News for hackers. Stuff that matters.

A comment on About the security content of iOS 14.7.1 and iPadOS 14.7.1. Parent comment

Re:About the security content of iOS 14.7.1 and iPadOS 14.7.1 by refulgentis on Monday July 26, 2021 @03:12PM (#27963926)
taking note of multiple comments mentioning Pegasus, wanted to flag on the top one: this is very unlikely to be a fix for it.

- reported by anonymous researcher

- if it is related, this would be the 2nd of 2 bugs that would need fixing. The first is the 0-click escape hatch from the Messages sandbox to calling functions on IOMobileFramebuffer

- there is only one bug listed for this release, and it is unlikely Apple would publicly flag #2 of 2 bugs was fixed, but not #1

- extremely tight timeframe from press reports of _a_ bug to a fix deployed, I'd like to think you could get a week turnaround on that, but...in practice, at BigCo, that timeframe would require moving heaven and earth, and yet still choosing to be irresponsible by skipping most of the gates on the release process

[ Parent | on HN ]
Re:About the security content of iOS 14.7.1 and iPadOS 14.7.1 by saagarjha on Monday July 26, 2021 @06:59PM (#27966541)
IMTranscoderAgent possesses the necessary entitlements
[ Parent | on HN ]
Re:About the security content of iOS 14.7.1 and iPadOS 14.7.1 by radley on Monday July 26, 2021 @03:17PM (#27964015)
> it is unlikely Apple would publicly flag #2 of 2 bugs was fixed, but not #1

It's very possible Apple doesn't want to verify that Messages was compromised, particularly if they can blame everything on something obscure.

[ Parent | on HN ]
Re:About the security content of iOS 14.7.1 and iPadOS 14.7.1 by ComputerGuru on Monday July 26, 2021 @03:24PM (#27964126)
There isn’t a separate “messages” from anything else, that’s an illusion Apple marketing encourages. iOS is a shared-tenancy, general-purpose operating system. A vulnerability in any of the core libraries can affect any of the apps (first party or otherwise) and a hostile or compromised application (first party or otherwise) can compromise the entirety of the device and its data.

Whether something is a Messages vulnerability or “something obscure” is just marketing spin.

[ Parent | on HN ]
Re:About the security content of iOS 14.7.1 and iPadOS 14.7.1 by kall on Monday July 26, 2021 @05:51PM (#27965934)
I think the important part is any person can force data onto your device via messages. If that is exploitable, it‘s a huge oroblem. That‘s why people care.
[ Parent | on HN ]