Hacker News Reader

Comment by raspasov | Hacker News Reader

I am not able to compile the first two of these (after the first two I stopped trying) with the newest Xcode on iOS 15.0. I haven't tried the other two or older tools.

The source code as given also had syntax errors in it.

View on HN

Follow the links to GitHub, the code there compiles perfectly, the PoC inside the article is just a shortened version

Thank you for the explanation! Will give it a shot.

P.S. Yes it works! Perhaps add a comments in the short version where it says

//This shortened version does not compile, use the GitHub version of the code

It said "proof-of-concept" and I generally expect PoC to work as presented. My bad for not reading everything carefully.

Good idea, I've added the comment

Just curious, what kind of compilation error are you getting?

'init(machServiceName:options:)' is unavailable in iOS

This is just a check built into Xcode to try to keep you from accessing XPC in iOS. The code on GitHub bypasses this by calling this method dynamically through Objective-C runtime

This makes one question whether there really are any security vulnerabilities at all. Perhaps Apple isn’t fixing these because there’s nothing to fix? I don’t know enough to say whether these vulnerabilities are real or not.

The Gamed 0-day compiles just fine. I can run it on my iPhone with iOS 14.8 and it shows 300 contact information gathered apparently from various sources without me giving any permission at all.

Which XCode version are you using to compile?

12.5.1

I am on 13.0, perhaps they fixed it because I can't compile on older iOS versions with XCode 13.0 .

PS I was wrong, it works. See the comments above.

maybe they 'fixed' it by not allowing any app of this kind (specific Api call) in the appstore? wouldn't challenge you to try and publish an example app though...

This is trivial to bypass

Reply on news.ycombinator.com