[HN Gopher] Bank of America Email: "Update Your iPhone"
___________________________________________________________________
Bank of America Email: "Update Your iPhone"
I got an email from Bank of America essentially: "Hey, Update your
iPhone". I imagine there is a pretty gnarly exploit.
Author : justinzollars
Score : 77 points
Date : 2022-08-24 16:06 UTC (6 hours ago)
| aaroninsf wrote:
| I got this...
|
| ...and my phone is up to date (15.6.1).
|
| #fail
| FollowingTheDao wrote:
| Better to fail at being safe then fail at being unsafe.
| OrangeMonkey wrote:
| Received one of these too.
|
| I do not update to the latest-and-greatest when it first comes
| out. I typically wait a bit for everyone else to 'beta test' it
| for me.
|
| If my bank is saying 'no, seriously, go fix this' maybe I should
| change my stance.
| notananthem wrote:
| Updates that Apple, or anyone (Microsoft etc) pushes to
| customers has been internally tested for a while on different
| rings of risk. People who write the code run it relentlessly to
| start to catch all the issues and then start pushing out
| updates to varying pools of people who can take those small
| bits of risk of a bug here or there, and poke holes in it. Once
| it reaches the company's QC metrics it is pushed outside.
| Pushing out bad updates ruins your credibility, companies are
| incentivized not to do so. Updating your computing devices as
| soon as public updates are made is vital to your own
| security/safety.
| jeffffff wrote:
| most people who are hesitant to update are hesitant because
| they've been burned in the past. apple has a history of
| making phones unusably slow with updates and breaking 3rd
| party software.
| mrazomor wrote:
| Yes, but there are layers of badness.
|
| An update might break the feature I need, or change something
| my workflow depends on (more common). I'd rather wait for
| blog posts with workarounds/fixes. As it tends to be
| extremely time consuming to fix it myself (as it's often
| outside my domain).
| yieldcrv wrote:
| I'm pretty content with the iphone 12 pro
|
| but I wonder if I'm becoming like you or others, where there
| was some other arbitrary technological progress and lack of
| interest in trends and suddenly 10 years went by and people are
| like "what is that device why are you using that"
| davidlumley wrote:
| In this case I think they mean "update your version of iOS"
| because there was a recent and important security fix:
| https://support.apple.com/en-us/HT213412
| sixstringtheory wrote:
| They're talking about updating the operating system on the
| phone, not buying a new phone. The title got me like that as
| well. There was a security update that went out recently:
| https://support.apple.com/en-us/HT213412
| magwa101 wrote:
| There are a ton of beta tests ahead of release, I think it's
| always prudent to keep up to date very quickly. This seems to
| be the top security expert recommendation.
| justinzollars wrote:
| I imagine they believe there is the potential to lose
| significant money
| treesknees wrote:
| I wonder if the "actively being exploited" bit of the webkit
| vulnerability was targeting either Bank of America or other
| banking apps.
| detaro wrote:
| Apple saying "looking at web content can lead to arbitrary code
| execution, this is potentially already used in the wild" wasn't
| enough?
| drewg123 wrote:
| It sure would be nice if Apple stopped forcing web browsers
| to be reskins of Safari, and allowed full implementations of
| 3rd party web browsers like Firefox and Chrome. Then we
| wouldn't have such a monoculture on iOS
| sofixa wrote:
| And/or allow Safari to be updated independently from the
| OS. Chrome/Firefox/etc. and Android WebView are updatable
| as normal apps outside of the Android lifecycle, there's no
| excuse for Apple's self-imposed limitations here.
| charles_kaw wrote:
| Something akin to this is coming in ios16.
| vlovich123 wrote:
| If you're talking about lockdown mode, that's a totally
| different feature from shipping browser updates
| independent of the OS.
|
| I think Apple fell down the design flaw that Microsoft
| went down of bundling the browser so tightly into the OS.
| Bud wrote:
| 1) Apple doesn't need an "excuse", it only needs a
| reason, and it has one
|
| 2) The reason is, they know that the moment they allow
| all the stuff you're talking about, we'll all be in the
| wild West again, with God knows what fucking version of
| Chrome being run, and it will be a nightmare to support,
| and a nightmare environment in which to protect privacy
| and security
|
| 3) Users have conclusively voted for it to be this way.
| We know it's this way and we're still buying iPhones
| instead of Android. What's annoying to me is that people
| like you, a lot of people, are still unable to summon any
| respect for the legitimacy of THAT choice. You can only
| think of the choice that YOU want.
| dane-pgp wrote:
| > Users have conclusively voted for it to be this way. We
| know it's this way and we're still buying iPhones instead
| of Android.
|
| That's like saying that every voter in a democracy
| approves of every policy implemented by the politician
| they voted for (especially if they re-elect that
| politician). The world is not as simple as that, and I
| think the general term for this erroneous line of
| thinking is "the fallacy of division".
|
| https://en.wikipedia.org/wiki/Fallacy_of_division
| Finnucane wrote:
| I think you underestimate the number of iphone/ipad users
| who would switch browsers if there was a meaningful
| choice.
| jjav wrote:
| > Users have conclusively voted for it to be this way
|
| I'm pretty confident that you'll need to interview a
| _lot_ of iphone users from the general population before
| finding one that even knows about browser implementation
| internals in iOS, let alone who cares enough to have
| voted with their wallet for this particular reason.
|
| So no, users have not voted conclusively for it to be
| that way.
| Cyberdog wrote:
| On the other hand, allowing other web engines to run on the
| phone would increase the number of potential vectors for
| this sort of attack.
|
| I personally would prefer if I could make the choice to do
| this, but I can also see the issues with that from Apple's
| perspective.
| [deleted]
| riquito wrote:
| More web engines means less revenue for hack (more
| engines to spend time/money to research on, less victimes
| for engine). Keeping only one makes it much more
| attractive as a target
| jdminhbg wrote:
| The Safari engine would still need to be embedded in the OS
| for things like web views, so it wouldn't really solve any
| problems.
| notsapiensatall wrote:
| Android uses your default browser for webviews, and that
| works fine. It's not hardcoded to Chrome, and there's no
| reason it should be.
|
| With Firefox, your extensions like adblockers and
| NoScript also run in webviews.
| mistrial9 wrote:
| I think the idea is that another browser is a "good thing"
| as along as there is more than .. three? include non-
| English world-power languages for the full puzzle
| lesuorac wrote:
| Isn't that the whole point of the Web nowendays?
|
| Anybody can put code out there that you'll run on your
| device?
| spcebar wrote:
| Yes, but ideally in a sandboxed environment that prevents
| drive-by attacks. The web looks very different when you
| need to treat websites with the same caution as an exe.
| OrangeMonkey wrote:
| Or with the same caution as an ex.
| MarcoZavala wrote:
| BHSPitMonkey wrote:
| You forgot the "arbitrary" qualifier.
| tomjen3 wrote:
| They didn't say that in the update notes I could see. It was
| the same vague stuff about system security that they normally
| say.
| rzz3 wrote:
| How do we know whether we've been exploited by this? Is there
| such a thing as antivirus for iOS?
| jjulius wrote:
| >Received one of these too.
|
| Was there any additional context or comments provided in the
| email? Both the initial post and this comment are pretty vague
| on what was communicated beyond the phrase, "Update your
| iPhone".
| dsizzle wrote:
| No additional context. They don't even specify which you used
| (I have both a Mac and an iPhone and both are up to date).
| The full text is below:
|
| "Update your iOS software and Safari(r) browser to keep your
| device(s) secure
|
| We noticed the iOS software version you're using on your
| mobile device and/or the Safari browser on your computer may
| need to be updated. <Instructions on how to update>"
| jjulius wrote:
| Thanks, appreciate the response! :)
| themadturk wrote:
| Amusing, as I also received the email and am using MacOS
| and iOS betas right now. I've updated into the future, for
| heaven's sake!
| drcongo wrote:
| I got one from a UK bank too
| beermonster wrote:
| What did it say? I know Starling mailed customers.
| drcongo wrote:
| It was indeed Starling...
|
| _Apple has today shared some information in relation to a
| security issue. This has the potential to allow others to
| gain access to information on your device if security updates
| are not up to date.
|
| We are contacting you as you have previously accessed your
| Starling account from an iOS device. We would strongly
| recommend that you ensure the security updates on your device
| are up to date to ensure that your device and information
| remains secure.
|
| To update: Go to your device Settings > General, then tap
| Software Update.
|
| If you are in need of further help updating your device, head
| to Apple Support._
| mikece wrote:
| I cannot help but read this as BofA saying their their systems
| are vulnerable to exploit more so than other banks who aren't
| sending out frantic "OMG! Upgrade your phone ASAP!!!" messages.
| aaaaaaaaata wrote:
| Or...they don't want bad word of mouth after (many) someone(s)
| has their phone pwned and their BoA accts wiped out from within
| their own app..?
| amalcon wrote:
| It's an RCE (out of sandbox) exploited when you load a web page
| in Safari. Everyone is equally vulnerable to this, and you
| should be frantically upgrading. People panicked about
| Heartbleed, and rightly so, but this is arguably _much_ worse,
| bot41 wrote:
| got a link handy to more detail?
| amalcon wrote:
| Another comment mentioned this CVE:
| https://cve.mitre.org/cgi-
| bin/cvename.cgi?name=CVE-2022-3289...
| spcebar wrote:
| Could be that other banks are equally vulnerable and just not
| disclosing it. Hard to know without some insider knowledge.
| We'll know in a few months if class action lawsuits start
| popping up.
| JustSomeNobody wrote:
| Maybe.
|
| But...
|
| If someone is using BoA and they have an issue related to this,
| are they going to blame BoA or are they going to blame Apple?
| X-Istence wrote:
| I got this email too from Bank of America... but I already
| updated all my devices the day the new version came out.
| pen2l wrote:
| I think it's the Webkit vulnerability CVE-2022-32893 that is of
| concern. As I understand there's this one and the other
| vulnerability is in the kernel which requires physical access to
| exploit. The former lets nefarious actors compromise devices
| without physical access and is in fact being actively exploited
| in the wild (by Apple's own admission), so it's encouraging to
| see that BoA is taking the initiative to go so far as emailing
| users to update to keep them safe.
| Havoc wrote:
| Yeah got same from employer - within hours of release on the
| 18th. Guessing there is a service of some sort IT team uses to
| monitor cause they're always very fast on highlighting the
| serious ones
| NoboruWataya wrote:
| Got an email from my employer threatening to disconnect my iPhone
| from their network if I don't update by Friday.
| bilekas wrote:
| I don't have a BoA account but it sounds like they might have
| safari embedded in there somewhere, or are depending on external
| links in some way.
|
| Either way its always a good idea to keep things updated!
| kemiller2002 wrote:
| They do. Can confirm.
| meltyness wrote:
| This was awesome then, and horrifying now:
| https://www.youtube.com/watch?v=hFDGTVlgkmI
| colejohnson66 wrote:
| People were going around to Apple stores and jailbreaking the
| demo units. It's a neat exploit, but it's scary how much power
| a simple website could have.
| [deleted]
| justinzollars wrote:
| https://support.apple.com/en-us/HT213414
| testplzignore wrote:
| And the other advisories:
|
| https://support.apple.com/en-us/HT213412
|
| https://support.apple.com/en-us/HT213413
| googlryas wrote:
| I'm curious if Lockdown mode would prevent this exploit?
|
| From Apple's Lockdown site, it's hard to tell the extent of
| what is locked down.
|
| > Web browsing: Certain complex web technologies, like just-in-
| time (JIT) JavaScript compilation, are disabled unless the user
| excludes a trusted site from Lockdown Mode
|
| This is allegedly the fix for this exploit for webkit:
| https://github.com/WebKit/WebKit/pull/3023, it appears to at
| least somewhat related to the JIT, but I don't know enough
| about the exploit, or webkit to make that determination.
| kossTKR wrote:
| "Processing maliciously crafted web content may lead to
| arbitrary code execution. An application may be able to execute
| arbitrary code with kernel privileges. Apple is aware of a
| report that this issue may have been actively exploited."
|
| Sounds pretty serious, has active exploitation like this
| happened before in the Apple ecosystem or is this like most
| zerodays; edge cases and state level exploits that don't target
| broadly?
| clint wrote:
| I have no hard data, but having looked at the security
| content of a lot of these over the years I'd wager WebKit has
| serious issues like this crop up more than any other
| component in iOS.
___________________________________________________________________
(page generated 2022-08-24 23:02 UTC)