iPhone zero-click Wi-Fi exploit is one of the most breathtaking hacks ever:
Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device—over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable—meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed.
This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly.
[...] Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel—one of the most privileged parts of any operating system—the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.
[...] Beer developed several different exploits. The most advanced one installs an implant that has full access to the user's personal data, including emails, photos, messages, and passwords and crypto keys stored in the keychain. The attack uses a laptop, a Raspberry Pi, and some off-the-shelf Wi-Fi adapters. It takes about two minutes to install the prototype implant, but Beer said that with more work a better written exploit could deliver it in a "handful of seconds."
Any Soylentils remember the Morris worm?
[N.B. "NOTE: This specific issue was fixed before the launch of Privacy-Preserving Contact Tracing in iOS 13.5 in May 2020." - googleprojectzero.blogspot.com]
(Score: 1, Insightful) by Anonymous Coward on Wednesday December 02 2020, @05:33PM (12 children)
I assume that anything on my cell phone can be hacked and act accordingly.
(Anything connected to a network, really.) There will always be security leaks. ALWAYS.
This sounds like an obvious and dumb post on my part, but I guess I just wanted to show my attitude: assume your device is compromised.
(Score: 2) by barbara hudson on Wednesday December 02 2020, @05:43PM (11 children)
I just don't allow wifi. Or airdrop. Or all the other services except Internet through the mobile provider. Throw in no Google, no social media, no other crap except a browser (Firefox with images disabled to save bandwidth and foul social media traxkers) so there's not much to worry about. Even email is plain-text only. Don't bother with images or attachments -the email client doesn't open images and I don't open attachments. Plain text of GTFO.
The price of convenience is lower security. Always has been the case.
SoylentNews is social media. Says so right in the slogan. Soylentnews is people, not tech.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @06:47PM (10 children)
I just don't allow Apple devices. Problem solved.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @07:21PM (9 children)
Because android devices are so much more secure.....
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @07:32PM (8 children)
There. FTFY.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @07:50PM (7 children)
The record is longstanding: iOS is more secure than Android.
It's this way because Android is by design spyware for Google to better sell you ads. Apple has been about selling you a very expensive phone. This may change in the future on Apple's part as they want to get that personal tracking data money, but this is how it has been.
(Score: 1, Informative) by Anonymous Coward on Wednesday December 02 2020, @08:09PM (6 children)
LineageOS [lineageos.org] and MicroG [microg.org] give the lie to that.
I'll assume you're just ignorant, rather than an Apple shill.
Have a wonderful day!
(Score: 5, Touché) by Anonymous Coward on Wednesday December 02 2020, @09:01PM (5 children)
Those are not what comes on an Android phone, so you AGREE with me that you need to replace the OS on an Android phone for security.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @10:24PM (4 children)
My point, from the beginning of this inane exchange, was that I *can* replace the OS on an Android phone. Which is a lot more than can be said for Apple devices.
You're just trolling. I hope you enjoyed your meal. Now back under your bridge, jerk.
(Score: 2) by barbara hudson on Wednesday December 02 2020, @10:49PM (3 children)
The iPhone 6 I'm posting this from was made in 2014. Here it is more than 6 years later and I got the 5th update this year last week. How many shitty Android devices still get regular updates even 2 years after purchase? Android == Planned Obsolescence.
No reason why it won't be working at the 10-year mark.
SoylentNews is social media. Says so right in the slogan. Soylentnews is people, not tech.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @11:14PM
Being deliberately obtuse as usual, eh Barb?
You go, girl!
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @11:36PM
More than 300. That's kind of the point of using [lineageos.org] LineageOS [lineageos.org].
And when that device falls out of Apple support [statista.com] in a year or so, what are you going to do?
Hey, I've got an idea. You could install another, supported, phone operating system (like LineageOS) on your iPhone. Oh, wait. You can't. Because you don't actually own your phone. In fact, you're only able to use Apps that *Apple says are okay* and iOS versions that that *they* decide you are allowed to run.
And if they alter the deal, pray they don't alter it any further. [youtube.com]
(Score: 0) by Anonymous Coward on Thursday December 03 2020, @07:22AM
Actually, that's *exactly* what I said [soylentnews.org]:
Is it painful talking out of your ass like that?
(Score: 2) by drussell on Wednesday December 02 2020, @05:36PM (7 children)
So anyone who's not running pretty much the latest version of iOS is vulnerable to this?
(Score: 5, Insightful) by rigrig on Wednesday December 02 2020, @05:50PM
Yups, and as the researcher points out:
It's safe to assume there are a whole bunch of other vulnerabilities we don't know about, but all kinds of shady organizations have already found. Just be thankful that most exploits nowadays are too valuable to waste on the likes of us.
No one remembers the singer.
(Score: 2) by EvilSS on Wednesday December 02 2020, @06:23PM (5 children)
(Score: 2) by drussell on Wednesday December 02 2020, @06:43PM (4 children)
Right, but anyone who has not updated iOS, which happens for a wide variety of reasons, has this gaping hole open.
(Score: 2) by EvilSS on Wednesday December 02 2020, @07:46PM (2 children)
(Score: 2) by arslan on Wednesday December 02 2020, @09:17PM (1 child)
If only that's the only alternate, but it is not. Apple refuse to provide upgrade and patch for my perfectly usable iPad Air gen 1. So I'm not ignoring security updates as there's nothing to ignore - this is on Apple.
I'm perfectly fine if they said I have to pay extended support to continue to use old devices but that isn't even an option. To be clear, this isn't just an Apple problem, same issue with Android devices unless I decide to hack/root it - Android device have at least that option but not something everyone can do, i.e. non-techies.
(Score: 2) by EvilSS on Wednesday December 02 2020, @10:57PM
(Score: 2) by barbara hudson on Wednesday December 02 2020, @10:52PM
And if you never connect to anything, what is the problem?
SoylentNews is social media. Says so right in the slogan. Soylentnews is people, not tech.
(Score: 0) by Anonymous Coward on Wednesday December 02 2020, @05:41PM (2 children)
Meet trash can.
(Score: 1, Insightful) by Anonymous Coward on Wednesday December 02 2020, @06:08PM
Because Android is secure? Please!
The only "mostly secure" phone is a dumb feature phone that makes calls and text messages and that's it!
(Score: 0) by Anonymous Coward on Thursday December 03 2020, @08:43AM
Oscar the grouch could always use a new phone!
(Score: 5, Insightful) by fadrian on Wednesday December 02 2020, @05:57PM (1 child)
Because drivers reside in the kernel—one of the most privileged parts of any operating system—the AWDL flaw had the potential for serious hacks.
This is another good reason for microkernels. I really don't care about the 10-15% overhead they have against monolithic kernels - hardware is cheap; security is expensive.
That is all.
(Score: 3, Insightful) by darkfeline on Wednesday December 02 2020, @11:38PM
Here's a good reason for not using microkernels: they don't exist.
I don't care for a pedantic reply. Yes, I know microkernels technically exist, but I can't install one and then proceed to use my computer to do things. I have a computer to do things with, not to use as a conversation piece.
Join the SDF Public Access UNIX System today!
(Score: 2) by Gaaark on Wednesday December 02 2020, @10:01PM (1 child)
I remember watching Morris dancers on "Dad's Army". They weren't naked...but it did seem pretty gay.
--- Please remind me if I haven't been civil to you: I'm channeling MDC. ---Gaaark 2.0 ---
(Score: 0) by Anonymous Coward on Thursday December 03 2020, @03:26AM
Yes I do. And the next semester there was a class on worms and viruses. We had a self contained network of unix computers where we could write worms and viruses and use other hacks to try to infect other computers on the network and harden/defend our own computers.