Hacker News Reader

The ability to exclude apps or websites from the lockdown seems at the face of it to reintroduce attack surface that lockdown mode is meant to prevent.

Countdown to some 0day no-click exploit that adds an app or service or site to the exclusion list and then proceeds with a further attack?

View on HN

> Countdown to some 0day no-click exploit that adds an app or service or site to the exclusion list and then proceeds with a further attack?

What type of exploit would be able to add something to the exclusion list but not already perform arbitrary code execution and just attack the system directly? This seems incredibly unlikely -- and roundabout, because you'd still have to get the browser to load the page.

Maybe they could compromise the server of someone else's site that's on the exclusion list?

I honestly haven't a clue, really just spit-balling after reading the link.

The only way I can think of that could work is if an attacker made a website (and convinced the target to visit it) that said something like:

> Tap Aa > Disable Lockdown Mode to view News Org secure content

Similarly to how malicious Word docs get users to enable macros.

Reply on news.ycombinator.com