Hacker News Reader

> It is new software added to old stack and made to gell with it. That 'gluing' process churns up new security issues.

Perhaps I'm misunderstanding you, but this is not really correct. Most vulnerabilities are not regressions.

Attention is what makes security issues discoverable, and popularity is what makes exploits valuable serious enough to warrant attention. The more popular software is, the more attention it gets from the security community (both black and white hat). The more popular software is, the higher the impact of an exploit is. The more popular the software is, the more significant the response is.

That doesn't mean older software is secure, or that it can't be exploited. It just means nobody is really looking at it. Fairly often, security alerts come up for software that doesn't list older releases because they didn't bother to check their EoL releases not because they're unaffected.

Take the Print Spooler vulnerability on Windows, or the ShellShock exploit in bash, or the Apache Log4j 2.x vulnerability. These vulnerabilities are all so old that they essentially work on any version of the affected software, including those that are more than a decade old for which no fix was even planned. Like the ShellShock bug in bash was found to go back to bash 1.03 released in 1989.

As long as you have an earlier version of software that was later found to be vulnerable, you should assume that it is unless you've explicitly investigated the vulnerability and found otherwise.

I guess the question then are there any attackers bothering to target that old software. We’re not in the era where there were millions of users living on unpatched out outdated versions of Windows XP anymore. Would malicious actors attack an iPhone 8?

> Would malicious actors attack an iPhone 8

It depends. The iPhone 8 might belong to someone they’re interested in for reasons as mundane as being a control freak and the iPhone belongs to their partner. Or just someone that annoyed them on the internet.

Or the attack might woken across all device generations in the same way. Then no specific targeting would be required and the phone owner gets caught in the net like all other unpatched versions, except they never had a chance to fix the issue.

Sweet summer child...

The military extensively uses older OS versions, which means they are very much targets.

The UK's new HMS Queen Elizabeth aircraft carrier uses windows XP.

It’s interesting how such a wise comment can be completely ruined by your first sentence.

Why is that? The phrase and intended meaning (innocent, potentially to the point of being naive) is 200-ish years old.

It fits the sentiment perfectly. Developers who exclusively think in terms of commercial internet are prone to thinking that everyone uses up-to-date browsers, and therefore OSs.

The world is actually messier than that common misconception.

It fits rather well.

Whatever alleged origin of that quote is, its present identity has been dominated by the TV show, which isn’t even current anymore and ended so poorly that its cultural cachet has eroded. But mostly it’s condescending as hell and thus marks the user as someone who both trafficks in cliches and enjoys patronizing others.

What tv show?

Pretty sure it was referenced in Game of Thrones which introduced it to a whole new group of people, typically more online than the origins of the phrase, and popularized it's use on Reddit/Twitter for being a hilarious and original way to condescend people

> a hilarious and original way

Well, it was.

The military is very good at physical security.

Huge difference to iPhones: they're not connected to the open internet for browsing, downloading files, receiving messages or email.

(The US Navy also has a support contract beyond end-of-life for XP versions, even still as of 2022, for a handful of their own programs on warships, because it's too much expense and delay of recertifying on new PCs. https://www.quora.com/Is-the-U-S-Navy-still-using-Windows-XP and other sources.)

https://www.quora.com/Is-the-U-S-Navy-still-using-Windows-XP )

If your an activist, journalist, politician or CEO, yes you could be targeted specifically.

But 99.99% don't belong to this category, and don't really need same level of caution.

A close relative has an iPhone 8, so, absolutely, I believe there are probably millions of them in the wild and they'd be child's play to compromise.

If you are in the business of compromising, why would you not?

an iphone 8 can run ios 16, last updated Sept 21, 2023, less than a month ago https://en.wikipedia.org/wiki/IOS_version_history & https://en.wikipedia.org/wiki/IPhone_8

I don't think Apple's patching every major security flaw on current - 1, but right at this moment, they're still able to run n - 1, which would probably put them roughly on par with the average on smartphone security, so I don't think it would be especially any more child's play than compromising an average phone, all things being equal (all things being equal, some people update, some don't; the iphone 8 on the latest iOS 16 is probably better than a later model lagged 3 years on updates)

Although it's all downhill from here.

I run an iPhone8. As of now, it's running iOS 16.7 (20H19).

I know it won't install iOS 17. So I figure I have about 12 months more of reasonable security updates. At this point, I'll likely get an iPhone SE 3rd generation to replace it.

My work phone is an an iPhone 8. Employer provided. Most likely to be replaced pretty soon.

Except that iMessage is a perpetual source of security concerns. Once that becomes unsupported, you’ll likely have exploitable code, where the exploit is publicly and widely known (but patched on newer versions).

The obvious workaround is to just disable iMessage and use an alternative messaging app that stays up to date on the App Store.

That probably wont help. If the vulnerability is in the PNG renderer, then Signal is also vulnerable as they also show you a preview.

If the vulnerability is within the PNG renderer, then wouldn't all text messaging (not just iMessage) be effected?

As I recall, the disclosures of major vulnerabilities in iMessage don't say that regular SMS messaging is effected.

I think all the reports just say "iMessage" and don't specifically note sms vs iMessage specifically. It's entirely possible that there a carrier side restrictions on allowed image formats, and of course these attackers don't want people to see their exploits and definitionally using sms would allow just that.

But also, in answer to the question: yes, every messaging app on Mac or iOS that could display webp was susceptible to this exploit. If they use ImageIO then the OS update fixes them, if they use their own copy of libwebp they are exploitable until they ship an updated version.

For the recent WebP exploit, IIRC no preview render was even required to trigger it; simply receiving the message was sufficient. The exploit was triggered by a code path in Blastdoor that headlessly rendered the malicious WebP that was embedded within a Passkit attachment.

(But I can't find a source for this atm. I remember reading it somewhere, but maybe I'm confusing it with a previous Blastdoor exploit.)

> For the recent WebP exploit, IIRC no preview render was even required to trigger it; simply receiving the message was sufficient.

It was triggered because the system shows a preview of the image by default.

Devices that had Lockdown Mode enabled no longer show preview images, so were not effected.

>Lockdown Mode is an extreme protection feature for iPhone. Its protections include safer wireless connectivity defaults, media handling, media sharing defaults, sandboxing, and network security optimizations.

https://support.apple.com/guide/iphone/use-lockdown-mode-iph...

> On September 7, 2023, Apple released emergency security updates to fix a buffer overflow vulnerability (CVE-2023-41064) impacting macOS, iOS, iPadOS, and watchOS products that was used in a zero-click exploitation chain by the NSO Group. Shortly after, on September 11, 2023, Google released an update to fix a buffer overflow vulnerability (CVE-2023-4863) in Google Chrome, which was reported by Apple’s Security Engineering and Architecture (SEAR) and Citizen Lab. Both vulnerabilities were nearly identical and listed as actively exploited, leading to confusion across the security community.

Note: Citizen Lab urges all at-risk users to enable Lockdown mode as this has been confirmed by Apple’s Security Engineering and Architecture team that Lockdown Mode blocks this particular attack.

https://arcticwolf.com/resources/blog/cve-2023-4863/

The attack was apparently via PassKit - a separate process entirely, because messages is explicitly hardened (the whole "blastdoor" (tm) thing is to deal with that). I'm not sure what the actual passkit APIs look like but in principle any app that would take an attacker provided image and send that to whatever process handles those passkit things would get the second order part of the attack. But of course some attacker trying to, for example, extract the messages from Signal or suchlike could start from code execution in the signal process.

iMessage is a "perpetual source of security concerns" because it is a remotely triggerable target. That's it.

If everyone is using message service X, then we'll start seeing more attacks on X.

The exploits we've seen over the last few years haven't been in iMessage the app, they've been in a host of different things. The most recent security brouhaha was apparently in the webp library[1] that also effected chrome, webkit, Firefox, every electron app, and I assume every app on android, iOS, macOS, that uses system image decoders, etc. But if you want a specific target then you aren't going to use something like a random webpage or phishing email if you have something that you can guarantee will go to only one device that you know is exploitable, and you can guarantee how it will be handled - i.e. the builtin system messaging apps.

[1] and even here the attack didn't happen from iMessage

I don't know if you're specifically referring to X, the artist formerly known as Twitter, but regardless, no; iMessage runs with unique privileges and capabilities that are not available to ordinary messaging services.

X is a common variable/placeholder like A, N or foo. Nobody is using it to refer to x.com unless it is a thread about Musk/Twitter

Like the other comment pointed out, I understood 'X' to mean a stand in for iMessage. It didn't occur to me that we were referring to FKA Twitter

No it doesn’t.

Sorry I forgot the most recent musk idiocy. X was a stand in for any other functionally always on and receiving service, messaging platforms are the primary example.

I'm actually now curious whether the various awful web notification standards allow images?

> I have a iPhone 8 which I use just to Facetime my MIL and receive her iMessages

You have an iPhone just to communicate with your MIL? you're surely the DIL or SIL of the year!

I’m not sure if your MIL is technical enough to do this, but you can receive FaceTime calls on the web now: https://support.apple.com/en-us/HT212619

I’m amazed how well my wife’s old 8 plus has held up.

Was one of the reasons I switched.