Apple patches “clickless” 0-day image processing vulnerability in iOS, macOS

https://arstechnica.com/gadgets/2023/09/apple-patches-clickless-0-day-image-processing-vulnerability-in-ios-macos/

by CharlesW • 3 years ago

15 3 3 years ago

agonz253• 3 years ago

Dup of https://news.ycombinator.com/item?id=37428817

Veserv• 3 years ago

Just your regular reminder that for the only security certification Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security, EAL1. A level only fit for products where [3]: “some confidence in correct operation is required, but the threats to security are not viewed as serious” which does not even require “demonstrating resistance to penetration attackers with a basic attack potential”. Four full levels below “demonstrating resistance to penetration attackers with a moderate attack potential”[4].

Is it any wonder that a company which has continuously failed for decades to certify resistance against moderate threats keeps getting their security completely invalidated by moderate threats? It should not be; they positively certify for sure that they are useless against them.

Until they can prove any non-trivial product of theirs can protect against moderate attackers, their claims about security of any form are extraordinary claims and thus demand extraordinary evidence (like certification proof). I am not holding my breath.

[1] https://support.apple.com/guide/certifications/ios-security-...

[2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE...

[3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR...

[4] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR...

gtvwill• 3 years ago

Apple also operates in Australia. Which by law means they can and almost certainly are backdoored by our intelligence community and they aren't allowed to let you know.

Most of these one touch zero day attacks are left there for the use of intelligence agencies. They have dozens it's more just how long they stay working until some security researcher notices it and they have to publicly close that doorway.

Apple patches “clickless” 0-day image processing vulnerability in iOS, macOS

Related Stories