| ▲ | nsxwolf 7 hours ago |
| What are these videos actually demonstrating? |
|
| ▲ | jeroenhd 6 hours ago | parent | next [-] |
| A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation. |
|
| ▲ | ks2048 6 hours ago | parent | prev | next [-] |
| Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc? |
| |
| ▲ | sunaookami 4 hours ago | parent | next [-] | | Marketing by security researchers and companies has gotten unbearable. They only want their name out there and not actually make devices more secure. | | |
| ▲ | cryptbe an hour ago | parent | next [-] | | We disclosed most bugs to Apple, and are going to disclose the rest. We've disclosed probably close to 100 bugs to Apple in the past 6 months. We've also been working with closely with the Signal Foundation to help them reduce the attack surface. It's not true that we don't want to make devices more secure. We do and it's why we do this research. We also do want our name out there because we're having a lot of fun and want to share that with our friends and the rest of the world. | |
| ▲ | r_lee an hour ago | parent | prev [-] | | how are they supposed to get paid? |
| |
| ▲ | cryptbe an hour ago | parent | prev [-] | | Check out https://calif.io/research/the-great-glyph-grift, which shows one could go wrong with PDF in iOS. We're gonna publish more in the coming weeks. Writing these blog posts take time, and we've been busy with another PHP thing. | | |
|
|
| ▲ | 6 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | dt3ft 5 hours ago | parent | prev [-] |
| Rooting, pretty much. Aka, executing code which shows their flying logo, but could also be exfiltrating data without displaying anything. |
