Re:Disclosure of three 0-day iOS vulnerabilities
by hungryforcodes on Friday September 24, 2021 @12:24AM
(#28638615)
You know, I'd love to think that the problem is cyber security is hard -- which it IS -- but I'm starting to get the feeling that the actual problem is that Apple doesn't care about this kind of stuff. So many incredible vulnerabilities going back generations of iPhones and iOS...the zero click iMessages one floored me.
[ Parent
| on HN ]
Re:Disclosure of three 0-day iOS vulnerabilities
by tyrfing on Friday September 24, 2021 @02:20AM
(#28639174)
> the zero click iMessages one floored me.
In case there is any confusion, there has been at least one of those a year for the past 3 years.
Re:Disclosure of three 0-day iOS vulnerabilities
by easton on Friday September 24, 2021 @07:18AM
(#28640924)
What is dumb about it to me is that the solution in my mind is simple: don’t give Messages.app private API access. They get access other messaging apps from the App Store can’t have and that’s what’s causing these vulnerabilities, but all they need is APNS and access to the SMS service (which is private but shouldn’t be dangerous… right?).
Re:Disclosure of three 0-day iOS vulnerabilities
by kenferry on Friday September 24, 2021 @09:59AM
(#28642437)
This last one was an issue in an image decoding.. it was public API.
It’s extremely common for an attacker to find a way to exploit a maliciously crafted image. Take a look at libpng, https://www.cvedetails.com/vulnerability-list/vendor_id-7294...