Browsers are essential and how operating systems are holding them back (2022) [pdf]

Re:Browsers are essential and how operating systems are hold... by mike_hearn on Wednesday February 08, 2023 @08:21AM (#34707602)

Nothing stops you executing arbitrary code on iOS, you just have to use an interpreter to do so, and Joker is in fact running interpreted code (a dex file).

Bear in mind one reason you may hear less about malware on iOS is simply that security researchers aren't allowed to sell products for it and they are blocked by the infrastructure from examining apps like anyone else is anyway, so they have no incentive or ability to figure out what apps are actually doing. On Android you can get APKs from the Play Store more easily, and APKs from third party stores very easily, and you're allowed to sell security apps into that market, so they have both means and an incentive to go find malware for it. Apple just point blank refuses to allow their commercial existence unless it's by selling vulns to Apple itself.

[ Parent | on HN ]

Re:Browsers are essential and how operating systems are hold... by GeekyBear on Wednesday February 08, 2023 @10:19AM (#34709226)

> Nothing stops you executing arbitrary code on iOS

Nothing except the App Store review process?

We already have tech sites warning Android users to beware of apps inside the Play Store, because Google has been unable to block Android apps from downloading malicious code and executing it on a regular basis.

If you're happy with that state of affairs, by all means, buy an Android device.

[ Parent | on HN ]

Re:Browsers are essential and how operating systems are hold... by mike_hearn on Thursday February 09, 2023 @02:12AM (#34720684)

The point being made by the cited article is that a tiny interpreter that activates days or weeks after an app goes live can't be detected by any app store review process. You have no idea how many such droppers are active in the iOS App Store because only Apple can look for them, and nobody knows if they do or to what extent they do.

That's why both platforms also use a sandbox. The dropper still needs to work within whatever permissions the app has been granted. App Review doesn't involve a full blown security audit of your app's source code and then a deterministic build process on top.

[ Parent | on HN ]

Re:Browsers are essential and how operating systems are hold... by GeekyBear on Thursday February 09, 2023 @02:10PM (#34729494)

> The point being made by the cited article is that a tiny interpreter that activates days or weeks after an app goes live can't be detected by any app store review process. You have no idea how many such droppers are active in the iOS App Store because only Apple can look for them, and nobody knows if they do or to what extent they do.

The point being that Apple doesn't allow information downloaded from random places to be executed as code in third party apps at all. This is literally the reason for the Webkit only policy.

Google does allow it, and they (very predictably) have no way to know if that code will be malicious or not.

Which is why Ars had to warn Android users that they had to be wary of apps downloaded from the Play Store.

[ Parent | on HN ]

Re:Browsers are essential and how operating systems are hold... by mike_hearn on Monday February 13, 2023 @08:26AM (#34773087)

I think we're talking at cross-purposes here. The issue is not what Apple allows, it's what they can detect and block. They can't detect arbitrary interpreters and therefore you have no idea if this is happening on the app store. You just have to take Apple's word for it that it's not. We're talking about malware, by definition it doesn't care what the rules are. Android is more open and so third parties can go investigate and find malware that uses interpreters to execute remote code, but Apple simply doesn't allow such explorations so we don't know what's out there.

[ Parent | on HN ]