Hacker News Reader

Comment by greenie_beans | Hacker News Reader

so...as a dumb consumer, how do i protect myself from this?

Always promptly install security updates. Other than that, there is no protection from this specific class of vulnerabilities.

There are other good security practices a slightly savvier user can follow, like running a soft firewall and installing fewer apps, but they wouldn't mitigate this vulnerability.

This sounds nice in practice, but real world says that there is a greater than zero chance that the quickly released patch can have a negative affect on your device up to bricking the device. As a long time Apple user, I never install version X.0. I wait until at least X.0.1.

I think you’re mistaking the stability of Apple’s x.0 releases as “negative effects” of security patches.

x.0 releases do a lot more than patching. Security updates are much smaller and more frequent than even x.x.1 updates

There are is such thing as a "security patch" for iOS. If they release an update, they are releasing features as well. How quickly we forget the debacle that is iOS13. This was not a smooth deployment[0]: 13.0.0 9/19/19 13.1 9/24/19 13.1.1 9/27/19 13.1.2 9/30/19 13.1.3 10/15/19

I wait a couple of days to make sure updates are not bricking devices. Waiting just a week saw 3 updates and a 4th within 10 days. Some of those updates saw serious crippling of capabilities of the device after the update.

[0] https://en.wikipedia.org/wiki/IOS_version_history#iOS_13

Oops, I was talking about macOS releases, not iOS. The numbers don’t match between the two

There is no protection against adversaries that have the resources it takes to stockpile exploits like these.

Feel good in that you are probably not important enough for them to target you..

I wonder if Jamal Khashoggi considered himself "important enough"?

Or his Canadian friend Omar Abdulaziz?

https://www.washingtonpost.com/world/middle_east/khashoggi-f...

If not, they should have.

Project Zero usually releases the details 90 days after they've found the exploit, giving hopefully ample time for Apple to patch the bug. So assuming they have, simply being on the latest version means you are safe.

> This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019).

> The vulnerability was first mitigated in iOS 12.4.1, released on August 26, by making the vulnerable code unreachable over iMessage, then fully fixed in iOS 13.2, released on October 28 2019.

(From the previous blog post in the series.)

That's also assuming Project Zero found this first...

I guess it depends if the question was a more general "how do I project myself from zero day" or "how do I protect myself from this specific zero day". For the latter, yes someone could've been exploiting it in the past, but right now, it's been patched for some months and if you're up to date, you should be safe.

Don't use any machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via computer programming.

Assume every electronically programmable device can, has been and will be compromised at now or at some point in the future.

Reply on news.ycombinator.com