Frustrated dev drops three zero-day vulns affecting Apple iOS 15 after six-month wait

Upset with Apple's handling of its Security Bounty program, a bug researcher has released proof-of-concept exploit code for three zero-day vulnerabilities in Apple's newly released iOS 15 mobile operating system. The bug hunter, posting on Thursday to Russia-based IT blog Habr under the name IllusionOfChaos and to Twitter …

[bazza]

From the article:

"Apple's internal security team gets it, but at the higher up, cultural level, they've all drunk the Apple juice, and believe their way is the right way, and they don't need any external help."

Well, at the higher up cultural level, they're $trillion right.

Ordinarily I'd caveat that by saying that the higher up level was running a high risk, because they're only one very serious bug away from the entire empire falling down. However, things are so weird these days that I'm not convinced that even a major security bug leaking everyone's data and costing all Apply Pay users a ton of cash would do any actual net damage. What Apple's higher, cultural level is learning is that their customers really don't give a damn.

They done this kind of thing before of course; the very first iPhone came out with < 1 day battery life, in amongst a sea of what we'd now call "feature" phones that all had 2 weeks of battery life. Did anyone care that their phone now no longer stayed charged up? Nope. And then there was the iPhone 4, holding-it-wrong gate, and other foul ups where iPhones were incapable of roaming between cells on the same phone network. Did anyone care about any of that? Nope.

And that attitude then bleeds over into Android too. If Android is a bit shonky in some area or other, it's not like switching to Apple is going to give you a shonk-free ownership experience.

About the only thing I can think of that'd now bring down the Apple edifice is a "Ratner" moment, but even then I'd not bet on it.

[Anonymous Coward]

About the only thing I can think of that'd now bring down the Apple edifice is a "Ratner" moment, but even then I'd not bet on it.

I'd say that CSAM qualified as that, but it appears that there are still a few people who have common sense so they abandoned that - for now.

[Anonymous Coward]

Does a significant portion of Apple customers 1) know about the CSAM thing and 2) care enough to leave Apple? Until I see evidence otherwise, I would think the answer is no.

[Gene Cash]

> care enough to leave Apple

And where are they going to go? To shitty Android phones? There's a huge choice.

And I say that as an Android owner. Android 11 is a steaming pile of shit.

[martyn.hare]

They just need to care enough to turn off iCloud

After all, processing only occurs if you use iCloud Photos. MEGA, SpiderOak, NextCloud hosting and the like all come to mind, as they all offer end-to-end encryption and don’t support Apple’s fingerprinting methods.

If customers switch from iCloud to other services it kills a massive revenue stream for Apple, with no need to otherwise change platforms. After all, iTunes works on Windows for automatic wireless backups and Linux has libimobiledevice (or whatever they call it these days) which supports backup and restore.

Also, should that happen, the iMessage backdoor closes too, as Apple will no longer have copies of the keys via iCloud. That would actually make known CSAM easier to distribute, which is a key point that law enforcement must have surely considered when pressuring Apple to do this.

[Steve B]

Have to agree coming at it from the other way.

I have never been an Apple fan, but although the Android phone I have basically works, it is being taken over by Google.

I have to have a Google email and user, I have to divulge my date of birth, can they have my credit/debit card for Google pay or the Play store? etc. My battery is winding down at alarming rates even though I do nothing and it turns out to be Play Services running round doing the above, which I don't want.

All I want is a phone that can take photos and access the internet as well as make and receive calls or texts, why do they insist on this tie in?

I'm thinking of going huawei just for the break from Google and Apple.

As an old programmer, I still can't see how any of these companies continue to develop code with so many ridiculous bugs in, when our techniques from the 70s would have precluded most of them getting as far as the test phase even.

If I remember correctly, my company was probably the first to decide that writing an OS in a higher level language would give them a far greater developer base to draw from. They found out very quickly that they only benefit was that the higher level language and new developers allowed for quicker development of bugs so they had to rethink the hiring policy.

It was interesting to see later major companies falling into exactly the same development paths. I used to phone one and tell them their next big issue, it correlated so well.

MS and Apple have unfortunately not learned all the lessons.

[NATTtrash]

Re: Have to agree coming at it from the other way.

All I want is a phone that can take photos and access the internet as well as make and receive calls or texts, why do they insist on this tie in?

I'm a dumb phone person, but...

You could try one of the *nix ones. Saw that the Pine one isn't that bad. Or go budget, get a Sony one of FleaBay, play around with it and put SailFish or BuntuTouch on it.

It's not for me because I like charging once every three weeks too much, but as an old programmer this could be something for you...

[cyberdemon]

Re: Have to agree coming at it from the other way.

The Pinephone is not so good, sadly. :(

But I have had great success with a Fairphone 3 running "/e/" OS. (de-googled AOSP that works)

[sabroni]

Re: I'm thinking of going huawei just for the break from Google and Apple.

I did, It's an ok phone, charges in about an hour, lasts about 3 days (I seldom use the internet on it, it's a comms device), completely free of Google. If you can be arsed to get it setup and know the apks you need are available outside the play store I'd say go fo it!

[hoola]

Re: Have to agree coming at it from the other way.

Yes, I have noticed this as well, why the hell does Google need to persist in asking for my DOB. There is no way of declining it.

But. does this information have to be given as an Apple user?

Is it optional or forced?

I think Microsoft may be pushing it now as well.

I Apple already do this (and I am in no way saying it is acceptable) then it is just the others making a grab for the same data.

[snowpages]

Re: Have to agree coming at it from the other way.

Just a thought - you don't have to give them your REAL dob (as long as you remember which one you used for any later security questions).

[Anonymous Coward]

Re: Have to agree coming at it from the other way.

Precisely.

At some future point they might be able to identify my dob simply by ruling out all the dates I've given so far.

[DiViDeD]

Re: Have to agree coming at it from the other way.

Maybe things are different in Australia (I somehow doubt it), but I have used the same throwaway non google email address since my first Android phone (anyone remember the Dell Streak?), and Google do have a date of birth on record, but I'm not sure if it's anyone's actual date of birth as such.

And yes, they keep asking me if I'd like them to have my credit card details, but I keep hitting Skip.

And yes, I've been living at 18 Letsby Avenue for some years now.

[NoneSuch]

My Cynical Mind...

I'm of the opinion that some three letter US Government agency has a back door deal with Apple to have deliberate back doors in their OS so foreign people of interest who use iPhones can be pushed, filed, indexed, briefed, debriefed and numbered.

Yes, that is a Prisoner reference.

[Robert Carnegie]

Re: My Cynical Mind...

Thank god for that, but you left out chopped into little pieces or was that Samsung...

[Tom 7]

I think all Apple devices ceasing to work would not have much effect on them until another brand name can con people into believing they invented everything.

[Anonymous Coward]

So we're waiting for Elon Musk then?

[Anonymous Coward]

Pity that Apple don’t have Elon’s attitude to fixing things

It a very great pity that Apple don’t have Elon Musks attitude to fixing problems.

He would never allow know day-0 bugs to go unacknowledged and unfixed for months and months.

It shows a very shoddy attitude by the senior management, and will one day come to bite them unless they change their attitude and take security issues seriously.

[mevets]

Re: Pity that Apple don’t have Elon’s attitude to fixing things

What in the hell are you talking about? Musk's attitude to fixing problems is suing people. His every endeavour is mired in crapware.

1. Tesla -- worst vehicle by every measured standard except its adoring fanbase.

2. Rockets -- 50 year old NASA technology that already worked took 10 years to turn into 50 year old NASA technology that already worked.

3. Tubes - Oh yeah, the Vegas hyper loop is quite something.

4. PayPal - Oops, they got rid of all of elon's companies source code before launch.

The guy is a pan handler.

[EricB123]

Re: Pity that Apple don’t have Elon’s attitude to fixing things

I hope that was sarcasm, but fear it isn't.

[Anonymous Coward]

Re: Pity that Apple don’t have Elon’s attitude to fixing things

He would never allow know day-0 bugs to go unacknowledged and unfixed for months and months.

And yet, the fantastically bad build quality of Tesla's (which includes an auto-conversion to a cabrio on its first ride from the dealer forecourt due to the roof not at all being attached) remains unaddressed to the point that in some places in Europe they're organising to sue the company collectively.

And no, that isn't news - this has been building up since 2019 - so I'm not worshipping Musk like other people do. The man has a serious disregard for consequences if they don't directly affect himself.

[big_D]

The Java update debacle also didn't have any long lasting effect on Apple or its profitability.

Oracle release an update in January 2009, ISTR. It was passed onto every platform vendor and they all brought out a fixed update at the same time (Windows, Linux, Android etc.), only Apple sat on the security bugs... Until, nearly 6 months later, public voices were getting so loud, they finally got around to releasing the Java patch.

[tip pc]

Mitigation?

"The bugs are neat, but unlikely to be widely exploited," security researcher Patrick Wardle, founder of free security project Objective See and director of research at security biz Synack, told The Register. "Any app that attempted to (ab)use them would need to first be approved by Apple, via the iOS app Store."

Bug is present but not readily exploitable.

Just maybe it’s lower on their priority list?

More people are likely pissed about the intentional snooping than a potential issue if some rogue app dev decides to intentionally exploit a bug that gets through apples approval process.

[eldakka]

Re: Mitigation?

Just maybe it’s lower on their priority list?

If this was some open source project or a tin-pot 2 people in a garage or even an SME of 100 people I'd agree completely.

But for a trillion dollar company that made ~$105b in profit in 2020?

[Ace2]

Re: Mitigation?

Everything ships with known bugs. It doesn’t matter how much money they have, if the people who know how to fix the bug are all busy on something higher-priority.

Or I guess you could hire some of the Stack Overflow brigade to try to throw in a last-minute patch…

[ragnar]

Re: Mitigation?

I don't think that should be a get-out for a company as profitable as Apple though, at least when it comes to security bugs.

They could spend $100m to build an amazing security team that does nothing but handle bug bounties and *still* have made $105bn in profit. Hell, spend $1bn and make it $104bn in profit.

The resources they have access to are utterly mind-boggling and it's shameful they don't care enough about security to use it.

[hoola]

Re: Mitigation?

Everything to do with Apple is perceived to be high quality. The products are mostly no better than any other premium product but there is this aura of respectability and quality that far exceeds the actual product.

They have always been priced for what their intended market would stand. Apple then discovered that the market had very deep pockets so they could pretty much set prices to whatever they want.

The product also because a ubiquitous status symbol. Well the hell else did the laptops have an illuminated Apple on the top?

Just like other products such as Amtico, Corian and in my opinion Tesla, the actual manufacturing costs are not that great but are very cleverly marketed to create exclusivity and status.

Apple have just perfected more than anyone else and have a very willing market.

[Open Sauce]

Re: Mitigation?

The only thing Apple have perfected is bullshitting at an industrial scale and the only people that fall for it are ones that have more money than sense.

[Charlie Clark]

Re: Mitigation?

There have been several examples of apps with obfuscated code being accepted into the Apple store. Assume the three letter brigade are all over this already.

[Clausewitz 4.0]

Patience is gold

Patience is gold and is rewarded accordingly.

[redpawn]

Patience is its own reward

Consider yourself well paid. -Apple

[Anonymous Coward]

People like shiny branded shit

They don't care about security - see Apple, Google, Facebook, Alexa....

People are dumb, and the billionaires know it.

[Fruit and Nutcase]

Re: People like shiny branded shit

Veblen Goods?

https://en.m.wikipedia.org/wiki/Veblen_good

[cyberdemon]

Re: People like shiny branded shit

More like the Giffen Goods.. As in, it's not actually any better (if anything it's worse), it's just got a higher price tag so the idiots want it more

[cyberdemon]

Reluctant to patch

They've got customers using those features..

[Anonymous Coward]

Worms

Love apples

[anothercynic]

There are other issues...

In iOS that are a problem. Using a private certificate authority and want to limit it to enterprise WiFi (WPA-Enterprise/802.1x)? Good luck with that. Without a .mobileconfig you're screwed. Is Apple listening? Who knows.

[Anonymous Coward]

Really....

"To me, the bigger takeaway is that Apple is shipping iOS with known bugs," Wardle continued...

Anybody that makes a statement like that, either:

1) Knows nothing about how commercial software products are developed

2) Knows nothing about how commercial software products are released

3) Is just plain ignorant wihen it comes to software development

4) Has never been involved in any facet of commercial software development

'nuff said.

I've been on 100's of software development projects over the past 30+ years and not one of them didn't have a prioritized, known bug list at any given time (including one for a version having just been released). If a list doesn't exist, it just means either no one has bothered to create the list, or no one is looking. It does not indicate that the software doesn't have any bugs.

If a company waited to release commercial software with no known bugs, likely the company would go out of business, because it would never ship the software. Note: This doesn't apply to gubermint projects, they can be a whole different story...

[flayman]

Re: Really....

I think that the Director of research at security biz Synack most likely misspoke or that the context you've taken this quote out of acquits him. He goes on to say "And that security researchers are so frustrated by the Apple Bug Bounty program they are literally giving up on it, turning down (potential) money, to post free bugs online."

When you are the company with the largest market cap in the world and you will ship software with privacy busting security bugs that have been known to you for months and through several releases because a white hat took the time to hunt them down and report them, it's not a good look. The remainder of the statement suggests that the bug bounty program is just for show.

[trevorde]

Alternative to Apple Bug Bounty program

The Dark Web or NSA. And you get paid in BitCoin!

[Cuddles]

Zero-day

"I've reported four 0-day vulnerabilities"

Why do they keep being called zero-days here? The definition of a zero-day vulnerability is one that's being actively exploited in the wild before it is known to the legitimate producers/users of the software. If you've found a bug, it's just called a bug.