating such an app goes against the AppStore rules. Same as porn.

https://www.wired.com/2009/05/apple-rejects-bittorrent-iphon...

Gotcha.

To be fair, I can't think of anything distributed via torrent that you'd want on an iPhone that isn't copyright violation.

It's fair to say that BitTorrent main use cases can not be said to have been in most copyright holders best interest, but as always, the details are important.

I don't personally think BitTorrent is super useful to most phone owners, but then again well over 99 percent of apps are not useful to me, so I don't know if that's an important metric?

Best interest of Apples commercial partners, seems to be what it is about, not what is reasonable, fair, or good. In other words, it wouldn't matter if there actually is/was things on BitTorrent that you actually wanted on your phone, because you are not the most important party here, the content owners are, and I think that is wrong considering the role digital devices has come to play in society.

Considering a lot of people only have phones today, I think Apple is clearly stepping over a line with how they manage their app store in a much broader sense.

Few would think it to be reasonable, that a main producer of printing presses would lease them on the condition that only certain articles can be printed, or maybe decide what magazines a kiosks on the sidewalk is allowed to sell - only because they were paid to build the shack - would be an even more apt comparison?

Tangentially, as we don't have any real equivalent to public spaces in the digital realm, it can be argued that the public spaces resides at least partially in whatever digital spaces are created to perform a similar role as the equivalent public space. An interesting thought, but I digress.

It boggles my mind that it is suddenly seen as okay because the "paper" is now a $1000 digital device, instead of a cheap piece of paper?

Since you can choose what paper to buy any day of the week, but what device to buy only rarely, I would expect society to put strict rules on the content curation of device producers/platform owners, but instead the opposite seems to be the case.

So why aren’t torrent clients banned on Android, ChromeOS, Windows, and MacOS? Because I might download a CentOS installer after downloading those 2TB of copyrighted movies and music?

Presumably because none of those platforms actually ban any app, unless I'm mistaken?

I believe crypto miners are banned.

Yes, you can. See Chrome OS.

Chrome OS is not protected by Apple.

But it is protected by Google? I fail to see your point.

The permission is within a XML comment so how sure are you that this would be caught as part of app store review?

Since apps now auto-update each night any one of your apps could theoretically add this code tonight couldn't they?

Apple knows how entitlements work and scan every release you try to upload for distribution. The app bundle is signed with an Apple signing key when it goes live, so you can't just randomly change the file once it is on the device.

Evidently Apple does not know how they work, as their multiple parsers can’t get them right ;)

If their scan included an XML parser with the same flaw as CFPropertyListCreateWithData, then yes you could get it published without them noticing.

Apple tracks every time you change it and manually reviews it. In even more sophisticated means after what Uber did.

Note that Uber was given that entitlement by Apple. It was explicitly granted an exception to use a private entitlement (which is in of itself unusual) and then submit such an app to the App Store.

Apple's XML parsers apparently are not catching this due to the comment trick.

So the security relies on a human catching it. There are many ways to hide text from a human, IE padding it out with whitespace, character encoding tricks, etc.