Apple patches “clickless” 0-day image processing vulnerability in iOS, macOS

Dup of https://news.ycombinator.com/item?id=37428817

Just your regular reminder that for the only security certification Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security, EAL1. A level only fit for products where [3]: “some confidence in correct operation is required, but the threats to security are not viewed as serious” which does not even require “demonstrating resistance to penetration attackers with a basic attack potential”. Four full levels below “demonstrating resistance to penetration attackers with a moderate attack potential”[4].

Is it any wonder that a company which has continuously failed for decades to certify resistance against moderate threats keeps getting their security completely invalidated by moderate threats? It should not be; they positively certify for sure that they are useless against them.

Until they can prove any non-trivial product of theirs can protect against moderate attackers, their claims about security of any form are extraordinary claims and thus demand extraordinary evidence (like certification proof). I am not holding my breath.

[1] https://support.apple.com/guide/certifications/ios-security-...

[2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE...

[3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR...

[4] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR...