[HN Gopher] No new iPhone? No secure iOS: Looking at an unfixed ...
___________________________________________________________________
No new iPhone? No secure iOS: Looking at an unfixed iOS
vulnerability
Author : akyuu
Score : 328 points
Date : 2023-12-27 23:43 UTC (23 hours ago)
(HTM) web link (joshua.hu)
(TXT) w3m dump (joshua.hu)
| userbinator wrote:
| _When opening the page, your /etc/passwd is there for the world
| to see._
|
| ...more precisely, for you to see; this needs to be combined with
| something to send back data (JS?) to be truly exploited.
| NewsaHackO wrote:
| Yea, this reads like someone was denied a bounty for a
| "exploit" and decided to make it a whole thing as retribution.
| iraqmtpizza wrote:
| Yes, science as a public service as retribution
| Sporktacular wrote:
| I don't see how. Apple is choosing to not patch known
| vulnerabilities on hardware sold new less than 3 years ago.
| Hardware they're happy to charge for repairs on.
| coldtea wrote:
| And how's that more difficult than the loading page
| (exploit.svg) doing a GET/POST request to some server, after
| <xmp><xsl:copy-of select="document('exploit.php')"/></xmp> was
| loaded?
| mtlynch wrote:
| Isn't the JS exfiltration part trivial?
|
| The attack assumes that the victim is visiting an attacker-
| controlled web server.
|
| If the attacker can put secret data in the DOM within the
| victim's browser, the attacker can also add JS on the same page
| that POSTs the DOM contents to the server once they're
| populated with secrets.
| userbinator wrote:
| If it's "trivial", then perhaps the article should've
| demonstrated that.
| tsimionescu wrote:
| If I prove I got a shell prompt on a remote device without
| any authentication, do I then need to show that I can
| execute arbitrary code? Or is it clearly implied?
|
| If the page body can read a file, then it can just execute
| an XmlHttpRequest to send that data to the origin server,
| which is the attacker in this scenario. This is just how
| the web works, nothing more to say about it, and no need to
| prove it.
| userbinator wrote:
| It's not necessarily true that what can be read locally
| can be sent to a remote server.
| tsimionescu wrote:
| It very much is on the web, if you are sending it to the
| origin server.
| fulafel wrote:
| Vulnerabilitity research without doing the work to
| productize exploits is good and productive, let's not
| normalize the opposite expectation. It's a chilling effect.
| chrismeller wrote:
| The iPhone 6S mentioned was released in 2015, but should run iOS
| 15, which Apple still should be releasing security updates for?
| garbagewoman wrote:
| As he clearly describes in the article, Apple seems to patch
| some exploits but not others in older versions of iOS.
| chrismeller wrote:
| I understand that, I'm just saying that they claim it gets
| security updates, so it seems like the kind of thing they
| should include.
| jeroenhd wrote:
| Apple only publishes _all_ iOS and macOS updates to the latest
| version of their operating systems. They release important
| updates to older operating systems (which is better than much
| of their competition!) but not all vulnerabilities are fixed
| for old versions.
|
| You'll probably always be safe from remote code execution on
| supported versions of iOS/macOS, but exploits like these aren't
| always fixed. Unfortunately, you can't install an alternative
| browser engine on iOS/iPadOS, so I guess you should expect all
| websites to be able to read all of your cookies just in case.
| gridder wrote:
| This is a 10 year old phone, released in 2014. Edit. I was wrong,
| 2015, sorry
| refulgentis wrote:
| Correct. The issue is it is not commonly known that Apple isn't
| actually backporting fixes for exploits while it has been
| claiming to update the phones: this is earth-shaking[^1] news
|
| [^1] It would be completely reasonable to say "Earth-shaking?
| Really? You expect security backports for a decade?" I've been
| in mobile my whole career, iOS for 7 years, starting from
| jailbreaking the original iPhone, then worked on Android itself
| for 7 years. I am sure significant decisions were made assuming
| this was the case.
| gridder wrote:
| Touche. P.S. Keep in mind though, what is the state of
| security of the Android phone you bought new in November
| 2015?
| TheDong wrote:
| The Nexus 6 (2014) can still run a version of android with
| security patches: https://wiki.lineageos.org/devices/shamu/
|
| Google no longer offers security patches directly, but
| since you control the phone sufficiently to install your
| own OS, the community can come together and keep security
| updates flowing. You could do it yourself if you wanted.
|
| Apple devices make this sort of community maintainership
| effectively impossible.
|
| I know this means practically nothing since only nerds can
| actually install a third-party ROM, so for the general
| populace only the "default" security patch window matters,
| but for the hacker news crowd it seems like it might be a
| meaningful difference.
| dangus wrote:
| Is my grandma going to install a custom rom? If it's not
| over the air it might as well not exist.
| mattigames wrote:
| Maybe you could be a good grandson and do it for her?
| mattl wrote:
| I don't consider it a good thing to install a custom OS
| for someone and not give them the same level of support.
| fh9302 wrote:
| Does that include updated drivers? If no, then there are
| still many unfixed security vulnerabilities.
| mrcarruthers wrote:
| It's all well and good to say "oh you can just install a
| custom ROM". But you (and many here) can do that. Because
| you're technically inclined. But the vast majority have
| users have no idea what the hell you're talking about.
| They barely know what a security update is or what
| version of Android they're using, let alone being able to
| find, choose, and install a ROM.
|
| Can we just choose to stop suggesting it as a legitimate
| solution cause outside of this bubble, it absolutely is
| not.
| realusername wrote:
| people don't know how to install Windows either. In
| theory they could go to a shop to update their phone like
| their are doing with Windows but the reality is that
| nobody cares about updating their phone.
| tsimionescu wrote:
| But it is effectively impossible on Android as well.
| Let's ignore for a minute the fact that practically no
| one can install a custom ROM.
|
| The bigger problem is that a huge bunch of software
| running on the phone is fully proprietary and closed
| source, and there are many many different versions for
| different phones around - making it virtually impossible
| to do any meaningful reverse engineering. So sure, your
| main OS may be up to date, but the baseband OS and
| virtually all of the device drivers will be left
| vulnerable, and they have just as much if not more access
| to the data on your device.
| lupusreal wrote:
| Is the only standard to which we hold one company whatever
| the other does? Is there no room for higher principles
| here, in your view? The competition between consumer brands
| is all that matters?
|
| Come on.
| geodel wrote:
| Huh, it can be totally earth shaking or completely normal
| depending on time and place. In current market place of
| smartphones it is more towards earth shaking than normal.
|
| You don't have to agree but resell value of older iPhone
| being much-much higher than Android tells customer values the
| support and quality of iPhone.
| mattigames wrote:
| As much as the sales of healing crystals tells me how much
| people value the health and anti-aging benefits of those.
| kaba0 wrote:
| Healing crystals seems to be a much smaller market (to
| the point of barely existing) than "Big Pharma", so your
| analogy doesn't really make sense.
| ionyun wrote:
| Apple still sells previous phones as lesser, but still not very
| affordable, models. The iPhone 7 was released in September 2016
| and discontinued in September 2019. It is also on iOS 15.8 so
| presumably also vulnerable to this. That would be about 4 years
| of security updates. Not the worst but not beating what e.g.
| Google promises for Pixel phones now.
| albntomat0 wrote:
| I looked it up, and the extended security updates for Google
| Pixel is only a recent change:
|
| Pixel 8: released in 2023, updates through 2030 Pixel 5:
| released in 2020, stopped getting updates in October 2023.
|
| https://support.google.com/pixelphone/answer/4457705?hl=en
| jvdvegt wrote:
| Looks like I hit a 'sweet spot' with my Pixel 4a (released
| in August 2020, guaranteed updates until November 2023)
| youngtaff wrote:
| I use a Pixel 4a as a second phone and consider Google's
| approach to be rubbish...
|
| 3 years worth of updates is pretty shit... my son's
| iPhone 5c got updates for over 5 years (and I think there
| were some security issues they patched after that even)
|
| At the moment I've got a perfectly usable Pixel 4a that
| I'm going to have to replace as it's not secure enough
| for work related stuff anymore
| dangus wrote:
| Personally I don't think Apple's level of support is
| incredibly bad when you take a look at the used device
| market. Even with Apple's famously high resale values,
| depreciation on smartphones is huge.
|
| Don't buy brand new old phones new from Apple, they're a
| ripoff. If you buy either an iPhone 12 or 13 used for
| $250-350 you can basically plan on a $50 a year budget to
| have a smartphone that always has the latest OS judging by
| their expected remaining lifespans.
|
| I think the big flaw with the status quo is e-waste more than
| cost to the consumer. I think an iPhone 6S or 7 are
| incredibly slow and outdated devices for today's usage but in
| 5 years I don't think we will be able to say the same thing
| about an iPhone 12 or 13. Smartphone hardware is far more
| mature now than it was even 6 generations deep into the
| iPhone product line.
|
| We should be able to replace batteries for $20 and replace
| things like broken screens for not much more, and Apple
| should be enthusiastic about it considering how services are
| their bread and butter moving forward. Apple should be happy
| to produce fewer phones and keep more consumer dollars
| allocated toward the purchase of high margin digital goods.
| chatmasta wrote:
| > I don't think we will be able to say the same thing about
| an iPhone 12 or 13
|
| The wildcard here is local LLM use cases and any new
| hardware that increases their speed by orders of magnitude.
| dangus wrote:
| That's not really a need for smartphone users. I can
| access an LLM on a website for free right now.
|
| I also don't see any indication that there will be
| impactful local LLM silicon at the smartphone scale
| anytime soon.
| calgoo wrote:
| You can yes, but the rumor is that Apple is focusing on
| adding them directly to your device, and if they
| integrate it deeply in the OS, then it will require the
| chips to run it. I'm sure you will be able to run old
| devices but without the latest Siri for example.
| paulryanrogers wrote:
| Can I get a user replaceable battery instead?
| butlike wrote:
| I just want a glorified iPod from my old phone that won't
| get pwned at the airport.
| davnn wrote:
| Not yet, I believe. Revenue from iPhone sales is still
| quite fundamental to Apple's success, it's more than triple
| the revenue from all services combined (not including
| Google's search engine deal).
| walteweiss wrote:
| I still use a 6s and a fist Gen. se, I won't say they're
| terribly slow. It's the apps, the modern apps, that make
| the device too slow. If you use not so many, it works quite
| very well. The only downside that the OS is not updated any
| longer. Although I got a security update recently, weeks
| ago.
| code_duck wrote:
| It was difficult to locate but I found a new iPhone 7 for
| sale for $92. Seems affordable.
| qball wrote:
| >but still not very affordable, models
|
| The 2020 SE is available from a wide variety of sources for
| 200USD (still new in box); it'll be supported until 2027. The
| 2022 SE is 400USD, supported until 2029.
|
| By comparison the Android phones at this price point
| functionally went out of support 2 years before they even
| existed- not only is there zero support for them, but they
| ship with outdated OS versions to begin with. And no, "but I
| can go to XDA and get a shitty ROM at the cost of my camera"
| doesn't count as support.
| Dylan16807 wrote:
| You had a strong first paragraph, but your second is going
| too far. A Pixel 6a is $349 and supported until 2027. A
| galaxy A15 is $175 and supported until the end of 2028 or
| early 2029. The full feature updates don't go quite as far,
| but they're still offered for multiple years into the
| future.
| fouc wrote:
| Isn't pixel 6 when google stopped using qualcomm modems
| and now has terrible signal reception?
| mrcarruthers wrote:
| You can't seriously give Apple shit for this and at the same
| time praise Google. iPhones have, pretty consistently since
| the 5 or so, received 5 or 6 years worth of OS updates since
| the phone's release whereas with Android phones you'll
| receive 2. Only after years of complaining is Google finally
| promising to support it for longer. And that doesn't cover
| Samsung, etc...
| Dylan16807 wrote:
| We can and should praise Google for improving things, and
| use their new strong points to push Apple into improving
| too.
|
| This isn't a debate about what company is better. The word
| "now" is used for Google's promises for a reason.
| WA wrote:
| > We can and should praise Google for improving things
|
| Let's talk again in 5 years, once they had the
| opportunity to prove their plans. So far, it's all just
| talk.
| beebmam wrote:
| Never forget the Pixel Pass rug pull. I'll never buy
| another Google product.
| kaba0 wrote:
| Especially that a 10 years old phone was very weak in
| terms of hardware, we haven't reached a more plateaus era
| back then. It's much easier to update a phone in the last
| 5 years for 10 years, than doing the same in a 5 years
| earlier window frame.
| lloeki wrote:
| > We can and should praise Google for improving things,
| and use their new strong points to push Apple into
| improving too.
|
| Over a decade of Nexus then Pixel devices being flashable
| has not moved any needle of Apple doing the same. Google
| promising 7 years is in line with Apple's 10 year track
| record of providing 6-8 years of updates, so it's more
| like Google aligning with Apple, not Google pushing
| Apple.
|
| Still, a vague+ promise in a blog post or keynote address
| is not going to fit the bill, at the very least it should
| be in the EULA or other contractually enforceable
| document, otherwise the promise is worth nothing.
|
| Ideally I wish software would be treated as with e.g
| automotive or washing machine manufacturers, who in the
| EU have a legal requirement to provide parts for 10
| years.
|
| + I mean the promise is clearly worded but bears no
| weight, especially when pitted against Google's track
| record over the last decade of making grand announcements
| then puling the rug down the road.
| jeswin wrote:
| But Android also lets you run custom builds, and my 2016
| phone runs the latest OS. Sure not everyone does this, but
| unlike iOS I can take care of it myself.
| parker_mountain wrote:
| > But Android also lets you run custom builds
|
| Yes, but that is only one component of a modern phone.
| Basebands and system bootloaders, among other firmwares,
| don't receive updates. Those are regularly attacked.
|
| It's good that they do but it's not enough.
| lloeki wrote:
| > my 2016 phone runs the latest OS. Sure not everyone
| does this, but unlike iOS I can take care of it myself.
|
| "not everyone" is an understatement.
|
| That's a solution for you (and the dozens - dozens! - of
| people doing the same), in practice it is not for 99% of
| Android users, therefore, again in practice, there's a
| huge fleet of devices with out-of-date software out
| there.
|
| > But Android also lets you run custom builds
|
| That's not even counting that:
|
| - many Android manufacturers make it non-trivial+ to
| root/unlock/flash a build and/or make it blow a warranty
| fuse, and that's if it's even possible _at all_.
|
| - usually the camera goes ape shit, and often loudspeaker
| audio quality too.
|
| - unless you relock the bootloader it immediately
| compromises security and makes bootloader updates
| nontrivial as unlocking again clears the device.
|
| Mind you, this is a fine, intellectually satisfying
| strategy for you and me to be able to flash open builds,
| but it's by and large an extremely fringe strategy, and
| it's been shown over a decade that it's staying that way.
|
| + Often involving downloading random flashing tools from
| obscure forums, that run only on Windows, some of these
| being one shot and requiring to plug in magic numbers
| corresponding to your exact device, and if you screw it
| up the device is bricked (e.g Samsung). Or the unlocking
| is on a low-write-count chip and once you exceed that
| limit the device is bricked (e.g OnePlus). I know, I've
| been there, bricked a few, recovered only one through
| JTAG.
| kaba0 wrote:
| Does it really let you run custom builds when it zeroes
| out proprietary firmware blobs on many models, turning
| your fancy camera into a shitty basic one? Or what about
| the million proprietary blobs you would need for full
| functionality -- will those also get patched?
| 0xFF0123 wrote:
| I feel like the security update period should really be
| measured from the date of last "as new" sale, not date of
| original release.
| polyomino wrote:
| Google doesn't have enough e-fuses to update the pixel phones
| for seven years, the marketing department is incompetent and
| didn't talk to literally the only engineers they should have.
| Dylan16807 wrote:
| Is there a reason you think most updates would even _want_
| to blow e-fuses, let alone _need_ to?
|
| And how many are there, then?
| kernal wrote:
| Does the Pixel 8 use e-fuses? I was under the impression
| that it used a stored rollback index to prevent OS
| rollbacks.
| Almondsetat wrote:
| Apple: proven track record
|
| Google: promises
|
| you're being disingenuous
| SirMittens wrote:
| > Google: promises
|
| Google is not promising this out of the goodness of their
| heart. They're just getting ahead of what the EU is
| planning to mandate [0], and doing that to get some good
| marketing while they're at it.
|
| So, while Google's track record leaves a lot to be desired,
| in this, I think they'll keep their promise, either because
| they actually care, or because the EU will force them to.
| Either way, we, the end users, will benefit from it.
|
| And this will apply to all electronic device makers. That's
| probably why Samsung also increased their updates policy to
| five years as well.
|
| [0]: https://www.insideprivacy.com/cybersecurity-2/eu-
| publishes-d...
|
| > "The requirements apply for the lifetime of a product or
| five years from its placement on the market, whichever is
| shorter."
| kernal wrote:
| >Google is not promising this out of the goodness of
| their heart. They're just getting ahead of what the EU is
| planning to mandate
|
| If that was the case then why did Google exceed the
| requirement by 2 years? Additionally, Google is providing
| 7 years of OS upgrades and 7 years of security updates.
| Google could have easily just do what they did with the
| Pixel 7 and offer 3 years of OS upgrades and 5 years of
| security updates, thus, meeting these EU requirement of 5
| years of updates. So to claim that Google offering an
| industry leading 7 years of OS upgrades and 7 years of
| security updates is not out of the "goodness of their
| heart" is being disingenuous IMO.
| kernal wrote:
| >Apple: proven track record >Google: promises
|
| Do you really think the cost of the class action lawsuit
| and settlement and the bad publicity for not adhering to
| their 7 years of support would not exponentially exceed the
| cost of a team of engineers tasked with supporting updates
| for their Pixel phones?
|
| As for "promises" - why hasn't any other OEM matched or
| exceeded Google? Apple should have been the first one to
| step up the very next day.
| walteweiss wrote:
| Google promises. I don't believe their promises after what
| happened to Google Reader.
| kaba0 wrote:
| Promising is easy - google can't keep maintaining successful
| apps of theirs, let alone a whole phone.
|
| I'll believe it at 6 years in, maybe.
| nindalf wrote:
| > Google _promises_
|
| While Google promises, Apple actually has a decade long track
| record of updating older phones for 5 or more years. We don't
| know if Google will actually follow through on their promises
| or the execs in charge in 5 years will feel differently. But
| I personally bet $1000 that the iPhone 13 will get 5 years of
| OS updates minimum.
| madars wrote:
| It's fine for a vendor to completely abandon 10 year old
| hardware but if you can still pay 30% App Store tax/pay for
| iCloud/etc, the security fixes should be backported as well.
| The current situation is charging full price for inferior (or
| maybe even dangerous) product: Apple wants to have its cake and
| eat it too.
| wtallis wrote:
| Are you really saying Apple should _actively break_
| interoperability with old software?
| madars wrote:
| They should stop charging 30% App Store tax for an inferior
| product at the very least.
| rrdharan wrote:
| What does this mean? The App Store fees are paid by the
| developers / vendors. Are you saying they should pay less
| proportionate to the number of times their apps are
| downloaded to older devices?
| JumpCrisscross wrote:
| > _What does this mean?_
|
| It means they're shoehorning another issue into this
| discussion.
| slaymaker1907 wrote:
| I think it's a completely valid point. Apple is still
| making (potentially a lot) of money off these old devices
| yet isn't willing to fully support them. It seems very
| unethical.
| schiffern wrote:
| > seems very unethical
|
| I agree. Clearly Apple should do the only ethical thing
| and immediately ban all unsupported devices from new App
| Store purchases.
|
| When Apple announces this (very ethical) policy change, I
| expect you to full-throatedly defend Apple from the mass
| shrieking cries of " _but muh planned obsolescence!!_ "
| Right? Right?? ;-)
|
| In fact, one could argue it's also "very unethical" for
| Apple to (negligently) allow someone to use a potentially
| unsafe or hackable product. To be maximally ethical,
| Apple should be remotely bricking any Apple device the
| day it loses security support. Better to be on the safe
| ("ethical") side and remote wipe too, to protect people's
| data privacy.
|
| Can you see how _Argument From I Merely Assert XYZ Is
| Unethical Then Demand Some Arbitrary Relief_ can quickly
| break down?
| gghffguhvc wrote:
| 15% for the vast majority of developers and apps FWIW.
| gnicholas wrote:
| Probably true, but is it the same for the vast majority
| of the app revenue? Quite possibly not.
| wtallis wrote:
| App Store purchases aren't tied to a particular device;
| you can buy an app on an old device and keep using it
| when you get a newer device. Do you have a coherent,
| reasonable suggestion for how Apple could modify their
| business model without completely breaking it, or are you
| just desperate to shoehorn complaints about the App Store
| fees into the conversation?
| madars wrote:
| Easy: offer a discount if purchase is made on an
| unsupported device, just like how grocery stores offer
| discounts for food that's about to expire.
|
| I don't think there is a real concern about app store
| economics collapsing, the app marketplace business is
| very lucrative. We can see this in related cases: you can
| avoid certain iOS taxes by purchasing your subscriptions
| on the web: Twitter Blue is $11 on iOS and $8 on the web.
| Spotify used to be $12.99 for iOS sign-ups and $9.99 on
| the web.
|
| Why should users pay full bundled iOS tax that supports
| security updates, if they are getting none?
| wtallis wrote:
| > Why should users pay full bundled iOS tax that supports
| security updates,
|
| I don't think I've ever seen someone express the
| expectation that Apple's App Store fees are for the
| purpose of supporting iOS development and maintenance.
| Mostly I've seen and heard the expectation that those
| fees are connected to running the App Store itself
| (payment processing, hosting, app review, etc.) and
| beyond that, vague profiteering. iOS itself isn't a
| subscription service, and Apple seems quite happy to sell
| you devices even if you don't spend money in the App
| Store. So you seem to be stretching a bit by attributing
| those fees to iOS maintenance and then turning around to
| say that unsupported iOS versions should get a discount
| on the fees for any services that still work.
| 8n4vidtmkvmk wrote:
| Your purchases carry forward to newer devices, no? If
| nothing else, people would keep an older device just to
| make purchases and then install it on their newer iPhone.
| mrcarruthers wrote:
| They're not charging you, the user that 30%. They're
| charging the developer. Yes that does trickle down to you
| in the developer's pricing, but, in this instance, a
| phone no longer receiving security updates is not an
| inferior product from the point of view of the
| transaction in question.
| kaba0 wrote:
| Why exactly? Does petrol get cheaper for an old car that
| barely works?
| judge2020 wrote:
| iOS 12 was released September 2018 and
|
| > iOS 12.5.7
|
| > Released January 23, 2023
|
| https://support.apple.com/en-us/103015
| leetcrew wrote:
| I don't totally follow this argument. the 30% app store
| commission, iCloud subscription, etc. does not only fund
| security fixes for the OS and core services. I don't think
| the average consumer thinks that's what they're paying for
| either. waiving the fee for EOL'd devices would create a
| perverse incentive of its own.
|
| I do wish apple would follow google's example and commit to a
| service lifetime upfront, but other than that, I don't object
| to their model. in practice, it vastly exceeds the level of
| support for any android phone other than the pixel 8, and we
| have yet to see whether google actually follows through on
| that.
| Closi wrote:
| Also it means that at some point, Apple would have to
| actively block some legacy devices from using iCloud, app
| store, apple music, any app with subscrpitions etc which
| would effectively make the device pretty useless.
| scarface_74 wrote:
| So theoretically - and I tried this a couple of years ago - I
| could still download the "last compatible version" of an app
| if it's available on the store for my old 2010 iPad 1st
| generation running iOS 5.
|
| This device had 256Mb RAM and 400Mhz 32 bit processor. Should
| Apple still support this with security updates?
| handsclean wrote:
| It's an issue of expectations. If Apple advertises security
| support then it's fraudulent to not deliver it; on the other
| hand, if they advertise an EOL date, then I'd agree there's no
| reasonable expectation of security updates. But what they
| actually do is neither, they communicate very little,
| supporting some past iOS versions fully and others to degrees
| that only they know, resulting in them profiting off a
| reputation for backporting security updates while not actually
| binding themselves to deliver it, or, often, doing so.
|
| Like the battery issue, I feel the whole issue is
| communication. Apple needs to communicate when they EOL OS
| versions. You don't otherwise know it, partly because EOL OS's,
| including this phone's, still get security updates, just not
| all of them.
| voidwtf wrote:
| They do communicate it in every major release, including
| which devices are supported. Many major vendors release
| security updates for EOL devices when doing so would greatly
| increase the security posture of those devices and comes at
| little to no cost to the vendor. Notably Cisco, Microsoft,
| Apple, and Samsung come to mind.
|
| Is the implication that once a device is EOL that a vendor
| should never release an update for that device again?
| wtallis wrote:
| > Is the implication that once a device is EOL that a
| vendor should never release an update for that device
| again?
|
| It seems typical for vendors use "EOL" to refer to end of
| _support_ life, not merely discontinuing sales of the
| produce. Most notably, that 's how Microsoft generally
| frames EOL for major Windows releases, hence expectation of
| jumps in PC sales corresponding to EOL of XP, 7, and 10.
| dangus wrote:
| They only communicate it after the fact, when the new OS is
| impending release. There's no way to know at time of
| purchase how many years your device will be supported.
|
| I feel like Apple changed the dynamics of smartphone market
| from company-issued devices like BlackBerry to BYO with the
| iPhone essentially on purpose so they don't get stuck
| providing decades of enterprise support promises like
| companies like Microsoft.
|
| Companies purchasing bulk orders of hardware probably
| wouldn't tolerate a vendor unwilling to make any sort of
| concrete support promise for the contract. But a company
| who employs iPhone users can basically put the
| responsibility on the user and simply block access to non-
| compliant devices.
| handsclean wrote:
| They communicate OS version device compatibility, I'm
| talking about communicating OS version EOL. For example,
| Windows 10 EOL is 2025-10-14, and we know this years in
| advance. For Apple, not only do we not get advance notice,
| we don't even know when it's already happened.
|
| No, I'm not implying there's something wrong with shipping
| the occasional update to EOL devices.
| uxp8u61q wrote:
| Does apple release jailbreak tools for ten year old phones?
| no_time wrote:
| This bug touches nothing hardware specific. In alternative
| timeline where mobile OSes arent fisher price parodies of
| proper operating systems, they could push the same image to all
| iphones and have a proper hardware abstraction layer take care
| of the specific details.
|
| There is nothing fundamentally incompatible about the last
| couple of generation of iphones. ARMv8 CPU, PowerVR derived
| GPU. If the mobile computing space weren't driven by greed,
| this would be a non issue.
|
| A Sandy Bridge era intel machine deployed in 2011 is easily
| capable of running the latest Linux, BSD or win10. And in the
| case of the first two, I'd wager it will continue to be viable
| for the foreseeable future.
| nindalf wrote:
| It's not economical to support devices used by less than 1%
| of the user base. Linux only manages it because community
| members step up to support older architectures. And sometimes
| when no one steps up the architectures are removed.
|
| - Linux dropping support for old graphics drivers (Nov 2023)
| - https://www.phoronix.com/news/Linux-Drop-Old-UMS-DRM-Infra
|
| - Linux Kernel Developers Discuss Dropping A Bunch Of Old
| CPUs (Jan 2021) - https://www.phoronix.com/news/2021-Linux-
| Drop-Old-CPUs
|
| Supporting all of these is work. It makes development of new
| features harder, because it has to account for quirks of
| older hardware. Older hardware is also harder to get in the
| hands of developers and harder to test on. That's why Linux
| has dropped support for 386, 486, IA-64 and other
| architectures.
|
| There's no point saying trillion dollar corporation etc. It
| comes down to some basic fact - phones must be built with
| SoCs, that's the easiest way. The PC way doesn't work at
| scale. Now that we are on SoCs you have to draw the line on
| support somewhere. Just because the costs imposed on future
| development aren't obvious to us doesn't mean they don't
| exist.
|
| I think 5 years minimum (and sometimes more) of OS updates is
| pretty good, FWIW.
| beeboobaa wrote:
| Shrug. That's their problem. Or it should be, at least.
|
| Don't sell crap you can't support for a decent amount of
| time. Stop ruining this planet we live on by creating
| immense amounts of e-waste every few years.
|
| We both know your argument is dishonest or at least naive,
| though. They could easily support updates if they want to.
| But it's about money. This way they are forcing people to
| buy a new phone every few years. It's clever, shame about
| the planet.
| nindalf wrote:
| > dishonest
|
| Dishonest? You're saying I'm lying to support a trillion
| dollar corporation I have no financial stake in and never
| have? Is such an accusation really in the spirit of this
| forum?
|
| I suggest you review the guidelines -
| https://news.ycombinator.com/newsguidelines.html
|
| Don't be snarky. Don't sneer. Assume good faith.
| smoldesu wrote:
| I will say that certain comparisons (eg. "The PC way
| doesn't work at scale") are objectively wrong. Even
| _Apple_ uses the PC model internally, despite not having
| an open bootloader or really supporting UEFI anymore.
| AFAIK, the XNU kernel even uses the same DeviceTree
| layout as Linux for supporting ARM SOCs. Apple hasn 't
| really broken any new ground that can't be re-covered by
| modern operating systems.
|
| Also, your claim that it's "not economical" is entirely
| unproven and arguably false. iPhones are still
| architecturally supported by Linux and will continue to
| be for a while (even longer on BSD). Other Apple products
| (eg. Apple Silicon) received community driver support
| entirely from donations and volunteer time. There's no
| reason to assume that iPhones lack community interest,
| especially since Apple has never given the iPhone
| community the same leverage they had on Mac.
|
| If that's the sum of both arguments, then you're mostly
| just leveraging FOMO to support an unproven concept. At
| best you're jumping the gun, at worst you're twisting the
| facts to preclude discussion of open iPhone software
| alternatives.
| zarzavat wrote:
| It's absolutely economical. Apple only has to support a
| tiny number of devices that they themselves manufactured,
| they have the easiest job in the world.
|
| Think about how many devices Microsoft has to support in
| Windows, it's orders of magnitude more.
|
| Apple doesn't _want_ to support older devices because they
| don't see a benefit to themselves.
|
| 5 years of support is pitifully short. Pretty much
| everything I own lasts longer than 5 years, my phone is one
| of the things I have to replace most often, not because the
| hardware is broken, but because it stops receiving updates.
| traceroute66 wrote:
| > It's absolutely economical. Apple only has to support a
| tiny number of devices that they themselves manufactured,
| they have the easiest job in the world.
|
| Bullshit. I really can't believe someone on a technical
| forum really believes such bullshit.
|
| New devices = New components = New Firmware = The updates
| have to stop sometime
|
| In the end its simple. Apple is an OEM for most parts on
| their board, if upstream support ends for the components
| on the board then its game over as far as firmware
| updates goes. Its not rocket science.
|
| And its certainly NOT economical to keep stuff running
| forever. Look at OpenBSD and Theo famously begging for
| money to keep his basement of antique equipment running
| at enormous expense !
| krisoft wrote:
| > New devices = New components = New Firmware = The
| updates have to stop sometime
|
| So how does microsoft do it? My PC is about the same age
| yet it is still supported. And not even barely, but
| without a hitch.
|
| > Apple is an OEM for most parts on their board, if
| upstream support ends for the components on the board
| then its game over as far as firmware updates goes.
|
| But this is not an issue with a chip's firmware. Do you
| believe apple can't compile code for their 10 year old
| hardware or how do you think this happens?
| CorrectHorseBat wrote:
| >And its certainly NOT economical to keep stuff running
| forever. Look at OpenBSD and Theo famously begging for
| money to keep his basement of antique equipment running
| at enormous expense !
|
| If OpenBSD can do it on a budget that's pocket change for
| Apple, with much more diverse hardware which they have no
| control over, then Apple definitely can do it.
| smoldesu wrote:
| Is it really bullshit? Lenovo manages hundreds of laptop
| models via fwupd, and those work just fine after they
| lose OEM support. I've got a Thinkpad from 2009 that
| still gets modern Linux patches (to say nothing of my
| 2006 PowerBook running Arch/Plasma 5).
|
| Compared to what Apple makes off hardware and service
| revenue, the cost of opening iBoot and providing basic
| firmware support would be almost nothing. It's _so_
| economical that the volunteers at Asahi were capable of
| replacing the missing bits via black-box reverse
| engineering. You want to tell me that Apple is incapable
| of releasing that firmware themselves? On a technical
| forum?
| no_time wrote:
| >It's not economical to support devices used by less than
| 1% of the user base. Linux only manages it because
| community members step up to support older architectures.
| And sometimes when no one steps up the architectures are
| removed.
|
| Again, bugs are this are not hardware specific. You are not
| supporting "devices". You are supporting the OS which all
| of them run. Ideally (I'm not familiar with OSX/iOS
| internals) all they have to do is push out an update that
| contains the newly fixed libwebkit.so or whatever. They
| control everything on their own platform so they don't even
| have to deal with glibc breaking backcompat like we have to
| in the GNU/Linux world.
|
| If they can't figure out a way to make changes like this
| universal across devices, it's either deliberate negligence
| or incompetence.
| beeboobaa wrote:
| My 10 year old laptop is still getting OS updates
| hulitu wrote:
| > My 10 year old laptop is still getting OS updates
|
| Microsoft is trying to fix this. Win 11 wants a TPM. /s
| charcircuit wrote:
| This is true for pretty much every vendor. Security fixes do not
| all get backported to every previous version of something. Newer
| iPhone do not just run the latest version of iOS, but they are
| more secure from a hardware perspective too.
| Sporktacular wrote:
| "every previous version"
|
| No reasonable person is asking for this.
| charcircuit wrote:
| Okay replace that with "more than the latest version / LTS".
| eviks wrote:
| How is hardware relevant here?
| SirMaster wrote:
| How do we know they won't patch it in like an iOS 15.8.1 update?
|
| Even iOS 12 had a security update in 2023 still.
| mrcarruthers wrote:
| Apple doesn't patch every security hole in older iOS versions.
| I don't know what the criteria is, but my guess is if it's a
| major security hole, or an easily backported one, they'll do
| it, but if it's super minor or not backportable, they won't.
| saagarjha wrote:
| If I had to guess, I think it's when they see a report that
| it's been actively exploited.
| Sporktacular wrote:
| The iPhone 8 was sold new less than 3 years ago. Okay, new
| features shouldn't be expected, but patching known
| vulnerabilities should be required.
| sparselogic wrote:
| What does the iPhone 8 have to do with this discussion?
|
| The linked piece specifically refers to iPhone 6S and iOS 15.8.
| 43920 wrote:
| It runs iOS 16, where Apple has the same policy of only
| providing partial fixes. From the article:
|
| > A new exploit targeting the iOS (among other OS') Bluetooth
| stack has also been left unpatched by Apple in all versions
| except iOS 17.
| mattl wrote:
| iPhone 8 had a patch to iOS 16 released a week ago, 6 years
| after it was released and 3 years after it was last sold during
| a global pandemic?
| avarun wrote:
| And the entire point of the article is that those security
| patches are ignoring known vulnerabilities that are patched
| by Apple in iOS 17.
| Sytten wrote:
| That is why I am an android dude, you will always find a random
| ROM on xda with the latest android security patch and sometimes
| even the latest android version on devices 10+ years old even if
| the manufacturer has stopped supporting it a while ago.
| appplication wrote:
| Not going to lie, if I were trying to infect some devices, it
| might be through "porting" unofficial "patches" (that no one
| will ever realistically inspect) for 10+ year old, out-of-
| support devices whose users have allowed root access.
| Sytten wrote:
| XDA works a lot on reputation and realistically you will
| infect like 1k phones none of which will be high value
| targets. I don't see the motivation. Those maintainers do
| quite a lot of work to backport patches every week/month and
| offer OTA. Also I dont enable root when flashing, that is not
| required at all.
| eli wrote:
| think about it the other way: if someone who happens to use
| random ROM happens to be a target of a state security
| agency _of course_ it would be trivial to infect and the
| other 999 users would be collateral damage.
| jojobas wrote:
| If state security agency is your model threat you'll be
| hard pressed to stay secure even with an airgap. If it's
| wholesale worm-like attacks you'll be way ahead of the
| curve by using a niche ROM from a god-forsaken site
| compared to any slightly out-of-date OEM distro.
| WWLink wrote:
| Realistically, if someone makes a fringe rom that may be
| downloaded a few thousand times, how many people are going
| to bother checking for nefarious exploits hidden in there?
|
| I hate that I wrote that lol. It reeks of the kind of
| cybersecurity whataboutism that leads to people
| inconveniencing the SHIT out of themselves for the sake of
| security.
| Sytten wrote:
| I think human laziness can be counted on. Realistically I
| dont see any benefit in doing something nefarious and
| there is karma like on HN.
| woah wrote:
| Wait... so because you don't want to be infected because
| you're using an out of date OS, you load OS patches of
| questionable provenance, but you're not worried about that
| since nobody would bother to infect you anyway? Why not
| skip a few steps there and just run an out of date OS?
| yjftsjthsd-h wrote:
| _Every_ device running an old OS is vulnerable, so it 's
| better to throw the dice on an aftermarket ROM.
|
| Edit: Though to keep things fair, it must be said that
| that particular argument only really applies to old
| devices. If you have a new device (or rather, one still
| getting regular security updates from the vendor) and a
| trustworthy vendor, a person could reasonably argue for
| staying on the stock ROM.
| woah wrote:
| Fair point
| websap wrote:
| lol! Are you really comparing Apple released operating system
| updates to xda?
| Sytten wrote:
| The whole point of the article is that they don't actually do
| that
| mattl wrote:
| How does a random image help most users?
| flanked-evergl wrote:
| I guess bricking your device makes security irrelevant
| kernal wrote:
| What about the binary blob drivers that can't be patched and
| are one of the leading attack vectors? Just look at all of the
| Qualcomm monthly patches alone . Unless all of your binaries,
| that have no source, are up to date you'll never be secure on
| any XDA rom.
| Sytten wrote:
| That is a real problem agreed, though vendors are starting to
| OSS more of those lately. Still better than running an
| unpatched android of 4 years.
| Aurornis wrote:
| > you will always find a random ROM on xda
|
| Installing random ROMs from random developers is an interesting
| take on security.
| Sytten wrote:
| That was bad phrasing, there is karma on XDA and trusted name
| reputation (evolution x, pixel experience, lineage os). So it
| is not a random ROM from a random dev. And you always have
| the source for those builds.
| MBCook wrote:
| > After contacting Apple [...]
|
| I'd be very curious to see HOW they contacted Apple. Depending on
| if you're reaching out to security or just filing a standard
| radar I'd expect a very different answer.
|
| Also, was it reported to the WebKit team? If that is where the
| bug is, perhaps that's who should be taking the report?
| 8n4vidtmkvmk wrote:
| It can make a big difference who reads the ticket. I might see
| something come in and think oh yeah that'll take me 5 min to
| fix and I'll just do it, but if someone else unknowledgeable
| about the feature sees it, or a PM... it might get closed as
| won't fix at best or just rot for 10 years.
| mmsc wrote:
| OP here. It was reported to product-security@apple.com.
| xyst wrote:
| Those Apple commercials purporting their ecosystem was the
| safest/secure have aged like old milk
| fh9302 wrote:
| Which 10 year old phone is more safe / secure?
| hulitu wrote:
| > Which 10 year old phone is more safe / secure?
|
| Windows Phone ? I bet nobody writes exploits for it anymore.
| /s
| Klonoar wrote:
| Not really, no.
| devaiops9001 wrote:
| Would be great to get Linux running on and driver coverage for
| all of the system-on-chip of these devices. Talent exists for
| this but they are busy with their jobs or more interesting
| problems.
| kaba0 wrote:
| https://projectsandcastle.org/
|
| But don't get too excited.
| conradev wrote:
| /etc/passwd is the same on every device because it is in the
| system image, which is world readable. I don't think this exploit
| can be used to read the call history database as the author
| implies because it is outside of the sandbox profile.
| saagarjha wrote:
| It probably does let you grab cookies and browsing history from
| Chrome, though.
| midtake wrote:
| > probably
|
| I wish the author included a full proof of concept
| turquoisevar wrote:
| Yeah the author goes a bit far in their hypotheticals, straight
| into fantasy.
|
| Also not sure I agree with the implication that Apple shouldn't
| publish which vulnerabilities they've patched (the only logical
| conclusion because the alternative, patching every version in
| perpetuity, is unrealistic).
| lewantmontreal wrote:
| Some iOS 15 phones like the 5S/SE have no newer comparable phones
| which makes upgrading difficult. Oh dear, I suppose not browsing
| the web is another option.
| mattl wrote:
| What's missing from the more recent SE models?
| qball wrote:
| Small physical size, also a headphone jack.
|
| The more recent SE models are iPhone 8 bodies with upgraded
| internals (being an iPhone 11 and 13 inside, respectively)
| and Apple no longer offers a Mini version of their newer
| phones (not that the A16 and A17 are significant improvements
| on the A15, but still).
|
| And the Mini is still larger than the first SE by about a
| half inch in either direction; the 8 (and the newer phones)
| add another half inch on top of that.
|
| Of course, the problem with using a first-gen SE today is
| that because information density on mobile is abysmal, the
| added vertical space has been very welcome to app developers
| (who also might not test on the smallest screens). So while
| the smaller phones were ergonomically far superior to the
| larger ones, and this is to a point true for the Minis as
| well, that's since been "balanced" by inherently worse UI/UX
| on said phones.
| usui wrote:
| A 4-inch screen size that allows the phone to be used single-
| handed with ease anywhere on the screen, which I'm using to
| write this comment right now. It's uncompromising in battery
| longevity when considering its size, too. First-gen SE is the
| best phone Apple ever made. The newer SE are terrible.
| fouc wrote:
| As someone that went from 5S to 2016 SE to 2020 SE which is
| my current phone, I've been very satisfied with the 2020
| SE.
|
| With each phone I have always taken steps to reduce battery
| usage, disabled background refresh, and manually turn on
| low power mode after charging every single time.
| usui wrote:
| Is your hand large enough to handle the phone one-handed
| and touch anywhere on the screen with ease without
| risking a drop? If not, do you use some kind of magnet
| finger-ring case or similar case?
| mattl wrote:
| I have my iPhones set to bring the top of the screen to
| the middle when I double tap on the Apple logo on the
| back.
|
| It's a feature called Reachability.
|
| https://support.apple.com/guide/iphone/use-reachability-
| iph1...
| mmsc wrote:
| Always a smile when I see my blog posted on hn:)
|
| To answer three questions:
|
| 1) this was not reported in the context of any bug bounty[0], and
| the total conversation between me and Apple is 4 emails (1: hello
| do you plan to fix this? 2: can you reproduce this on the newest
| ios17? 3: no. 4: if you are able to reproduce it on ios17 let us
| know)
|
| 2) exfiltration is obviously possible, I'm not sure why I would
| even need to specify that any page is able to read its own
| contents using JavaScript
|
| 3) the iPhone 6s and 15.8 are still seemingly supported by Apple.
|
| [0] and you won't find me on any bug bounty websites except for
| where I try to get contact with humans, see
| https://joshua.hu/slack-is-broken-with-noscript
| denysvitali wrote:
| Getting in touch with an human is generally "easy": getting in
| touch with an engineer isn't.
|
| It's sad that one has to open a bug bounty request to get an
| engineer to look into an issue like the one you described in
| your linked blog post.
| asabla wrote:
| It,'s always a fun and interesting read when your posts hit HN.
|
| How much time would you estimate goes into researching? And do
| you have any pointers for someone which want to dip their toes
| into this vast sea of exploration?
| mmsc wrote:
| This wasn't really my "finding" per-se (the original
| vulnerability was from June, after all), it was just
| something that came into my eyes and I thought it would be
| interesting to discuss the implications and some perceptions
| I have based on it.
|
| >And do you have any pointers for someone which want to dip
| their toes into this vast sea of exploration?
|
| Can you expand on what you mean by this exactly? I got into
| security by accident when I was a child and have never
| followed any type of routine when it comes to learning.
|
| Probably the only pointer that may help is: take something
| that you know and use often (some piece of software) and ask
| "what if?" or "why can't I or someone do X?" -\\_(tsu)_/-
| y7 wrote:
| > exfiltration is obviously possible, I'm not sure why I would
| even need to specify that any page is able to read its own
| contents using JavaScript
|
| Things that are obvious _to you_ may be non-obvious to other
| people, including the readers of your blog.
| br0wnr1c3 wrote:
| In the context of their blog post, it's assumed that the
| reader has some knowledge of web technologies -- if you can
| print data to your own webpage, you can also exfiltrate it.
|
| It's not reasonable to expect the author to explain _every_
| underlying technology involved since that was likely not the
| scope of the post.
| oefrha wrote:
| You didn't answer the biggest question: being able to read
| /etc/passwd does not imply being able to read any of the
| sensitive files listed under "What files could somebody steal?
| Well, there's always:". Did you actually test any of those?
| mmsc wrote:
| I only tested passwd at the time and I don't currently have
| access to the 6s to test the other files. I can report back
| whenever I get access to that phone again.
| CodeWriter23 wrote:
| Welcome to HN, in as gentle a way possible I refute this
| statement
|
| > Apple continues to support nearly-decade-old devices like the
| iPhone 6S, which and iOS 15.8 is still powering those devices,
| seemingly with official Apple support, with the latest update
| from October the 25th, which addressed some security
| vulnerabilities.
|
| With: try to update your Apple Watch with a device running the
| latest iOS 16
| mmsc wrote:
| https://ibb.co/fn84p09
|
| This photo was taken the day the blog post was published.
| CodeWriter23 wrote:
| And yet, I am still unable to update my Apple Watch with
| the latest iOS 16. iOS 17 is now required. iOS 17 is also
| required to rent a movie on my Apple TV.
|
| So, to the author's assertion that "Apple does a good job
| supporting old hardware", they may give some security
| patches but interoperability between current and previous
| versions is seemingly deliberately broken.
| Pathogen-David wrote:
| I think a lot of people here are missing an important point here
| that Apple has always been fairly ambiguous about what their
| level of support is for older devices beyond major feature
| updates.
|
| If it weren't for a friend giving me his old iPhone XS as thanks
| for a favor, I'd probably still be using my old iPhone 6s--and I
| would not have worried about it from a security perspective
| purely because (as the article notes) Apple is still releasing
| security fixes for iOS 15. I'd feel differently if Apple had
| publicly stated that all iOS 15 security fixes from now on will
| be on a minimum effort basis only.
| K0nserv wrote:
| Apple, in my opinion, does a very good job of supporting old
| devices. Buying an iPhone and keeping it for 6 years is a great
| strategy and when amortising the cost of the phone over those 6
| years, it's price competitive with Android.
|
| I do wish legislators forced Apple and Google to give users a
| path to install an alternative OS on their device. That would
| enable old iPhones(and Androids) to have their lifetime extended
| further.
| izacus wrote:
| > I do wish legislators forced Apple and Google to give users a
| path to install an alternative OS on their device.
|
| All Google phones allow installation of alternative OSes (and
| are pretty much the only phones that allow resigning the boot
| loader so they're still secure - which is why they're chosen by
| projects like GrapheneOS). Why do you think they need to be
| forced into anything? You can buy a Pixel right now and run an
| alternative OS.
| K0nserv wrote:
| Yeah I know some devices already support this, the point of
| forcing it via legislation would be for those that don't.
|
| I think this is also the answer to "the app store question".
| It feels unfair to force Apple to change a core value
| proposition by forcing them to allow side loading, but in the
| spirit of "It's my device" it should be possible to install
| an OS that makes a different tradeoff e.g. Android
| zote wrote:
| I interpret their comment as suggesting that Apple should
| adopt a similar approach, and that Google, as a platform
| owner, should mandate this requirement for licensing
| Android(tm) (not AOSP) to other OEMs (I've had several phones
| whose bootloader couldn't be unlocked), and for this to be a
| practice enshrined by law for any other such companies that
| could operate in a similar position.
| blacksoil wrote:
| I think the biggest problem is in the alternative OS. Non-
| official OSes typically are unstable that I personally find
| not worth the time given phone is quite important piece of
| communication. As others have already mentioned, certain
| lines and brands, such as One Plus, Google Pixels, etc have
| unlockable bootloader so people are free to install custom
| OSes.
| andrepd wrote:
| I've been installing alternative ROMs on my android phones
| for almost 15 years. Never did I have any stability issues,
| on the contrary: the community ROMs often did a much better
| job than the official ones in terms of battery management,
| etc.
| FirmwareBurner wrote:
| _> Buying an iPhone and keeping it for 6 years is a great
| strategy and when amortising the cost of the phone over those 6
| years, it's price competitive with Android._
|
| What's stopping you from keeping your Android 6 years making it
| an event better value? Most people I know don't throw away
| their Androids after 3 years but keep them as long as iPhones.
| Basically until it breaks/dies. So far I don't know anyone who
| got hacked and suffered damages for using an Android that
| stopped getting updates.
| K0nserv wrote:
| Shorter patch cycles - at least historically, I haven't kept
| pace with the Android ecosystem. That said, with Android you
| can use a different OS and keep the device secured
| FirmwareBurner wrote:
| Sure, but like I said, people don't throw away their phones
| once they get stop getting SW patches the same way they
| don't throw away their ancient Macbooks with glowing Apple
| logos just because Apple stopped pushing OS updates years
| ago, because most non-HN people have no idea what patches
| are and they keep their phone and laptop as long as it
| still works and the battery lasts.
|
| Obsession with zero day patches and security hypochondria
| is mostly a HN/tech-workers thing as if they're under
| attack by state actors using Pegasus. The average joe
| doesn't care not is he very likely to be impacted, unless
| using Android Jellybean or something, since most malware in
| the wild out to get them is script kiddie level not state-
| actor level.
|
| And anyway, someone correct me if I'm wrong, but from my
| knowledge and experience with Android security, most
| Android critical vulns that can impact the day to day
| security of the Average Joe are covered by updating Google
| Play services and Chrome or whatever browser you use as
| those are the main attack surfaces for (non state
| sponsored) malware based on what people do with their
| phones, and those services keep getting updates from Google
| long after the manufacturers stopped pushing OS updates.
| signal11 wrote:
| > So far I don't know anyone who got hacked and suffered
| damages for using an Android that stopped getting updates.
|
| That's a "hope for the best" approach to security, for me
| it'd be irresponsible to recommend it to even friends and
| family.
|
| But if you want to do it with knowledge of the potential
| problems -- go for it. It's your phone and your data.
| FirmwareBurner wrote:
| Please don't twist my words. I never said anything about
| recommending such a lifestyle to people. All I said was,
| using older devices without SW support, is the reality for
| a lot of people if you care to leave the tech bubble and
| see what devices people actually use, especially the not
| well off ones. Yes, a lot of people keep using their older
| device and they haven't got hacked. How do you get them to
| stop using their older devices, if they're happy with them
| and see no obvious threat and don't want to buy a new one?
|
| Here's a though exercise: Most people use their device for
| browsing the web and messaging people, right? So as long as
| you keep your Play Services, browser and messenger apps up
| to date, how will malware get to the outdated layers of
| your OS to PWN you? Especially that modern web browsers and
| Andorid use sandboxing for apps and web tabs. I'm talking
| about realistic documented scenarios from the wild that
| have happened and are likely to repeat again, not state
| actors or scenarios from research labs where they hack you
| through the firmware vulns of the baseband modem.
|
| Like I said, I'm not recommending you still use unpatched
| devices, but the realistic risk from using an Andorid
| device that stopped getting updates a year or so is
| relatively minimal in practice, otherwise there would be
| mass hacks and credential thefts left and right on a daily
| basis considering how many unpatched Android phones are out
| there.
| windexh8er wrote:
| Not when you can load an OS like Calyx [0], GrapheneOS [1]
| or LineageOS [2]. In this context the iPhone ends up the
| true "hope for the best" option. The original Pixel / Pixel
| XL (2016.10.04) can still run the latest LineageOS with
| current patches [3].
|
| [0] https://www.lineageos.org/ [1] https://grapheneos.org/
| [2] https://calyxos.org/ [3]
| https://download.lineageos.org/devices/sailfish/changes
| signal11 wrote:
| I was responding to the parent who recommended using
| unpatched, out of support Android.
|
| People who're comfortable (or can be bothered) installing
| alternative OSes on their phones have an entirely
| different view on device obsolescence. Statistically
| they're also a rounding error in the total mobile-using
| population.
| _____k wrote:
| Well android patching after 3 years is pretty new thing
| compared to Apple policy. Apple was and is keeping security
| updates for very long time with major updates on top of that
| for iOS. Not knowing someone does not mean they will not be
| hacked or already has not been by downloading some app from
| the store.
| tomaszsobota wrote:
| fwiw I tested this and the exploit doesn't work on iOS 16 which
| is the latest available for a 2017 iPhone X.
| daft_pink wrote:
| I feel this is misleading as most iPhone users are totally aware
| that iPhone Models not running iOS 17 are not being actively
| updated.
|
| The list is widely published:
| https://support.apple.com/guide/iphone/models-compatible-wit...
|
| Any model more than 5 years old (Xr and Xs) are essentially not
| being updated and not secure. So an iPhone 1, 3, 5, 6, 7, 8 and X
| are all not secure and most people who use the iPhone are totally
| aware of this.
|
| It's like writing an article that Windows 7 is insecure and
| Microsoft isn't patching it. This is essentially their policy in
| most cases.
| e40 wrote:
| According to the link Xs is supported.
| acer4666 wrote:
| The parent comment says this - anything _older_ than XR or XS
| is no longer supported
| e40 wrote:
| > Any model more than 5 years old (Xr and Xs) are
| essentially not being updated and not secure. So an iPhone
| 1, 3, 5, 6, 7, 8 and X are all not secure and most people
| who use the iPhone are totally aware of this.
|
| That reads very much like X's are not supported. The 2nd
| sentence even says it explicitly.
| oynqr wrote:
| That was about the literal iPhone X (the letter X). The
| iPhone Xr and Xs (roman numeral 10) are still supported.
| lemoncucumber wrote:
| It's made more confusing by the fact that the comment
| omits all the S models from the list of unsupported
| models (along with the iPhone 4 for some reason).
|
| So at a glance one could assume that the XS is lumped in
| with the X just like the 6S is lumped in with the 6.
| daft_pink wrote:
| Sorry for my poor drafting. I agree with your comment.
| tjoff wrote:
| This is about the browser, not the OS. The unique thing about
| apple is that they tie the browser to the OS. So you won't even
| get application updates, which is quite surprising for anyone
| that has ever touched a computer.
|
| That is some Windows 98 nonsense right there.
| frizlab wrote:
| IIRC the browser is a part of the system because the engine
| is used everywhere in the system. For a long time in iOS it
| was WebKit that rendered attributed strings for instance.
| tjoff wrote:
| FYI that is exactly what Microsoft proclaimed back in the
| day.
|
| Doesn't sound better today does it?
|
| At least on Windows they didn't prevent you from installing
| a different browser.
| daft_pink wrote:
| I understand your point, but I just think the headline....
| "No new iPhone? No secure iOS" is misleading, because iPhone
| xR and xS, iPhone 11, iPhone 12, iPhone 13 and iPhone 14
| models are all not new iPhones, but they receive secure iOS
| updates. The headline suggests only brand new iPhones are
| secure, but when you click they are talking about deprecated
| devices more than 5 years old that most users know do not
| receive updates just like Microsoft/Android or any other
| vendor, Apple explicitly stated they won't update these
| devices and most users are aware of this fact.
| adrianN wrote:
| I'm pretty sure most iPhone users are unaware of which version
| of iOS they run.
| grvdrm wrote:
| Exactly my thought as well
| cyphar wrote:
| This is addressed in the second paragraph of the article. The
| iPhone 6S had an OS update in October 2023 (iOS 15.8) _which
| included a security fix for a different issue_. The Chromium
| security issue was fixed in June 2023.
| superlupo wrote:
| I have been a developer and nerd since 25 years, and I always
| expected that Apple also patches some previous versions. E.g.
| around a week ago they released both iOS 17.2.1 and iOS 16.7.4:
| https://support.apple.com/en-us/HT201222
|
| So why should I assume that latest iOS 16 isn't completely
| patched? I think it's a shame to say at least that Apple has no
| public policy of how which OS versions are supported and which
| are not, it's just guesswork. Whereas I definitely know how
| long Microsoft supports Windows versions, e.g. Windows 10 until
| October 14th, 2025: https://learn.microsoft.com/en-
| us/lifecycle/products/windows...
| 999900000999 wrote:
| I don't know what OP expects from such an old device. Apple goes
| above and beyond other manufacturers in terms of support.
|
| The phone is almost 10 years old, the only thing Apple should do
| is send out a push notification warning users their device is no
| longer supported.
| CivBase wrote:
| My laptop is older than that and I have no problem getting
| updates. Turns out tightly coupling hardware and software for
| general computing devices is not such a great idea for users or
| the environment.
| 999900000999 wrote:
| Microsoft straight up disallows Windows 11 installation on
| plenty of PCs that could easily run it.
|
| Sure you can argue that it's "easy" to install Linux on it,
| but that's out of scope for the typical user.
| smoldesu wrote:
| Apple straight-up disallows MacOS updates on plenty of Macs
| that could easily update, too. I'd even argue they're worse
| than Microsoft about it; I heard about Opencore Legacy
| Patcher _looooong_ before I knew people were modifying
| Windows 11 images to get a working install.
|
| > you can argue that it's "easy" to install Linux on it
|
| In my experience, the average Linux install wizard is less
| technically involved than the MacOS one. So yeah, maybe I
| would argue that.
| 999900000999 wrote:
| Most people don't even know how to install an OS.
|
| I wouldn't expect the typical person to be able to do it.
| fulafel wrote:
| Quoting the post:
|
| > iOS 15.8 is still powering those devices, seemingly with
| official Apple support, with the latest update from October the
| 25th, which addressed some security vulnerabilities.
|
| > In reality, however, Apple seems to only be addressing some
| security issues in its older supported devices.
|
| The author is surprised, reasonably IMO, that if a device is
| getting security updates, you are still exposed to known
| vulnerabilities.
|
| For a tech competent user this is worse than clearly being out
| of support in which case you would retire the device.
| 999900000999 wrote:
| Well that's just weird, you either support devices or not.
| luke-stanley wrote:
| It's worrying to me since it's often kids who get the hand-me-
| down phones. I don't think they are going to know how vulnerable
| their data is. Surely Apple could at least let a community
| compile latest security updates, if they don't wanna invest their
| many riches in it? People often can't afford newer phones, and
| their data is vulnerable.
| ijio2iii wrote:
| Microsoft still release security updates sometimes for 22 years
| old Windows XP.
| 6510 wrote:
| Moving the photos and videos to a hard rive is a pain usb is
| buggy, icloud is useless. Cheaper iphones have very little
| storage and there is no ssd slot either. It means, when the phone
| is full you have to buy a new one. If you want to update
| (assuming updates are available) you have to do hours of manual
| photo and video deletion to make space for the update.
|
| If they really wanted to update phones that are full they could
| move the images/video to their server until the update is done.
___________________________________________________________________
(page generated 2023-12-28 23:02 UTC)