Exploit Market ‘Flooded’ with iOS Vulnerabilities | Hacker News Reader

Exploit Market ‘Flooded’ with iOS Vulnerabilities

9to5mac.com

61 pointselectic24 comments

Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered and talked about last week with the iOS exploits.

Google has been utterly quiet about it, and kept only talking about iOS exploits.

Certainly lots of security PR happening and this article is interestingly timed also.

> Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered

Volexity did [1], although it's not clear if the android exploits were hosted on the same sites that google was referencing.

[1]: https://www.volexity.com/blog/2019/09/02/digital-crackdown-l...

Thanks for sharing, that's a great resource! This at the grand scheme of things hasn't gotten much attention I think.

Google did not find any Android exploits.

It seems very unlikely that the majority system used (especially outside the US), would not be exploited - maybe they try to separate and say not the exact same webpage hosted Android exploits. But I havent seen any official statement from Project Zero that they have not found Android exploits as part of this campaign. Not even one that says, not the same page hosted Android exploits.

If you have a link, please share.

All I saw was this below. It says Google did not comment on the question officially:

https://www.forbes.com/sites/thomasbrewster/2019/09/01/iphon...

Here's a tweet from a member of Google TAG saying they didn't see any non-iOS exploits. https://twitter.com/itswillis/status/1168543167219716096

That same article has a quote from Microsoft:

> Google Project Zero was very specific in its blog post that the recently publicized attacks used unique iPhone exploits and they have not disclosed similar information to us,"

I would be rather surprised if Project Zero ran across new Windows exploits and did not notify Microsoft so I suspect that any exploits they found for Windows used known vulnerabilities.

This is the only public thing I can point to. See position and retweets. [1]

1. https://twitter.com/ShaneHuntley?s=09

Well, why would Google need to publicly shame themselves (e.g. 90 day ultimatum) to motivate a bug fix?

They can just fix the bug once they know about the vulnerability.

Does this mean that iOS is more or less just as secure/insecure as Android? I’m not much of a security expert but I continue using iOS under the assumption it was ‘safer’ than android

If ios is more secure, then there are less exploits. However higher payouts incentivise more researchers to find bugs, leading to more exploits. The free market in action.

I'm not expert, but my sense is that Android is open source (easier to find bugs) but memory safe (Java), whereas iOS is closed source but memory unsafe, and tooling is recently at the point where it's feasible to find many exploits despite not having source access, so the lack of memory safety is becoming more and more untenable over time.

According to the article the flood of exploits has more to do with iMessage and safari attack surface and not necessarily the OS.

That's what I was talking about too. The kernels of both have source available, Linux vs xnu.

But the userland of Android is mostly memory-safe Java, and the userland of iOS (e.g. iMessage) is mostly memory-unsafe ObjC. The kind of marshalling and memory management exploits described in the p0 posts are very unlikely to happen on the Android side.

Lots of android system/userland libraries are written in C or C++. Stagefright is but one example of a high impact vulnerability reachable from SMS/MMS on Android.

Android is a Linux kernel written in C, so it's memory unsafe there. The apps are in a Java-derivative, so they're memory safe. Chrome browser is not written in this language, so it's memory unsafe.

iOS is a Mach+XNU kernel written in C, so it's memory unsafe there. The apps are in Swift, so they're memory safe. Safari/Webkit is not written in this language, so it's memory unsafe.

The only real difference in security here is that Apple has had better sandboxing and security (hardware) implementations.

Android has better sandboxing for apps (Java virtual machine + process isolation + user isolation + se-linux + containers & virtualization in some cases). But the permission system is so badly designed it's almost wide open.

The hardware you are thinking of is mainly used for secure storage and crypto.

What's wrong with the permission system design ?

(agree otherwise on the refutal of GP, but curious about that point)

Old permissions were too broad. Need a file? Here is a permission to look at ALL files!

More restrictive permissions (and a new model where you don't need a permission but user decides what file to access) were added later but it takes time to get developers to change.

Android's hardware is extremely fractured with the majority of the devices sold being cheap and missing the good features, including hardware security.

Apple's phones are more homogeneous. Certainly a larger percentage of Apple users have a Secure Enclave than Android users do.

The article indicates that it's pretty much six of one and half a dozen of the other.

iOS is more of a monoculture compared to Android, so a successful exploit chain against the current version of iOS has the potential to affect quite a few more users.

On the other hand, the article states that Android is more fragmented, so a successful chain of exploits will likely affect fewer users. The article hints that "one-click" Android exploit chains are harder than iOS, and so are worth more at the moment.

It's interesting to me that a one-click compromise is so valuable given the supply-chain vulnerabilities [0] and ongoing "dodgy-app" issues [1]. Google just dropped a boatload of iOS issues, but they also just took care of nearly 200 issues, some long-standing and some critical in severity, within Android themselves [2].

It seems like declaring one as more secure than the other is more a game of hot-potato than anything.

[0] https://krebsonsecurity.com/2019/06/tracing-the-supply-chain... [1] https://nakedsecurity.sophos.com/2012/07/31/almost-every-and... [2] https://www.forbes.com/sites/daveywinder/2019/08/23/android-...

Executing a supply chain attack requires you to be in a pretty privileged position to start with. Most people can't just decide to do one, whereas most anyone can put up a malicious website or app.

You’ve already received sensible answers, but let me add that “Android” pretty much means a Google device here; an Android device that doesn’t get updates, or only after a long delay, is decidedly less secure.

Original source article:

https://www.vice.com/en_ca/article/mbmgqp/this-is-worst-year...

Reply on news.ycombinator.com