[flagged]
The people finding and building these chains are doing so as part of nation-state intelligence operations; they go well beyond what any reasonable civilian threat model contains.
Put another way: if someone in a competent nation state's IC decides that you're worth $10+ million dollars to compromise, they are going to get you. This is true whether you have an Android, an iPhone, or a Tamagotchi. The only thing that sets Apple apart here is that they've historically beaten Google to the punch on mitigations for these kinds of exploits. But from a threat modeling perspective, this attack is not comparable to the kind that most people have to deal with. Treating it as indicative of an overall security differentiator will not help you make ordinary security decisions, because anybody who gets this kind of attention will be Mossad'ed upon[2].
[1]: https://en.wikipedia.org/wiki/FORCEDENTRY
[2]: https://www.usenix.org/system/files/1401_08-12_mickens.pdf
It would be so great if someone at Apple could get the buy-in to clean out this zoo but try explaining that to a product manager at these places.
It’s happening! Admittedly it’s happening slowly, but it is happening. PostScript support recently got stripped out of MacOS and iOS explicitly because the security risk was too great, and effort to make parsers and renders safe was greater than any residual benefit from the postscript format.
It also looks like the “fix” for one for the TrueType exploit was to simply strip out the ancient extension because it’s not used anymore. As for why it didn’t happen before now, that probably just because nobody knew it still existed.
Neither is "going to get you" a given, maybe another agency is in charge of the alternative methods of getting you, and they have different priorities that doesn't include your target (or alternative ways are much more expensive or too slow to be worth it)
99.99% of the world lives in threat model 1; our goal as security minded people is to protect these people. These people want general purpose networked computers in their pockets.
0.01% of the world lives in threat model 2; our goal is also to protect these people. But these people don't get protected while also having general purpose networked computers in their pockets.
Both groups are civilians, and both deserve security. But they also have different demands; if Apple forced Lockdown Mode's usability restrictions onto a billion people tomorrow, a large percentage of them would switch to materially less secure hardware and software vendors.
From the inside of the status quo, those threat models, well-informed reasoning, the descriptions of hierarchy, and what “should” and “should not” be possible, “millions will react like this, millions will react like that” are valid and respected. From the outside, there's a tiny bit of a problem: ordinary human has no value apart from that of a cog in the machine, there is really nothing to protect, an empty place, so all those powerful words crumble like a card house in situations like these.
What I'm hinting at is that that assumption is wrong, it's a dead end from the start. Just like tribes sitting around the bonfire, and discussing legendary totem animals and gods making their life reasonable and orderly, people today are charmed by the images of events “above”. It's just a belief in the workings of “modern world”. One needs a better base to live one's own life, not an axiom that one, for all intents and purposes, doesn't matter.
Consequently, I ensure that my motorcade of armed guards are always with me, and accept cars loaded with only the toughest reinforced glass. I am, of course, paranoid about physical proximity to strangers and that mostly incentivizes me to avoid public travel, particularly flights (though even my private jets must be carefully maintained only by my most trusted insiders lest they find themselves tumbling out the sky near Tver). When flying on particularly important trips I send a decoy plane, and I make sure that air space near me is well controlled.
Or maybe, just maybe, I don’t actually face the same threat profile as presidents, spy agency bigwigs, and leaders of paramilitary organizations, and pretending I do is an act of high fantasy that far from empowering my true human soul would be so ridiculous as to make life unlivable!
They've proven numerous times they couldn't care less about the rights of their own citizens. The US agencies in particular can't even muster any respect for their own allies. I don't even want to imagine what they feel justified in doing to foreigners. They're basically a threat to everyone on earth at this point and we all need the ability to defend against people like them.
So it costs millions to compromise someone? We need to find ways to make it cost billions then. Then we make it cost trillions. They should have to commit crimes against humanity in order to get anyone at all.
The point is this: good security means being able to intelligibly state your threat model and respond to its specific capabilities. Failing to do this results in all kinds of muddied thinking, making it harder to defend against more quotidian adversaries. If your threat model genuinely involves the US IC, then turning on Lockdown Mode is about the best you can do short of throwing your phone in the ocean. By all appearances, that would have prevented this chain.
(Hopefully what I said wasn't interpreted as a value judgement about hardware security specifically -- the only point I was trying to make is that ICs spend significant resources discovering exploits on all of these platforms.)
supports your point but it's not an easy argument to win either way. It's "everyone can see it so the good guys will find it first" vs "bad guys have harder time discovering vulns but once they do they have gold"
This is Kaspersky. They had to be aware of the long history of iMessage security bugs. They could have disabled it. They chose to ignore it instead.
Maybe, maybe not. But it is still a testament to their poor security posture that iMessage was enabled in corporate devices, when it is not part of their software catalog.
Kaspersky has tried to publicly switch blame to Apple twice in a row now. Maybe it is time for them to take some.
The OpenSSL debacle kinda disproved that point, didn’t it?
Imho end of the day, open source vs closed doesn’t matter for number/severity of security issues and ends up just being ideological posturing. The bugs exist for a variety of other reasons and tend to have the same root causes attached.
OSS has other considerations though around security. Flaws may be easier to identify and either exploit or fix. Flaw fixing is trickier though because you need to do it in such a way as to not advertise it to the world either before it’s sufficiently deployed.
It's easy to laugh at Juicero users, it's harder to notice the bigger elephant in the room.