The first defense they can perform is to change the automatic checks in the App Store review process to identify the attack in a maliciou...
The first defense they can perform is to change the automatic checks in the App Store review process to identify the attack in a malicious app and stop it from being approved. This could be fairly easy, of course Apple doesn't tell anyone what they do in this process so we have no way to verify it. Still you have to identify how the process could be hidden but since it uses known API calls in an uncommon way, I think this is quite doable. The second defense is more complex, changing the way Keychain API works without breaking every app out there is much more complex. Not knowing much about this is implemented it might take a lot of testing to verify a fix without breaking apps. The last thing they can also do is to build a verified system tool that checks the existing keychain for incorrect ACL usage. You can't hide the hack from the system. This way Apple could fix the ACL to not allow incorrect usage and not give access where it doesn't belong. I think this is fairly easy to do since it will break very little. This is why building security is hard no matter who you are and everyone gets it wrong sometimes. At least Apple has the ability to readily (except for point 2) repair the problem, unlike Samsung having to have 800 million phones somehow patched by third parties to fix the keyboard hack.
Posted by coldcode on Jun 17, 2015, 2:26 PM
Tags
Related issues
- That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
- I'm intrigued about the "Trip Planner" being a top-level app.
- This asymmetry is IMO the biggest problem with AI-driven output.
- This is one of the most important objectives in software today.
- At least in Europe - these rouge corporations need to be reined in or just leave the market.
- I was skeptical, but this looks genuinely useful.
Raise real-world problems, find people facing the same issue, and discuss solutions.6,000 issues0 comments
hackernews (SaaS)
That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
I'm intrigued about the "Trip Planner" being a top-level app.
This asymmetry is IMO the biggest problem with AI-driven output.
This is one of the most important objectives in software today.
At least in Europe - these rouge corporations need to be reined in or just leave the market.
I was skeptical, but this looks genuinely useful.
Why has she gone through so many iPhones?
The biggest problem with Europe is the lack of innovation.
The first defense they can perform is to change the automatic checks in the App Store review process to identify the attack in a maliciou...
The first defense they can perform is to change the automatic checks in the App Store review process to identify the attack in a malicious app and stop it from being approved. This could be fairly easy, of course Apple doesn't tell anyone what they do in this process so we have no way to verify it. Still you have to identify how the process could be hidden but since it uses known API calls in an uncommon way, I think this is quite doable. The second defense is more complex, changing the way Keychain API works without breaking every app out there is much more complex. Not knowing much about this is implemented it might take a lot of testing to verify a fix without breaking apps. The last thing they can also do is to build a verified system tool that checks the existing keychain for incorrect ACL usage. You can't hide the hack from the system. This way Apple could fix the ACL to not allow incorrect usage and not give access where it doesn't belong. I think this is fairly easy to do since it will break very little. This is why building security is hard no matter who you are and everyone gets it wrong sometimes. At least Apple has the ability to readily (except for point 2) repair the problem, unlike Samsung having to have 800 million phones somehow patched by third parties to fix the keyboard hack.
Comments (0)
No comments yet. Start the discussion.