Re:How to unc0ver a 0-day in 4 hours or less
by saagarjha on Thursday July 09, 2020 @03:03PM
(#23783781)
I think the implication was that App Store review would catch such things. Personally, I'm not so sure, considering that Snapchat currently ships a binary with syscall instructions embedded in it.
Re:How to unc0ver a 0-day in 4 hours or less
by yunruse on Thursday July 09, 2020 @03:36PM
(#23784154)
It is likely this is a heuristic; Apple would lose out disallowing major companies, so rules are sometimes shifted, if not explicitly for all. Snapchat being pulled would cause a minor exodus, I imagine, especially if it was heavily leaned on that Apple were responsible for their removal.
Re:How to unc0ver a 0-day in 4 hours or less
by saagarjha on Thursday July 09, 2020 @03:41PM
(#23784206)
That is likely true, but slipping in a call to list_lio would be really easy to do. Even if they had a check for the syscall instruction in this case, you could just ROP your way to libc…
Re:How to unc0ver a 0-day in 4 hours or less
by wolco on Thursday July 09, 2020 @05:27PM
(#23785431)
It would probably kill snapchat and force many groups to other platforms.
Re:How to unc0ver a 0-day in 4 hours or less
by wrkronmiller on Thursday July 09, 2020 @09:21PM
(#23787180)
It’s possible for both to happen. People might switch chat apps in the short term, but reconsider buying an iPhone in the next cycle (esp. if Apple makes a habit of killing off popular apps).
Are you sure about this?
I'm far removed from the app store development world, but a cursory glance at the description and the original lightspeed bug seem to indicate this is a problem within the kernel interface, and as such I assume callable by any application??
Sorry, I could be missing something, just curious why this couldn't occur in the app store.