.png "back to home page")
Why is Apple not working with security researchers who are finding highly critical bugs like these?
— Stefan Arentz ? ? ?? (@satefan) September 24, 2021
They should put someone competent in charge to run a proper security bounty program.
It is just so bizarre that this is completely mismanaged. https://t.co/0kwChrEDam
https://t.co/g65r2XrPrB 3 iOS 0days dropped. Also, what the fuck is Apple doing with this info!? Why do they need to log your menstrual cycles? pic.twitter.com/bLvHzK8zOc
— Rena and -3 others (@RenaKunisaki) September 24, 2021
Apple will never change their ways until they're publicly shamed. Sad to see it has come to this.
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
Click through to see the Game Center exploit in particular. It’s rough.
— Marco Arment (@marcoarment) September 24, 2021
Things like this should almost never slip through the cracks with a functioning security program.
Instead, with Apple, it’s commonplace.
That’s so deeply broken, yet nothing changes.
What will it take?
Security relations are developer relations.
— Marco Arment (@marcoarment) September 24, 2021
What will it take for Apple to change their entire CULTURE of how they treat outside developers? https://t.co/BQdN1tRiyF
The report shows any app could access contact details without requesting permission. That's what Apple just decided to sweep under the rug. https://t.co/3XGu3FCAxU via https://t.co/UqGFu4u0dU
— 10 GOTO 10 (@mahemoff) September 24, 2021
"I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page" ?
— 10 GOTO 10 (@mahemoff) September 24, 2021
not fun to watch iOS start to feel more like Windows XP before SP1 https://t.co/wppmJpK0MB
— alex (@alex) September 24, 2021
Rumors are saying that Apple can’t afford to pay the maximum payouts on bug bounties and that’s why they never did. I’m starting a fund raising to help Apple, reach out if you want to donate and assist Apple through that difficult period.
— Matt “Swish” Suiche (@msuiche) September 24, 2021
It appears to be able to pull my entire contact list and lots of details about my conversations, with no user prompt of any kind. I see a ton of my own private data in each of these 3 sections: pic.twitter.com/WIzo8lpQT1
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
NEW: A researcher has published the source code for exploits that take advantage of three unpatched iPhone bugs.
— Lorenzo Franceschi-Bicchierai (@lorenzofb) September 24, 2021
Another researcher said he was able to reproduce exploits in 30 mins. But bugs are not *that* dangerous for users. https://t.co/exxHhzWufa
?Apple ignored this person. Now they’re publishing multiple proofs-of-concepts:
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
“I've reported four 0-day vulnerabilities this year [...], three of them are still present in [iOS 15.0] and one was fixed in 14.7, but Apple decided to cover it up”?https://t.co/eKzq6BEupG
When Apple doesn’t bother to fix serious issues long after they’ve been *reported* to them, how can we trust them to be the good stewards of an ecosystem used by a billion people?
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
Rampant scams on the App Store are another example of Apple’s failings: https://t.co/TIkmJzEVD7
?“Any app installed from the App Store may access the following data without any prompt from the user:” pic.twitter.com/hXpfqlgnDa
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
I presume fixing these exploits will make it harder for Apple to spy on its employees...
— Alan Langford ☮️❤️?? 2x? (@alanlangford_ca) September 24, 2021
cc @ashleygjovik https://t.co/nhr0PMw6AY
It looks like Apple has a bug bounty problem. This researcher claims they've reported 4 zero days, 3 of which are still exploitable in iOS 15. This after a Spanish researcher dumped a lockscreen bypass because he says Apple ignored him. https://t.co/6cRn2IUQ1z https://t.co/Pgqr85GCwV
— Nicole Perlroth (@nicoleperlroth) September 24, 2021
?Can confirm the exploit also works on iOS 15.0 - it's able to silently pull a *trove* of personal information without _any_ kind of user prompt.
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
We just updated the story with comments from the researcher who found the bugs.https://t.co/TxYgincF33 pic.twitter.com/O9cUkhK5XU
— Lorenzo Franceschi-Bicchierai (@lorenzofb) September 24, 2021
Every OS has security issues. What's important to understand here is how the approaches differ.
— Alex Russell (@slightlylate) September 24, 2021
Other OSes let you move your computing to a safer layer (the web) and deliver choice + competition about those protections. Only iOS keeps mobile down in the (security) dirt. https://t.co/mLcuKmGlAc
The website at the top of the thread seems to be having some intermittent issues. Link to archived page: https://t.co/IqKuHO97DD
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
Another researcher annoyed with how Apple handled his report, from just a few days ago: https://t.co/tgh2iVoC03
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
But seriously how Apple doesn't just pay 100k for every bug is the dumbest penny pinching when you've got a trillion fucking dollars pic.twitter.com/txEVpoTDzm
— SoS (@SwiftOnSecurity) September 24, 2021
Can confirm the exploit runs successfully on iOS 14.8: pic.twitter.com/6k3RCumwys
— Kosta Eleftheriou (@keleftheriou) September 24, 2021
Researcher drops three iOS zero-days that Apple refused to fix https://t.co/EyotJ1zpat
— Zuk (@ihackbanme) September 24, 2021
There are few expressions of dismay with a bug bounty program, in this case Apple's, that are quite as clear as dumping proof-of-concept code for unpatched holes. https://t.co/4tBBc4TVVx
— Joseph Menn (@josephmenn) September 24, 2021
Researcher drops three iOS zero-days that Apple refused to fix https://t.co/Sc4Iid252c
— Jim Nitterauer (@JNitterauer) September 24, 2021
Researcher drops three iOS zero-days that Apple refused to fixhttps://t.co/Okc1r566GM
— no bullshit bitcoin (@nobsbitcoin) September 24, 2021
archive: https://t.co/WfuLsUlWjt https://t.co/uelA36aab2
Researcher warns of three zero-day iPhone hacks still not fixed https://t.co/mcXU9Ooulo
— iMore (@iMore) September 24, 2021