Fear of data leaks for one. That’s never going to be zero, but it could be a lot better than it is.

&gt;This is a mistake that Google, Apple and even Microsoft (for the short time they made phones) all made, and now we have to live with the consequences of that.What consequences are we living with?

I never thought that hacking like in Star Trek will be anytime truth. But it looks like we slowy head for it...

I really wonder how different the mobile security landscape would look if researchers were treated seriously. This is a mistake that Google, Apple and even Microsoft (for the short time they made phones) all made, and now we have to live with the consequences of that. Along with your &quot;post privacy&quot; world, we may as well march this as the epoch of &quot;post security&quot;. It just depends on how much someone is willing to spend to engineer one (or three) zero-days from your target&#x27;s machine. This used to be feasible, but recent ransomware and surveillance malware has proven that it&#x27;s commoditized now.

It looks like that they no longer work for Microsoft anymore. Weren&#x27;t they making some not so great comments before the FBI investigation though?

She faced a FBI investigation over the threats she was making during her rants, not because she dropped 0days publicly. It is not very cool of you to falsely insinuate that these things are related.

Yes, that person did drop 0days publicly and then promptly faced an FBI investigation causing a tremendous level of stress and irreparable mental health damage.

There aren&#x27;t worth anything to Zerodium afaik

Isn&#x27;t this why most researchers just sell their 0days to Zerodium or drop it publicly? I&#x27;ve heard of multiple companies doing this type of BS. There was a person called Polarbear&#x2F;sandboxescaper who dropped a few Win10 LPE&#x27;s on GitHub. They claimed that Zerodium also only pays out a small amount then resells the exploit.

This is a part of our industry I do not follow beyond headlines. A lot of those headlines are about hackers trying to be responsible getting screwed out of supposed bounties that to my mind already appear quite small. Also responsible companies doing very little to quickly close them. Does anyone have any insight into how the market for vulnerabilities operates? Is there is a significant disparity in price between official&#x2F;responsible disclosures and private sales?

Full disclosure is always responsible, even if the vendor is not notified in advance.

This is crazy. At this point it&#x27;s pretty well established that Apple isn&#x27;t really going to pay you much if at all. Might as well disclose in 90 days at this point.

&gt; What about an exploit that can cause the users phone to explode?Possibly world ending, at least from the perspective of the user whose phone explodes next to their face?

You can do a lot more damage with someone&#x27;s bank account than you can by exploding their phone.

I would be an order of magnitude less concerned with camera&#x2F;mic access, compared to perfect historical proof of my usage and communication patterns.Exploits often feel like pathogens, probably why they share the term virus. If a virus has a high mortality rate, contagion is lower, because it frequently kills the host before it can spread.Similarly, I think a &#x27;complete device compromise&#x27; is much more likely to be identified, prioritized, and patched. The vulnerabilities mentioned here represent the highest severity without an immediately noticeable fallout. Props to the researcher.P.S. I wonder if the researcher&#x27;s Russian nationality (assumed from their other post) had any impact on their lack of payout.

If these are gargantuan, how would you describe a remote zero click complete device compromise (complete with camera&#x2F;microphone access)? What about an exploit that can cause the users phone to explode?

&gt; I really, really hope something changes. Soon.I would not hold my breath... it&#x27;s been like this for decades at least.

And if you try to deploy these in an actual app, you will be getting banned very, very hard.

The remedy for this is not just making the company&#x27;s responsible for the failures, but hunting down criminals who abuse it globally and sentencing them to death.

The only mitigating factor is that they’re not remote vulnerabilities.That being said, this is more or less the industry standard. And even if the other person mentioning this was downvoted, they are right: this has been the case since forever and can only be remedied through laws making companies responsible for their failures. But neither the US government nor said companies want this. It will have to get so bad that it visibly harms US or EU security for something to move in this space.

100% - they got away with it because they were small. Hacking Mac OS was unattractive - whereas, hacking iOS is the most attractive target. High gain, low security.Apple does not have security in its DNA, as is obvious from all these exploits. Apple lives in the past where it was OK to kinda fudge it, to kinda give home apps special passes, to bypass stuff to make the game center work, and so on and so forth. These are all red flags.Apple&#x27;s threat model is script kiddies and Russian hacker groups. It&#x27;s very naive vs real world exploits conducted by state level actors, companies serving state level actors, and a $1M market rate for iPhone zero day p0wn exploits.In this cat and mouse game, the hackers are leagues ahead at this point - motivated by money and a whole different mindset.Relying on the app store review process to catch these things is naive. A company that takes security seriously would never even think this way, obviously there&#x27;s many ways around app store reviews, and hackers who went through all the trouble of finding exploits will find a way around the app store reviews, too.

Is that really the case? Or were they just not such a big target before when everyone was spending most of their time in a windows desktop. Maybe they just got away with it more easily in the past.

Cynically I feel like we’re maybe expecting a lot here. Privacy (and I’d assume security, given it’s a necessity to achieve that) was a well-timed marketing drive at Apple, but that was months ago. You can’t expect them to support these minor features forever!Besides, why focus on something as superficial as keeping your private data safe when the new iPhone now comes in a gorgeous pink finish. And with Ceramic Shield and the lightning-fast A15 chip? It’s truly the best iPhone they’ve ever made.These puppies sell themselves without all that expensive privacy talk.Honestly their attitude to the bug bounty makes me wonder if there’s not a small group of engineers that keep screaming about this problem just to have the door closed behind them and a “lol nerds” giggle heard from the execs on the other side of the door.

This is such an incredible amount of vulnerable mission-critical data.- all contacts, including 3rd party messaging apps, with metadata (interactions, timestamps, other stats)
- full address book
- whether any app is installed
- SSID of connected wifiand formerly,- medical info
- device usage
- screen time
- device accessoriesI don&#x27;t keep anything mission critical on mobile, but this is still a gargantuan set of exploits, and each appear extremely straightforward to validate and pay out the security researcher (and maybe even patch). It&#x27;s utterly tragic how Apple (and others) have devolved to become the same monolithic, careless organizations they once displaced.I really, really hope something changes. Soon.

that&#x27;s just dumb, like third parties do all the work and contact you about critical bugs the only effort on Apple&#x27;s part of verification and some coordination which shouldn&#x27;t be a huge issue for a company the size of apple.. just hire a team to do it and be done with it the whole &#x27;secrecy culture&#x27; is a bunch of hogwash

That makes apple (the org, not the fanboys) sound a bit cultish... Can&#x27;t say I&#x27;m surprised though...

Bug bounty programs are the antithesis of Apple&#x27;s internal methodology, culture, and way of doing business. They keep everything close to the chest, they shun &quot;outsiders&quot;, etc.. The idea that someone outside of Apple, from the unwashed masses, could find a flaw in Apple&#x27;s own software is a pretty big pill for them to swallow. Thus it doesn&#x27;t surprise me there are problems with their bug bounty program. I think if they could they would prefer to just silence all vulnerability&#x2F;bug reports with a gag order rather than acknowledging or even investigating them.

Disclaimer: I am not an Apple insider by any means, and this is all a hypothesis.Their management of the bug bounty program seems like a reflection of their secretive (and perhaps sometimes siloed) internal culture. I&#x27;d argue that for any bug bounty program to be successful, there needs to be an inherent level of trust and very transparent lines of communication - seeing as though Apple lacks it internally (based on what I&#x27;ve read in reporting about the firm) it is not particularly surprising that their program happens to be run in the shadows as the OP describes.I forget the exact term for it, but there is a &quot;law&quot; in management which postulates that the internal communication structures of teams are reflected in the final product that is shipped. The Apple bug bounty seems to be an example of just that.Edit: Its called Conway&#x27;s Law

I  actually got response for a bug report saying &quot;We fixed that, can you try it on the next beta and send as a code sample to reproduce it if the bug is still there&quot;. But that bug was about the way SwiftUI draws the UI.

I used to submit bug reports for things I found in macOS or any other applications, like that Pages would include a huge picture in the files for no reason at all. But those bug reports would usually be closed and &quot;linked&quot; to another bug report you don&#x27;t have access to. Essentially shutting you out. At some point you just give up. At some point bugs are getting fixed but there is no pattern to it.

Apple has always been infamously bad at doing anything with external bug reports. Radar is a black hole that is indistinguishable from submitting bug reports to &#x2F;dev&#x2F;null unless you have a backchannel contact who can ensure that the right person sees the report.Bug bounty programs are significantly more difficult to run than a normal bug reporting service, so the fact that they&#x27;re so bad at handling the easy case makes it no surprise that they&#x27;re terrible at handling security bugs too.

So what? Everyone has been affected. Apple doesn&#x27;t somehow get a pass at not doing their basic duties.Sitting at home looking at a monitor and typing is largely the same doing the same thing in an office. They&#x27;re not service sector workers, doctors, nurses, or truck drivers who actually have had to deal with the impact of this head on.

I see no reason COVID has anything to do with Apple’s poor response to external reporters, which has been something that has been a problem for decades.

I&#x27;m curious. Would you accept it if Apple came out and said that the reason this is happening is because of the COVID pandemic affecting their operations?Surely even if it were true, that is no excuse for a company like Apple?

Apple could have chosen to simply not release a new iPhone or iOS version this year, if it wanted to. To the extent that they prioritized that over fixing up their security infra, that&#x27;s on them.

Hackers aren&#x27;t going to stop because of COVID. Apple has a duty to their customers to keep their products secure.

It&#x27;s interesting to me that in this entire thread, nobody is even mentioning or considering the possibility that COVID has impacted Apple&#x27;s operations.It obviously has. It has affected every tech company. Certainly it has affected mine. Whether this is an example of that, I don&#x27;t know, of course, but I think it&#x27;s plausible.

&gt; Explain I&#x27;m naive: why would Apple&#x27;s bug bounty program be so poorly run?Hubris.Apple&#x27;s culture is still fundamentally the same from the day they ran ads saying &quot;Macs don&#x27;t get viruses&quot; to today. They used a misleading ad copy to convince people they could just buy a Mac and be safe, not needing to do anything else... ignoring that Macs still got malware in the form of trojans, botnets and such... and encouraging a culture of ignorance that persists to this day. &quot;It just works.&quot; etc.So now their primary user base is majorly people who have zero safe online habits.And that sort of mentality feeds back into the culture of the company... &quot;Oh, we&#x27;re not Windows, we don&#x27;t get viruses. We don&#x27;t get viruses because our security is good. Our security is good, obviously, because we don&#x27;t get viruses.&quot; It, in effect, is a feedback loop of complacency and hubris. (A prime example of this is how Macs within the Cupertino campus were infected with the Flashback botnet.)Since their culture was that of security by obscurity (unlike, say, Google&#x27;s explicit design in keeping Chrome sandboxed and containered for sites), closed source and again, hubris... it&#x27;s coming back to bite Apple in the ass despite their ongoing &quot;We don&#x27;t get viruses&quot; style smugness. If it&#x27;s not about Macs not getting viruses, it&#x27;s about how Apple values your privacy (implying others explicitly don&#x27;t) and like with everything else, it&#x27;s repeated often enough to where the kool aid from within becomes the truth.Apple&#x27;s culture is that of smugness, ignorance and yep... hubris. Why should they have a serious, respectable bug bounty program if they&#x27;ve been busy telling themselves that they don&#x27;t simply have these kinds of security problems that they&#x27;ve bragged about never having?

I feel like Apple could afford to staff a security program like this.  Much, much smaller and less wealthy companies manage it.

I don&#x27;t buy this. They fixed one reported, got back to him and acknowledge the lack of disclosure, apologised, promised to fix it and never actually disclosed it 3 reports later.It&#x27;s not a case of &quot;someone missed this&quot; it&#x27;s &quot;this seems dysfunctional&quot;.

&gt; Let’s say they have a team of 6 engineers tasked with this.They are a trillion dollar company. They can have as many engineers as they&#x27;d like.

I imagine they are just overwhelmed.Let’s say they have a team of 6 engineers tasked with this. They probably receive hundreds of reports a day, many bogus, some real, but all long winded descriptions like this framed to make the vuln seem as bad as possible. In addition many vuln reports are generated by automated tools and sprayed to thousands of sites&#x2F;vendors daily in the hope of one of them paying out, they seem coherent at first glance but are often nonsense or not really a vuln at all, and of course there are many duplicates or near duplicates.If each of these takes 20 mins to triage, 1 hour to properly look at and days to confirm, you can see how a team of any reasonable size would soon be completely submerged and unable to respond to anything but the most severe and succinct vulnerability reports in a timely way.

I think they don’t want to admit such a big security breach publicly. At some extent privacy is their business.

&gt; My guess would be, that MSRC and Apple&#x27;s equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do &quot;well run&quot; companies do with cost centres... they minimize them :)It would have to be this.If you start to increase the payout, you get more people wanting the payout.

Apple does not have cost and profit centers. They maintain a single profit and loss balance sheet for the entire company.That doesn&#x27;t mean the functional areas don&#x27;t have a budget or resource constraints, but Apple&#x27;s structure is quite different from most companies.I&#x27;d agree with the other comments that pin Apple&#x27;s specific issues on their insular culture that discourages all forms of external communication if you&#x27;re not part of marketing. Great bug bountry programs require good communication with researchers and some level of transparency, two things apple is structured to avoid and discourage.

My hypothesis is a lot simpler:Hacking is much more profitable than preventing hacking.Incentives are heavily biased towards security exploits on all levels.End of story.There&#x27;s no reward for &quot;your code never got hacked&quot;. There&#x27;s a reward for delivering a feature in time and a penalty for not doing so.You&#x27;ll get a bonus or promotion for delivering features. If you take twice as long because you made your code really secure - no one will know.I think that&#x27;s really all there is to it. Security is obscure and complicated.

Here&#x27;s my totally outsider informed guesswork. We&#x27;ve seen similar problems recently with Microsoft, where legitimate sounding issues are denied bounties, so this kind of issue is not unique to Apple.My guess would be, that MSRC and Apple&#x27;s equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do &quot;well run&quot; companies do with cost centres... they minimize them :)I don&#x27;t think that organizationally either company wants to have bad security, and I don&#x27;t think that individual staff in those companies want to have bad security, but I do think that incentive structures have been set-up in a way that leads to this kind of problem.I&#x27;ve seen this described as lack of resources in the affected teams, but realistically these companies have effectively limitless resources, it&#x27;s that they&#x27;re not assigning them to these areas.

this is the real reason. not anything internal&#x2F;culture relatedA good iOS 0-day is worth hundreds of millions of dollars in contracts with shady governments. Apple can&#x27;t compete with that multiple times a year

That explains the payout, but not the poor communication on the part of Apple.

Best explanation I&#x27;ve heard was in Darknet Diaries about Zero Day Brokers, which was a fantastic listen! (<a href="https:&#x2F;&#x2F;open.spotify.com&#x2F;episode&#x2F;4vXyFtBk1IarDRAoXIWQFf?si=395b9194255c4adf" rel="nofollow">https:&#x2F;&#x2F;open.spotify.com&#x2F;episode&#x2F;4vXyFtBk1IarDRAoXIWQFf?si=3...</a>)The short version is that if the bounties become too large they&#x27;ll lose internal talent who can just quit to do the same thing outside the org. Another reason was that they can&#x27;t offer competitive bounties for zero days because they&#x27;ll be competing with nation states, effectively a bottomless bank, so price will always go up.I don&#x27;t know much about this topic, but surely there are some well structured bounty programs Apple could copy to find a happy middle ground to reward the white hats.

It doesn’t matter how big of a company they are, the only thing that matters financially is whether they’re growing or not.

Its company culture, some companies see failure as a problem to be avoided others see failure as the road to success.Evidently apple see failures like bugs as a problem to be avoided and are just trying to avoid the problem with the obvious result that they have problems and look like a failure.Companies that accept failure as a consequence of trying will learn and improve until they achieve success.

it feels like we&#x27;re conflating two issues here: fixing the bug on time and paying out the researcher. at the point where the bug is too complicated to fix within SLA and the exception has been escalated to senior leadership, surely the bug bounty team can pay the researcher?

That honestly sounds like a failure to communicate with the researcher first and foremost. If it&#x27;s difficult to prioritize the fix internally due to organizational politics, that&#x27;s one thing, but that shouldn&#x27;t stop the bounty team from communicating the status to the researcher. In fact, that should be the simplest part of the whole process, as it&#x27;s completely within the purview of the bug bounty team. If they handle that right and build some trust, they might be able to successfully ask the researcher for an extension on disclosure.Case in point, Apple likely could have come out of this looking much better if they didn&#x27;t ignore and then actively lie to illusionofchaos. That really isn&#x27;t a very high bar to clear.

Having worked in at a large tech company with a big bug bounty program and seeing tonnes of bugs come through, my experience is that usually there is a wide disconnect between the bug bounty program (situated in one org of the company) and the engineering group responsible for fixing the bug (which is in a different part of the company.) This is exacerbated by misaligned incentives, bug bounty team wants fixes ASAP while PMs&#x2F;TPMs dont care about security and want engineers to be busy on feature development vs fixing bugs. On top of that if the leader of that org comes from a non-tech background then its even harder to convince them to prioritize security. Bug bounty teams are mostly powerless pawns in the politics between leaders of several different orgs with varying cultures of caring about security.This is roughly how I have seen things work internally:* When a bug report comes in, the bug bounty triage team tries their best to triage the bug and if legit, passes it on to the infosec team situated within the organization where the bug belongs.* Security team for the org then scrambles to figure out which exact team the bug belongs to assigns it to them.* A day or two later that team picks up the bug and there is usual back forth on ownership, &quot;oh, this is that part which this another team wrote and no one from that time now works at the company&quot; or &quot;its not us, its another team, please reassign.&quot;* Even when the right team is assigned to the bug, there are discussions about priority and severity - &quot;oh we dont think its a high sev issue&quot; types of discussions with PMs who have no knowledge about security.* Even when everything gets aligned, sometimes the fix is so complicated that it cant be fixed within SLA. In the meantime, security researchers threaten to go public, throws tantrums on Twitter while Bug bounty chases internal teams for a fix.* When the bug cannot be fixed within SLA, the engineering folks file for an exception. This then gets escalated to a senior leader who needs to approve an exception with agreement from a leader within security. This takes a couple of days to weeks and in the meantime, security researcher has now completely lost it because they think no one is paying attention to this crazy oh so critical bug they spent day and night working on.* When exception is granted, bug bounty swallows the pill and tries to make up excuses on why it cant be fixed soon. Eventually, 90days are over and researcher feels disrespected and establishes animosity and starts to think everyone on the other side a complete idiot.* A blog shows up on HN and gets picked up by infosec twitter and slowly media catches up. Now, internally everyone scrambles to figure out what to do. Bug bounty team says &quot;we told you so&quot; and engineering team figures out a magical quick band-aid solution that stops the bleeding and partially fixes the bug.

Apple didn&#x27;t get rich by writing a lot of checksironically, spoken by Gates @0:52 <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=H27rfr59RiE" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=H27rfr59RiE</a>

Explain I&#x27;m naive: why would Apple&#x27;s bug bounty program be so poorly run? Is it simply a sign of organizational failure? 
 (e.g. perhaps the managers running the program have been promoted to a position that they simply don&#x27;t belong in, and higher up execs don&#x27;t care? Or are they prioritizing profit over success?)I would think that, given the profitability and positioning of Apple in the marketplace, that they would be heavily incentivized to provide large bounties for finding such destructive vulnerabilities. And I imagine that there are plenty of security people working there who genuinely care about fixing fix these issues right away.

did you mean 0day exploit authors? otherwise, wouldn&#x27;t the actual authors of the 0day be Apple employees on the iOS team?

They don&#x27;t need leaks to find vulnerabilities... although the source code would probably help.

I wonder if the culture of leaking and dissent within Apple is enabling information to leak which assists the 0day authors?

Is there a point to this...? Or did you just want to crap on GDPR?Not saying it&#x27;s good or bad. But just...relevance?

GDPR cookie consent banners that make it more difficult to opt out than opt in are illegal, and only continue to exist because the GDPR is poorly and inconsistently enforced.

&gt; crap like GDPR (which makes basically all normal interaction cumbersome)Only if you count &quot;tracking users on first visit before they do anything else&quot; as normal. Otherwise, there isn&#x27;t a banner needed; sites could simply have a link to opt-in to tracking in the header or footer, and not track unless the user opts in.This is like passing a law making it illegal to just hit people in the street, requiring you have to ask them for consent first. So most of the people who want to hit others up come up with some gish gallop that most people fall for, and then hit them.And people bitch about the law, and claim it &quot;makes it necessary for people to chew off the ear of other people they pass by in the streets&quot;... with a straight face, that&#x27;s what they twist it into, with an air of indignation even... and not just for a few weeks, until they read up and the initial misunderstandings are cleared up, but year in and year out, because they never read up, and the falsehoods you just posted keep getting repeated.

The only interactions made cumbersome by GDPR are those with organizations that abuse their users&#x2F;customers’ data.Otherwise you don’t even need a cookie banner.

The cookie popup is something else, and the result of misinterpreted legislation and companies trying to cry foul that they can&#x27;t do whatever they want anymore. It&#x27;s not at all needed for common cookie usage - just the unexpected soul-selling kind.GDPR restricts companies from using data however they want, makes you able to obtain a copy, and makes you able to require it deleted. It also required the company to document, provide a person responsible to contact, etc.It only benefits you as a consumer, and the downside in proper uses is that the webpage&#x2F;app might have a page somewhere with data processing information should you be curious. Nothing major.Any nuisance are poor implementations or because companies can no longer do terrible unexpected things, like selling your data to hundreds of companies just by accessing a page, without permission, because it is nonsense no one would expect or want.And with everyone clicking &quot;no&quot; (which must be at least as easy as clicking &quot;yes&quot; as determined in court), the practice would die eventually.

God, I would HATE if the US follows the EU with this craziness. I&#x27;m already sick of the cookie popups, now layer on the GDPR insanity and we will definitely lose the privacy fight to users who will be sick of this nonsense as well.I&#x27;ve seen studies that show crap like GDPR (which makes basically all normal interaction cumbersome) has like 10% of folks clicking around to &quot;opt-out&quot; while 90% can&#x27;t be bothered. And of course, you COULD just clear your own cookies.There is no more real security in the EU. Your mental health records will be leaked there. The EU will spy on you like crazy. And more.

Right, it’s hard to compromise a kettle and manual grinder, the only thing I could possibly consider a benefit of a networked coffee machine is you can schedule it&#x2F;script it with home assistant.But even then, I’m pretty sure you can buy simple electric ones with timers…

When I was looking for an espresso making a lot of them have touch screens and connected features. They will wake up before you get out of bed and have hot water ready. I specifically bought one without touch screens and all that crap. It takes maybe 30 seconds for the water to heat up.Lots of people will get their regular coffee maker ready the night before with water and ground beans. At a specific time in the AM it will brew. Lots of old models have timers you can set. I avoid smart devices like the plague. My Bosch fridge is a smart fridge and I plan on putting it on a VLAN.

&gt; Further to this, you claim that you have been compromised on HUNDREDS of sites even though you use a unique password everywhere?It’s not too far-fetched.I’ve been compromised on dozens of sites out of ~1.500 sites on which I have accounts, all of them with unique email addresses and unique passwords. Those dozens accounts are just those I happen to know about (through HIBP, incoming email spam, or the occasional site owner’s disclosure) so they’re probably just the tip of the iceberg.Sites are being breached left and right. If you’re lucky, the site owner tells you. Many won’t.

Hang on, you have a coffee machine that is capable of being compromised? How exactly?Further to this, you claim that you have been compromised on HUNDREDS of sites even though you use a unique password everywhere?How is this happening to you? Isn&#x27;t this a huge concern?

Aren&#x27;t Ombuds generally limited to investigations and recommendations (not enforcement)? What country colors your context? (e.g. I&#x27;m in the US where federal Ombuds aren&#x27;t much of a thing, though similar roles may be filled by other persons).

If your annual revenue is above $100M, you should be held accountable to a strict version of GPDR enforced by an ombudsman, that requires you to patch all data leaking vulnerabilities within 90 days, or pay out everyone who bought your product.I just updated to iOS 15 and it now tells you which sites you have been compromised on, or had your passwords&#x2F;info compromised on. To be clear, I use a password manager with a unique password on every site, so it is difficult for something like this to have a significant impact. Nethertheless, I was compromised on hundreds of sites and products, and those were just the accounts that iOS Safari knew about. None of them bothered to reach out and tell me. Even my coffee machine was compromised. Ridiculous.

Settings &gt; CellularIt shows my carrier, amount of data used and shows remaining on my plan.Mine reads,<pre><code> Usage: Used 7.43GB - Unlimited
</code></pre>
If I click on it it has 3 fields.Data, Calls, MessagesData reads the same here. Calls and Messages simply say ‘Unlimited’

Does iOS have any way of telling if you’re on an unlimited data plan? If not, maybe it’s just to prevent the footgun (and subsequent bad PR) of somebody accidentally updating the OS over an expensive metered connection. But it could also be a carrier demand, not really sure.

This has changed on the newer phones (12, 13):<a href="https:&#x2F;&#x2F;www.macrumors.com&#x2F;2020&#x2F;10&#x2F;21&#x2F;iphone-12-can-download-ios-updates-over-5g&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.macrumors.com&#x2F;2020&#x2F;10&#x2F;21&#x2F;iphone-12-can-download-...</a>

You got downvoted but this is correct. For a long time iOS didn&#x27;t allow you to perform big downloads (apps, updates, etc) from the device if you were on mobile data because they didn&#x27;t want to upset the carriers. But I believe those days are over.

Why must iOS use WiFi to run critical security updates? I assume it’s a kickback from telecoms to reduce network bandwidth from users with unlimited mobile data plans?

&gt;com.apple.gamedI like the poetic nature of exploiting that one.

Completely aware of that. Just a weird perception thing for me.

It means a vulnerability is made public while there is no patch available. As opposed to releasing the information a number of days after the patch was released.

FYI, 0-day just means &quot;first time made public&quot;.

I must have missed the medical info.I guess I don&#x27;t consider contacts mission-critical though I definitely would not want them exposed and generally don&#x27;t give apps access to them.

From an earlier post: This is a boat load of mission critical data.- all contacts, including 3rd party messaging apps, with metadata (interactions, timestamps, other stats) - full address book - whether any app is installed - SSID of connected wifi- medical info - device usage - screen time - device accessories

There is a system, cvss scoring <a href="https:&#x2F;&#x2F;www.first.org&#x2F;cvss&#x2F;specification-document" rel="nofollow">https:&#x2F;&#x2F;www.first.org&#x2F;cvss&#x2F;specification-document</a>

There needs to be a distinction between 0-days that make remote code execution possible and those that don&#x27;t. This is still a pretty damning data leak.

Maybe it&#x27;s just me, but these aren&#x27;t what I think of when I hear 0-day.These are serious, but I was guessing remote code execution or sandbox escape. It seems like we&#x27;re talking about bypassing privacy controls though.That said, Apple needs to take this much more seriously. They created the program reluctantly and it shows.

Haven&#x27;t they done this in the past? &quot;Oh thank you!&quot; then &quot;Actually we already knew about it and had a fix planned, so no bounty for you&quot;?

I think the behavior is very Russian.Hacker: You have a vulnerability bounty program. Well here are three. Pay up.Apple: [silence]Hacker: [interprets this correctly as a fuck you.] Fuck me? Fuck you!Me: Love it!

Seems more likely it&#x27;ll just take 3-4 years with months of silence at a time, based on the extremely few security Radars I&#x27;ve ever filed as a developer. 90 days to publication is certainly a valid choice, but it&#x27;s also a personal choice that reduces a probable $100k payment in X years to a certain $0 payment today. I would be fine with that delay. OP is not, and that&#x27;s fine too. I don&#x27;t know whether that&#x27;s an acceptable choice or not to anyone else, but Apple should be disclosing their communication practices a lot more clearly here. I discourage participation by anyone who isn&#x27;t willing to wait a year between replies.

You’re claiming that they maliciously lie and refuse to payout because, based on OP, they screwed up on release notes and didn’t get it solved within the 90 day crunch period between WWDC and release.It took so little evidence for you to decide it’s hopeless and declare as fact your prediction. Maybe you felt this way before this post? Otherwise I’m just not sure how to respond.

There is no $100K coming.Apple hopes you&#x27;ll stay silent by dangling a hypothetical $100K (or whatever large amount) in the vague future. Once they&#x27;ve fixed the bug, they no longer have an incentive to pay you so they won&#x27;t.

Given that (according to the author) they&#x27;ve already lied at least twice (&quot;processing error, will be in next release&quot;)...... what gives you such high hopes that he will ever get his 100K?

I would not consider Apple particularly concerned about shame in regard to bounty program delays in communication and publication, no matter how much people try.

This fellow has a lot more to gain than $100k by the popularity and prestige he&#x27;ll gather from publishing this. Especially considering that Apple will never change their ways until they&#x27;re publicly shamed, the long term outcome of shaming them is worth more than $100k if they actually change the policies to take security researchers and the bug bounty seriously

It must be nice to give up $100k by being impatient. I do understand that OP probably feels a moral reason to do so, but that $100k would be life-changing for me, even if it took 3 years to pay out.

I believe the poster was referring to the practice of testing if an app was installed by calling [UIApplication canOpenURL:] —- as I recall Twitter was found to check for hundreds of different apps, to feed into their ads and analytics business, and Apple later changed it to only be callable 50 times.

Facebook and Twitter exploited 0-day security vulnerabilities to collect private data?Can show the proof link please?

Obscure ad-tech companies would love to get those installed apps like they were aggressively doing (Facebook &amp; Twitter too) about 5 years ago.

It’s pretty trivial to encode a backdoor into your app that would let you remotely call native code of your choice.

&gt; I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps.On a side note, this is one more reason Apple can cite for their App Store exclusivity. If there is a vulnerability in the OS exploitable by apps, and they can’t get a patch out in time, they can screen and prevent the download of such dangerous apps.Not a popular position here I know. But I’m correct no?

The whole point of Swift is to be next generation Objective-C and C on Apple platforms, no need to drop down to other languages.In fact, the prof of concepts shown in the article are all written in Swift.

Don’t update your apps till after Apple releases a patch. The first two are API calls that apps can make.An exploit wishing to exploit these vulnerabilities has to be coded to make these calls. Most apps don’t dynamically construct arbitrary API calls. In fact, you can’t do that in Swift AFAIK. You have to drop to Objective-C or C to do that.So most apps need to be updated to exploit the vulnerability. The only exceptions would be apps that are intentionally constructed to call arbitrary APIs or at least with arbitrary parameters. The first would be a violation of developer agreements but that hasn’t stopped people in the past. Also, these aren’t even private APIs. These are public APIs that got exploited due to not properly checking parameters&#x2F;entitlements.I wonder if Apple isn’t running static analysis tools right now to look for these vulnerabilities against all apps.

Delete any apps you don&#x27;t want others know you downloaded or be linked to you immediately. If your wifi name for some reason is something sensitive rename it. The address book&#x2F;sms one is tricky, maybe make a backup of your iPhone and if you&#x27;re truly paranoid delete all your contacts and sms messages and restore them when Apple releases a patch?This is truly a massive fail on the part of Apple and I hope there is as big of a backlash from their users.

Are there any partial mitigations you can take until these are patched?

Good on you.  I&#x27;d be happy to make a small contribution to your legal fund if Apple tries to send lawyers after you.  Even if these vulns weren&#x27;t critical there&#x27;s no excuse for their inept handling.  Thank you for pressuring them to get their act together.

&gt; the zero click iMessages one floored me.In case there is any confusion, there has been at least one of those a year for the past 3 years.

You know, I&#x27;d love to think that the problem is cyber security is hard -- which it IS -- but I&#x27;m starting to get the feeling that the actual problem is that Apple doesn&#x27;t care about this kind of stuff. So many incredible vulnerabilities going back generations of iPhones and iOS...the zero click iMessages one floored me.

In which case—if it’s a legitimate deficiency—that doesn’t bode well at all for any other commercial enterprise. This arms race is always tilted in favor of the attacker.

I remember some of early Android phones that ran manufacturer maintained Kernel turning out immune to then-undisclosed RCEs years before disclosure.I think it’s less about disclosure handling but more about being motivated to pay for or build a black magic code analysis tools.

The problem is not that cyber-security is hard, but that a trillion dollar company is incapable to handle security disclosures.

It really helps add some color to the motivations behind notorization. It seems ridiculous to me that I have to jump through so many hoops to run an executable that I trust. Especially when Apple can’t be bothered to follow up on real vulnerabilities that have already been reported.

Not to mention that there are still no mandatory security courses in CS curriculum at most major universities.

Cybersecurity is a genuinely hard problem, but stuff like this is dropping the ball entirely. It&#x27;s not hard to solve exploits like faulty permission-checking after they&#x27;ve been reported to you.Sure, there are always going to be problems you miss. I can forgive them shipping with zero-days, it happens. Failing to respond to reports is just that: failing.

i agree that we need to hold massive corporations to a higher standard, but security is incredibly difficult. this comment is more directed at all of the comments who are dismissive of how difficult good security is.even some of the sharpest security&#x2F;privacy minds on the planet, who work for organizations who exist purely to make secure software or hardware stumble often.now add in that we actually expect our devices to also be usable, and yes, security is very very _very_ difficult.if someone hasn’t learned by now that every device will eventually be cracked, we should question their ability to reason.now again, we should absolutely expect more from apple&#x2F;google&#x2F;$company than we do, but we also can’t hand-wave away that security is very hard.

Or better, we could stop making excuses for trillion-dollar companies with terrible security practices.

I don’t think of my devices as being hack-proof, but as being the best set of trade-offs for me personally between security, privacy, usability, etc.

i’m not sure anyone who is at least semi-informed believes their devices to be hackproof.it’s more likely they’ve considered which security issues they’re personally concerned about and decided the other choices are as bad or worse.once we actually dig into the specifics of an issue–especially one as complicated as personal threat models combined with actual usability–it’s rarely a “my device is now unhackable” cartoon caricature.

Apple makes ridiculous amount of money, and many Apple fanboys I know believe their devices are hack-proof.

Because it makes developing new features slightly slower and that is for mostly stupid reasons deemed unacceptable.

&gt; The problem is that cybersecurity is ridiculous hard problem.This is why I wonder why &quot;minimize your data exposure&quot; is such a controversial opinion.

The other day I tried to update my Macbook over a personal hotspot and it happily downloaded about 2GB before the computer went to sleep and I was greeted with a &quot;Whoopsie, failed to download the update, try again&quot; message when I woke it and, of course, it would just start over again. They don&#x27;t even support resuming the download! That&#x27;s just embarrassing.

Microsoft has been all over the cyber security news due to their repeat vulnerabilities in Exchange and Azure AND the way they have handled disclosures made to them

&gt; but iOS updates can’t be done on 4G&gt; This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandmaIn too many countries, mobile data is incredibly expensive. If Apple were to allow over-the-air OS updates, you can bet it would take only a week until the first class-action lawsuit by people having their data caps blown through because they did not understand that updates are huge.

Apple&#x27;s entire bug reporting system has always been massively dysfunctional. It is little surprise this extends to their handling of externally reported security issues as well.

&gt; my grandma doesn’t have WiFiTech workers have difficulty taking into consideration lifestyles they don&#x27;t know exist, which is understandable. At the end of the day this comes as another consequence of the lack of diversity in tech, I guess.

&gt; instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari...&quot;Your comment seems to be implying that Apple could simply ship the delta in the source code: i.e. something like `git diff --minimal --word-diff=porcelain head^1`. Would this not require iOS to be compiled on the device, and store its own source code, à la `.git`? How would you address the issue of the compiler itself needing to be updated as part of this process?Or are you suggesting they would ship the diff for the binary? For one, I don&#x27;t think the delta in the resulting binary would be as small as the delta in the source, due to addresses changing, etc. There are tools like bsdiff which can &#x27;intelligently&#x27; handle this, but I believe they aren&#x27;t widely used for operating system updates, as opposed to standard userspace binaries.In addition to this, the diff shipped would be relative to whatever version the device is currently using, which would necessitate storing a very large number of diffs, especially for binaries, or else computing it on the fly (which simply shifts the burden from disk space to CPU cycles).Or have I misunderstood you entirely?

&gt; I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly)Print Nightmare was part of a risky call in the printing subsystem design which was recognized as such when they made it in the 90s. That specific vulnerability was disclosed to Microsoft in 2020, accidentally disclosed in public in June, flailed at with incomplete patches and bad documentation all summer while ransomware gangs exploited it, and has theoretically finally been patched in the September release following multiple incomplete patches.The Exchange auto discover bug announced yesterday had previously been reported with Microsoft telling the reporter that it wasn’t a bug. Oops.This is hard but it’s also important to remember that this is an industry-wide failure because it’s been cheaper to clean afterwards than invest in proactive cleanup of old “stable” code, and it will likely continue as long as there are no financial consequences for a breach. Adding consequences would change that dynamic but would also be a massive change to the industry. It could endanger open source and would almost certainly make everything more expensive.

I hate blaming people and pointing fingers. It seems to me, that the current CEO, who was the CFO at the same company before, would be well advised to drop the &quot;numbers &amp; metrics&quot; MBA mindset.Written five years ago but sadly still relevant: <a href="https:&#x2F;&#x2F;steveblank.com&#x2F;2016&#x2F;10&#x2F;24&#x2F;why-tim-cook-is-steve-ballmer-and-why-he-still-has-his-job-at-apple&#x2F;" rel="nofollow">https:&#x2F;&#x2F;steveblank.com&#x2F;2016&#x2F;10&#x2F;24&#x2F;why-tim-cook-is-steve-ball...</a>

Depending on her data plan, downloading several  tens of gigs over her 4G could have resulted in a rather exciting phone bill.

&gt; “you need a 3GB OS update even if the only fix is 3 lines of code in Safari,...”,If Apple really cared, it would have changed this scenario by now. A 7year old android device which can download&#x2F;sideload latest Firefox is technically more secure for web browsing than an latest iOS device which is yet to receive an OS update with the critical patch for the Safari.But as Tim Cook proudly claims, People who use Apple products are those &#x27;don&#x27;t want to take risky decisions themselves&#x27; maybe they&#x27;d be willing to wait for that OS update however long it takes.

This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari, but we don’t push updates when ready since we don’t want to cause update fatigue, so you’ll need to wait 4 weeks for the fix to come in the next programmed OS update”, and so much more. Even Android seems decent security-wise, since many of the processes that would cause security concerns get updated through Play Store, even in really old phones.Another example: my grandma doesn’t have WiFi, and I bought her an iPhone, but iOS updates can’t be done on 4G, which can only be bypassed by internet-tethering a computer (which she doesn’t have), downloading the full IPSW, and installing it. She was on iOS 14.0 until 2 weeks ago when I fixed it. And with Safari being, according to security researchers, much less secure than Chrome, that makes me shudder. This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma, and Apple’s poor security design leaves her vulnerable for zero good technical reason, where Android wouldn’t. (They just dropped Google Play Services support for Jelly Bean a few months ago, so even an old Android phone would be reasonably secure). Caring about security requires thinking of details like this.

Existing frameworks?Does anyone knows the technology stack Apple uses?

Have they considered asking security questions on interviews instead of algos?like you know, shitty performing algo can be always rewritten, leak or 0day cannot be reverted

The problem is that cybersecurity is ridiculous hard problem.Security is challenging, but there are lots of things we know how to do better that many software developers still aren&#x27;t doing. For example, if you&#x27;re still writing application-level software in an inherently dangerous programming language in 2021 and that application handles important data in a connected device, you&#x27;re part of the problem. If you ship a networked hardware product with a standard password for all devices or forget to disable the backdoor access used during development, if you use encryption or hashing methods that are known to be weak, etc. These things obviously won&#x27;t solve all security problems, but they are low-hanging fruit that is still being left on the tree far too often.

&gt; recently the wealthiest company on the planet … They could slow down their software development process, focus less on adding new features, and prioritize fewer security holes.My inner cynic¹ has a slightly different take on that: You don&#x27;t get to be the wealthiest company on the planet by doing the right thing at the expense of the profitable things.¹ He says, pretending it isn&#x27;t also his outer and all-consuming cynic!

&gt; The problem is that cybersecurity is ridiculous hard problem.This is hard for me to believe for a company the size of Apple. They were recently the wealthiest company on the planet and are worth over a trillion dollars IIRC. They could slow down their software development process, focus less on adding new features, and prioritize fewer security holes. It seems like such a huge risk to them that their devices are basically always vulnerable. But the general public never really hear about these 0-days so they may have some ability to ignore the problem.The cynic in me imagines that someone at Apple knows about these bugs and they are shared with spooks for exploitation. One could imagine that even for a responsible disclosure program, they could share details of every new vulnerability with some three letter agency who could have months of use out of them before a patch is finally released.

If companies respected and paid platform&#x2F;architecture engineers, or SecOps&#x2F;SysAdmin types fair amounts of money and treated them with respect, instead of just throwing more and more money at hordes of mindless devs who are &quot;pushing product&quot;, as virtually every single company does, maybe this problem wouldn&#x27;t exist.I&#x27;ve had this conversation too many times. Security isn&#x27;t hard, it&#x27;s just that nobody has respect for it. The guy who understands software security isn&#x27;t getting the respect he deserves. The situation is so bad, some companies are literally hiring people who know the equivalent of script kiddie &quot;penetration-testing&quot;.Pay security engineers enough and listen very carefully to what they have to say. Literally the only companies who seem to understand this basic concept seem to be the intelligence agencies, and a few other high profile companies.

&gt; The problem is that cybersecurity is ridiculous hard problem.I don&#x27;t believe that. Making perfectly secure software at large scale is indeed very hard, but a lot of security issues we see every day have little to do with lack of perfection. There&#x27;s a ton of low hanging fruit out there.&gt; The junior to senior developers are just using existing frameworks with poor documentation.Yes, I do believe that the modern way of quickly ducktaping junk together while paying little attention to security does make for lots of security issues, which might give someone the impression that cybersecurity is ridiculously hard.Security requires proactive effort. It&#x27;s not ridiculously hard, but it needs to be done, it requires time (just as anything). Leaving it for &quot;hope you don&#x27;t write buggy code&quot; and &quot;does colleague notice the gaping hole in code review&quot; is not doing security, it&#x27;s just winging it.And I&#x27;ve never really been asked to do security, even when literally working on a security product. Everyone just seems to assume security is an automatic byproduct of skilled programming, but it&#x27;s not when the pressing concern is &quot;how many hours&#x2F;days&#x2F;.. does it take to ship this new feature oh and we have three dozen other features that need to be implemented soon&quot; and &quot;can we get it sooner?&quot; and &quot;why is it taking so long, it&#x27;s not that hard!&quot;It needs to be discussed, planned, designed, reviewed, tested, verified, questioned, audited. Just like anything else, if you want quality. None of this is ridiculously hard, but it needs to be done for it to be done. If it&#x27;s not being done, it&#x27;s that the organization doesn&#x27;t care about it.In a lot of ways it&#x27;s similar to technical debt. Are you taking the time to avoid it, reduce it, get rid of it? No? Then you&#x27;re accumulating it. Security issues accumulate just like technical debt when ignored. And even the most skilled programmers do generate technical debt (because they don&#x27;t jump into a problem with perfect knowledge of what needs to be done). Depending on the organization, they may or may not get to fix it. Many organizations just don&#x27;t care and would rather have the devs work on something &quot;more productive.&quot;

You talk as if the Apple engineers couldn&#x27;t have fixed those 3 vulnerabilities in half a year because it&#x27;s too difficult for them...

&gt; It&#x27;s the same never-ending war as anti-cheat vs cheat.Building secure software and building anti-cheat are nothing alike.Anti-cheat is fundamentally impossible (on a true general purpose computer) because you’re building software that has to run in an environment where it can be dissected and modified.Building a secure device (something which has to satisfy certain security properties for all inputs through a constrained API) is fundamentally possible. We’re just too lazy and cheap to do it. I don’t even think it’s “ridiculously hard” - we would just have to spend more money on correct by construction designs, formal methods, etc instead of spending money on flashy UIs and random features no one cares about.The number of employees at Apple working on security is vanishingly small compared to the number of employees, say, working on random siri features. And the way they approach security in many apps is also wrong. Instead of having people with formal correctness backgrounds designing the APIs against which apps are built, they just have developers with no security background putting everything together and then have a few security people trying to pick up the pieces.

Entitlements are great, right up until someone has to start manually deciding what access to give. After being blocked or questioned by the OS a handful of times, people are going to either disable the security or effectively disable it with wildcard matches.

It would really help a lot if:(1) We used safe languages like Go, Rust, C#, Java, and Swift instead of 1970s YOLO languages like C and C++.(2) Our operating systems were designed from the ground up to be secure in a modern environment.Unix (all flavors) and Windows were both built long before security was anywhere near as much of a concern as it is today. Their security posture is very lax by modern standards. Applications have a ton of permissions by default including seeing the whole network and filesystem. Everything runs with only basic memory isolation. Everything has access to an enormous system call surface area.It is extremely hard to apply security in retrospect to an insecure system, especially a complex one with lots of legacy support requirements. You are going to be playing a whole lot of &quot;whack a mole.&quot;A modern secure OS would begin with the principle of least privilege and be built from the ground up to isolate applications as much as possible from anything they are not entitled to access.Oddly enough the web browser might be the best attempt. When you browse the web you are basically swimming in malware, and you are relatively safe.

Don&#x27;t apple make the frameworks they use? Im pretty sure they could just patch them when they are notified of a vulnerability.

On anything other than trivial examples it is an impossible problem. Given the gigabyte of code on iphones (and android) it&#x27;s even more impossible. Best you can do is put an emphasis on quickly fixing any issues found and to practice security hardening. It seems iphone is failing on this pretty hard currently since they didn&#x27;t fix these errors that were handed to them on a silver platter.

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any consumer technology will be beaten to submission.It&#x27;s the same never-ending war as anti-cheat vs cheat.

Yeah, I quoted it myself. My point is that the article is formatted in a confusing way. It&#x27;s formatted into 4 vulnerabilities, but only 1 of them has a timeline, which immediately made me wonder why there weren&#x27;t 3 more timelines.Even though I read the sentence at the beginning saying the author reported all 4 to Apple, when I saw there was a reporting timeline on 1 vuln but not the other 3 I started doubting my own memory and thought maybe the author only reported 1 vuln to Apple. I had to go back and re-read the first paragraph again to reassure myself that all 4 were reported to Apple.

The second sentence of the article gives a sufficient timeline.&gt; I&#x27;ve reported four 0-day vulnerabilities this year between March 10 and May 4So the vulnerabilities were reported at least 140 days ago. He also mentions 3 upgrades of iOS were published after his reports.

Props to the author. One small critique though:&gt; I&#x27;ve reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7It would have been clearer if in each of the 4 vulnerabilities the timeline was given. The article only gives a timeline for the last vuln (the fixed one).

All the hard working security researchers are this much appreciated by the rotten Apple.

Does this rise to the level of a class action lawsuit? Especially if I theoretically started receiving spam texts with more personal info (my name, contacts’ names) in them starting about seven hours ago?I haven’t, I’m just curious.

At some point Apple has to realize their bounty program as its currently being run is tarnishing their privacy branding.

Probably means they make &quot;good looking&quot; products. But underneath the hood, it&#x27;s spaghetti.

Actually, these vulnerabilities are good evidence that Apple does not make excellent products.

I really hate the path Apple is taking. They make excellent products, really the average Joe simply loves Apple products. But they need to stop acting anti-consumer and anti-developer to “protect” their IP. At this point they could release the schematics of iPhone 13 and still people will buy Apple’s iPhone than someone who copied them. Rant over.

I don&#x27;t know why you&#x27;re being downvoted. My mind immediately went to this, given the relative obviousness of the exploits (compared to the massive supercomputer fuzzing runs done by Project Zero &amp;c), and given their refusal to either document or fix these serious vulnerabilities in several releases.

Apple might have left these vulnerabilities for Pegasus like softwares including the sotfware used by FBI and other agencies.

As bad as this is for people who use iOS, I think it&#x27;s good in the long run.People here are getting boggled down in details about how is it possible for this to happen and what sort of policies apple has internally for it to be possible, but that doesn&#x27;t really matter. Any company even 10% the size of APple should not be given the benefit of the doubt because obviously they&#x27;d all prefer not to have the major&#x2F;minor embarrassment, if they can. Bounty programs exist not because they care about security of their customers only, but it&#x27;s also a way to promote the company as security-conscious and avoid having 0days sold on the black market.But to overcome this you can just continue publishing 0-days straight to the public. Put really easy to use sourcecode on github&#x2F;bucket&#x2F;srht&#x2F;etc... allowing script-kiddies and copy-pasters to make use of them easily. This will either drive people to lose trust or force Apple to scramble to release fixes, either way it will push them to respect researchers and fix their bounty program or setup better security guidelines in general.Props to the author for following through and releasing.

What&#x27;s funny about it is that apparently some of their WatchOS&#x2F;device combos have FIPS 140-2 and FIPS 140-3 certifications. Pretty useless security theatre if you then shuffle the data around to other operating systems or into arbitrary servers with complex infrastructures.

Not if your API design is so bad that any third party can access them, apparently.Aside from that, I&#x27;m pretty sure they&#x27;ll also get stored on their servers, if you have not declined all the nagging iCloud sync requests.

Isn&#x27;t it better to persist medical data on the device rather than putting it on Apple&#x27;s servers?

&gt; menstrual cycle length, biological sex and age, whether user is logging sexual activity, cervical mucus quality, etc.These are hardly data collected by Apple Watch, unless someone is being inventive with one. These come from HealthKit. Which is alarming as HealthKit can also sync your EHR from health providers.

Diagnostic data is a category of medical data. So yes, that stuff is considering medical data.

According to the GDPR health data is a special category that needs extra care and heart rate falls in that category:&quot;Information derived from the testing or examination of a body part or bodily substance&quot;

Even if &quot;health data&quot; and &quot;medical data&quot; aren&#x27;t synonymous, it&#x27;s a distinction without a difference to their privacy importance.

&gt; There is indeed heart rate tracking, but can we really label this data as medical?The detailed data (ECG level) is medical enough that devices that measure it are regulated. That’s why some features aren’t available in some countries.

I have some doubt with respect to whether what author claims is &quot;medical data&quot; is indeed medical. Practically speaking, the data he mentions seems like the things collected by Apple Watch and stored in the Health app. There is indeed heart rate tracking, but can we really label this data as medical? IMHO &quot;medical&quot; would relate more to professional diagnosis, treatment etc. which according to Apple is stored in an encrypted form [1]. Garmin devices also collect heart rate, sleep stats etc. and I have never thought of these as medical (health-related yes, but not medical). The line is thin though.Since you work in the industry, perhaps you could share your opinion how such data should be treated?[1] <a href="https:&#x2F;&#x2F;www.apple.com&#x2F;healthcare&#x2F;health-records&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.apple.com&#x2F;healthcare&#x2F;health-records&#x2F;</a>

Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way?I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?

One more reason why &quot;closed systems&quot; are not magically superior. Closed systems still have vulnerability, and the culture that creates and maintains the closed system shuns those that find flaws in it. So much so that security researcher becomes, in their minds and practices, synonymous with black hat actors. Why would you report vulns to a company that doesn&#x27;t want it? Go sell it elsewhere and use that money to get a better device. Yet researchers persist, for the good of secure technology.

Apple is going downhill. It&#x27;s amazing how a trillion dollar company can&#x27;t even get this right. Wouldn&#x27;t be surprised if the IS&amp;T group is running the bounty program. Probably offshored to hell at this point.

Yep, here is a thread which has screenshots on the latest iOS update:
<a href="https:&#x2F;&#x2F;twitter.com&#x2F;keleftheriou&#x2F;status&#x2F;1441252412061204486" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;keleftheriou&#x2F;status&#x2F;1441252412061204486</a>

Has anyone on HN been able to run any of these 0-days to see if they work on their device?

Would you consider something like the PinePhone once it’s a bit more usable?

I realize you don&#x27;t mean it that way, but this comes off as a bit &#x27;whatabout-ish&#x27;.It doesn&#x27;t say absolutely anything abut other companies. It just says that Apple doesn&#x27;t take security nearly as seriously as their Marketing and Sales department would want us to believe.

Dumb phone might just be backdoored as well, how do you trust it? Do you have an open source dumb phone?

&gt; If Apple can&#x27;t handle properly disclosed vulnerabilities on their main revenue generating platform what does this say about other companies?It doesn&#x27;t say anything about other companies, it just says that Apple doesn&#x27;t give two shits about relationships with security researchers, despite their massive resources and wealth even when smaller or FOSS teams do much better. Apple are the king of user experience which made them insanely wealthy but that&#x27;s about it. In every other respect they are anti-consumer, anti-developer, anti-reparability, anti-researcher, anti-openness, anti-standardization AF and act like major a-holes in general to anyone outside their org who isn&#x27;t a customer.It&#x27;s not that Apple can&#x27;t be better on the other fronts if they actually wanted to, it&#x27;s that they actively choose not to be, as that has no impact on their stock price or consumer experience and in consequence to their executive pay. So why do things differently if people still buy your products?At this point, I wouldn&#x27;t be surprised if the &quot;Apple is more secure and has less vulnerabilities&quot; moniker just stems form researchers getting tired of dealing with Apple&#x27;s BS of not acknowledging or paying them, so instead they just keep quiet and sell the 0-days they find on the exploit markets (hard working honest researchers still need to eat and pay rent) only for those exploits to later end up in the hands of shady companies like NSO or nation states, therefore leading to no news in the mainstream media about Apple related vulnerabilities. Win-win for Apple I guess.

If Apple can&#x27;t handle properly disclosed vulnerabilities on their main revenue generating platform what does this say about other companies? Nothing good I&#x27;m afraid.Meanwhile the contact list on my dumbphone is perfectly safe. Time and again that&#x27;s been proven to be the right decision, convenience seems to trump security in the eyes of many but I just don&#x27;t want to give this up until there is a &#x27;cloud free&#x27; smartphone.

I am seriously considering throwing my $800 phone at a concrete wall.

FYI, it&#x27;s &quot;kowtow&quot;, not &quot;cow tail&quot;.Also, it&#x27;s &quot;This makes it immediately available to exploit before a fix can even _theoretically_ be developed&quot;, not &quot;This places pressure on the corporation to fix it immediately&quot;.

&gt; My actions are in accordance with responsible disclosure guidelines (Google Project Zero discloses vulnerabilities in 90 days after reporting them to vendor, ZDI - in 120). I have waited much longer, up to half a year in one case.&quot;Responsible&quot; disclosure guidelines only benefit corporations. They do not protect consumers. Why should independent researchers - working for free, no less (and sorry, the well-below-minimum-wage pittance that is most bounties does not count as not working for free) have to cow tail to corporate guidelines?If you find a vulnerability, do everyone a favor and disclose it immediately. This places pressure on the corporation to fix it immediately, instead of ignoring it indefinitely.

Thanks to @illusionofchaos for sticking to responsible disclosure and putting themselves under legal risk for the benefit of Apple&#x27;s users.Who knows if any of these are exploited in the wild already (Pegasus, etc) and by whom.

&gt; This is a complete myth.No, it isn&#x27;t. Snow Leopard was awesome. Mavericks was also pretty solid. In fact, I&#x27;m still running that on my machines today.

None? I had an iPod Touch that lived in my glovebox for 9 years and it never died. My Rio Karma on the other hand basically disintegrated. Thanks for asking!

I&#x27;ve never even heard of a broken iPod, who are these people that have several lying around?

&gt; Apple used to be the company that made devices that were secure and &quot;just worked&quot;.This is a complete myth. In fact, not only did Apple devices break all the time, but they were near-impossible for regular users to repair on their own. A simple proof: how many broken iPods did people used to have lying around?

They might&#x27;ve sliced it into two parts on macOS, but it&#x27;s still iTunes, with all the issues iTunes had.

Sadly, Apple always gives the &quot;latest and greatest&quot; version all the security updates, and is more selective about backports, see here: <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-gb&#x2F;HT212814" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-gb&#x2F;HT212814</a> for stuff you&#x27;re unprotected from if you stay on iOS 14.This includes arbitrary code execution with kernel privileges.This has been the case for a long time for Apple, which forced me to break my Catalina boycott (remember the macOS Vista stories here?) because I don&#x27;t want unfixed, publicized 0days on my machine.

Here, I&#x27;ll save you the trouble: download the iOS 14.8 IPSW for your device, and then in the Finder when your device is connected hold down the option key and hit &quot;Update&quot;. Then select the IPSW and it&#x27;ll update your device with that.

You can download the IPSW from ipsw.me (you actually grab the file straight from Apple and it&#x27;s digitally signed, so the malware risk is zero) and perform the update yourself by option-clicking the Update button in the iPhone window in Finder.

After the disclosure of the last critical 0-day, I went to update the OS is my four iDevices. I upgraded three of them to iOS 14.8 with no trouble, but when I went to update the fourth it wouldn&#x27;t let me update to 14.8 but rather only offered me the option of upgrading to 15.0. I didn&#x27;t want to upgrade to 15.0, so I called Apple support and the first-line tech said, &quot;Oh, I can definitely help you with that.&quot; I thought to myself that I&#x27;d give long odds against, but let&#x27;s wait and see. Long story short, the matter has now been escalated two levels and is still not resolved. Funny side-story: at one point the first-tier tech suggested I try upgrading the phone using iTunes. iTunes has not existed in MacOS for quite a while now. The way you talk to iDevices now is through the Finder (which actually makes a lot more sense), but apparently their tech support didn&#x27;t get the memo.Apple used to be the company that made devices that were secure and &quot;just worked&quot;. Now they are as bad as Microsoft in the bad old days, and no one makes computers that &quot;just work&quot; any more.:-(

normally I&#x27;d define it as something found in the wild being exploited already ... not a bug thats been found, reported and &quot;ignored&quot;this seems to be a zero day just because Apple haven&#x27;t seen fit to respond the the reporter

What is your definition of 0-day? Because they are exactly right, this is a 0-day. Whether it&#x27;s already actively being exploited or not has no bearing on the definition.I&#x27;ll refer you to <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Zero-day_(computing)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Zero-day_(computing)</a> to make up your own mind.

A zero day is a zero day, regardless of whether it&#x27;s been exploited in the wild. There&#x27;s a decent chance that well-funded bad actors have already found these, and you have no idea whether they&#x27;ve been used or not.

0-day ... what they mean is .... I found an issue. Its hardly a 0-day, they&#x27;ve not posted any evidence of it actually being used in the wild, just that &quot;it can be used&quot;.
Why is a normal &quot;ooh look a bug or two&quot; all of a sudden hair on fire world is burning news.... oh yeh ... I get more attention this way by exaggeratingApple may have a terrible bug bounty and response process ... but call a spade a spade... I saw a bird this morning ... help theres dinosaurs on the loose!!!!

I suspect when Apple doesn&#x27;t want to pay the bug bounty, they just ignore it.

With such a successful privacy marketing campaign, Apple doesn&#x27;t really need to care about security anymore to make boatloads of money. The public is mislead into thinking iPhones are secure and news outlets won&#x27;t report on these minutiae.

It would probably take the exploitation of a security hole in Apple&#x27;s systems to find out, as they clearly have no desire nor incentive to do this.Is it odd that I&#x27;m now hoping this might happen while also hoping for them to start patching up security holes?Edit: typo

&gt; In my understanding they receive the full source code of an app for reviewI did not know that, is that even legal that Apple gets to look at your IP.

Apple doesn&#x27;t get your app&#x27;s source code when reviewing it, they just receive the binary.

Furthermore, no one stops you from developing an app and planting RCE vulnerability inside the binary. Then you can exploit it remotely when necessary and execute the code that exploits any iOS vulnerabilities known to you.

There is no way they could prove that an app HASN&#x27;T exploited this. They don&#x27;t get source code, only compiled binaries, and with objective-c&#x27;s extremely dynamic nature, any app could technically receive a HTTP response containing strings containing class and method names to dynamically look up and invoke, maybe even based on the app&#x27;s IP address or only on specific dates. So calls to these exploitable APIs could have happened and there would be no way to prove otherwise.

Can Apple retroactively identify apps that might have exploited these vulnerabilities to exfiltrate personal data? In my understanding they receive the full source code of an app for review, so they probably have an archive with all revisions that they could go through using automated tools to identify exploit code? Would be good to know if these exploits have been used in the wild, being able to exfiltrate the entire address book without any user involvement whatsoever is quite scary.

Disclosure of three 0-day iOS vulnerabilities