Hacker News Reader

Comment by saagarjha | Hacker News Reader

> Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

Are independent discoveries of bugs common?

View on HN

Yes, but also bugs "overlap" in multiple different ways; the most obvious is that a "similar" bug in a different code path will, at a company like Apple, Microsoft, or Google, result in a hunt for the same pattern on other code paths, but also the fix for one bug can kill multiple bugs elsewhere. So even though people do sometimes find exactly the same bug --- I'm fond of pointing out that at Matasano, Vitaly McLain found the nginx equivalent of Heartbleed within 2 hours of someone else reporting it --- that doesn't actually have to happen for someone else's work to kill your bug.

In addition, real exploits often involve exploiting multiple bugs in order to be really useful

You're conflating an exploit for a narrow bug target class with a malware package which likely contains one or more exploits and probably a payload. The act of exploiting requires much more than an exploit alone to have the desired effect.

What's meant is that real exploits require one to get RCE, another to break sandbox, another for privilege escalation.

Also maybe an infoleak to set up the RCE.

Yes - if you go by the iOS 12.1.1 security notes, for instance https://support.apple.com/en-us/HT209340 , it appears that CVE-2018-4435 was discovered independently (on the same day, even!) by TrendMicro / ZDI https://www.zerodayinitiative.com/advisories/ZDI-18-1365/ and Google Project Zero https://crbug.com/project-zero/1671 , whose reports don't mention each other. CVE-2018-4438 is also credited separately to both Qihoo and Project Zero, and the P0 report https://crbug.com/project-zero/1649 again doesn't mention Qihoo. I've seen this sort of thing with some frequency in previous update reports.

Also, somewhat famously, both Spectre and Meltdown were discovered independently by multiple teams in the same timeframe, who all coordinated disclosure with the CPU vendors etc. https://meltdownattack.com

Reply on news.ycombinator.com