Hacker News Reader

Comment by snazz | Hacker News Reader

iOS requires user permission for each app to make local network requests (Settings -> Privacy & Security). So in theory this shouldn’t be possible, unless ByteDance came up with a way to bypass it that made it through Apple’s review process.

View on HN

I imagine TikTok could get pretty far simply asking users for permission. A significant number of users would probably allow it. Fortunately watchdogs would probably get it into the news pretty quickly.

You could log into any OS X machine by just pressing enter at the login screen enough times, for over a decade. Apple has trash security and they've stopped even saying what their security updates fix.

That’s not a convincing argument that this VM somehow reflects a LAN based sandbox escape attack.

It's just a reflection on how Apple's security can't be trusted, regardless of the possible vector. Big companies like Apple need vulnerabilities for deniable intelligence and national security access, but anybody can find and use these to achieve a breach.

FWIW:

1. That wasn't a bug for "over a decade," as far as I'm aware. It was only introduced with an OS update

2. I could be wrong here, but it required you to already have created a root user with a blank password, which isn't possible unless you know how to trigger another bug that does it.

"TikTok requires local network access to <cast to your TV or some other reason>" and there we have it, local network access.

Reply on news.ycombinator.com