PEGASUS iOS Kernel Vulnerability Explained

http://sektioneins.de/en/blog/16-09-02-pegasus-ios-kernel-vulnerability-explained.html

by ssclafani • 10 years ago

82 17 10 years ago

sektioneins.de

klue07• 10 years ago

Apple also released a fix for OS X with its latest update.

https://support.apple.com/en-us/HT207130

jetpks• 10 years ago

This was the real news to me. Apple had to know OS X was vulnerable when they released iOS 9.3.5, yet they waited until yesterday to push updates.

a2tech• 10 years ago

Did these guys just admit they have their own private jailbreak? That seems like something you'd keep quiet

q3k• 10 years ago

Stefan Esser is a well know iOS security researcher that is well known to be (and vocal about) keeping private jailbreaks.

This makes sense considering the platform - burning an exploit would render it unnecessarily difficult to continue research on future versions of iOS.

xenadu02• 10 years ago

Keep this in mind when you think about Apple's recent bug bounty program. Anyone who has been sitting on some private jailbreaks might be tempted to collect $200k, no?

yborg• 10 years ago

  Because we at SektionEins believe keeping the public in the dark about details of already fixed vulnerabilities is wrong...

  ...use our private jailbreak...

i.e. your undisclosed vulnerabilities bad, my undisclosed vulnerabilities are cool.

Useful analysis, but casting a marketing endeavor as a public service is rather disingenuous.

stevetrewick• 10 years ago

But maybe they'll share it with you if you book on their training course. Only EUR 4000!

vizzah• 10 years ago

What a jailbreak is worth these days.. close to a million? So training course for a few grand by someone capable of developing a jailbreak (on numerous occasions*) should be a well-spent educational investment, even if no unfixed vulnerabilities are shared (obviously, they won't be).

satnoehustn• 10 years ago

You seem to not understand the difference between "already fixed vulnerabilities" and a private jailbreak.

hughw• 10 years ago

I understand the difference. I don't see the distinction. They know an unpatched vulnerability and if they haven't reported it to Apple, they don't own the moral high ground that would justify their smug public-interested belief.

stevenh• 10 years ago

Are people who never install new apps on their Mac safe without updating for now, or can this be exploited over the web?

eugeneionesco• 10 years ago

This can be exploited over the web by chaining it with the other bug used in the attack.

whoopdedo• 10 years ago

Once again demonstrating that the term "zero day" is horribly overused and misused and probably should be eliminated from the lexicon, the OSUnserializeBinary bug doesn't appear to be new. Brandon Azad[1] says he discovered it last year. It was fixed in OS X in May. Or maybe the fix didn't work since they had to make another patch this week.

[1] https://bazad.github.io/2016/05/mac-os-x-use-after-free/

reiichiroh• 10 years ago

Realistically, is this in the wild under active exploit? With the likelihood of infection remote unless one is a UAE-targeted activist?

PEGASUS iOS Kernel Vulnerability Explained

Related Stories