Hacker News Reader

Comment by steponlego | Hacker News Reader

This is pretty cool. Imagine what Tik Tok could do from a kid's phone when their parent is working on their laptop, on the LAN.

View on HN

What exactly could it do using a VM that it can’t already do using native JavaScript (or anything that compiles to it) or WASM?

Note that the parent article is about the website, not mobile app.

iOS requires user permission for each app to make local network requests (Settings -> Privacy & Security). So in theory this shouldn’t be possible, unless ByteDance came up with a way to bypass it that made it through Apple’s review process.

You could log into any OS X machine by just pressing enter at the login screen enough times, for over a decade. Apple has trash security and they've stopped even saying what their security updates fix.

That’s not a convincing argument that this VM somehow reflects a LAN based sandbox escape attack.

It's just a reflection on how Apple's security can't be trusted, regardless of the possible vector. Big companies like Apple need vulnerabilities for deniable intelligence and national security access, but anybody can find and use these to achieve a breach.

FWIW:

1. That wasn't a bug for "over a decade," as far as I'm aware. It was only introduced with an OS update

2. I could be wrong here, but it required you to already have created a root user with a blank password, which isn't possible unless you know how to trigger another bug that does it.

"TikTok requires local network access to <cast to your TV or some other reason>" and there we have it, local network access.

I imagine TikTok could get pretty far simply asking users for permission. A significant number of users would probably allow it. Fortunately watchdogs would probably get it into the news pretty quickly.

Tell us, what could it do?

Open a reverse proxy and scan your LAN direct from Beijing for one.

Reply on news.ycombinator.com