7 ms·

It is not a 0day in the traditional meaning, it's a simple <did not read the manual> and <bad defaults> case. On the other hand I've been waiting to get on Appl

It is not a 0day in the traditional meaning, it's a simple <did not read the manual> and <bad defaults> case. On the other hand I've been waiting to get on Apple's HoF for two years now, reporting cross-site scripting bugs and even a sqli - yet I'm not there. Apple is not getting any responsible disclosure from me.

lukeqsee 12y ago
I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in their apps). I was primarily referring to the major players who do have the bug and whose primary responsibility the bug is.
- algorithm_dk 12y ago
  I can't do responsible disclosure when there are tens of thousands of apps using webView. The number of vulnerable apps is way too high for any kind of responsible disclosure.
  - eyeareque 12y ago
    You could have told Apple. They could fix this in iOS, blocking the apps via a software update. If it was me, I would have notified Apple and all of the companies who have bug bounty programs.
    - deleted 12y ago
      [deleted]
    - gepeto42 12y ago
      Apple knows. Look at the security content of iOS 7.1. http://support.apple.com/kb/HT6162 http://support.apple.com/kb/HT6162 I reported CVE-2013-6835. They fixed Facetime-Audio from Safari, but not from other browsers (yet?). This is quite a wide issue. I do not think letting every individual developer know is feasible. I did it for a few bad issues, but there's a limit to what can be done. And a lot of these can be found in a matter of minutes anyways.
      - eyeareque 12y ago
        It might not be feasible, but why not if they might pay you money for it?
- deleted 12y ago
  [deleted]
biscuittt 12y ago
So are you investigating security to find security holes or to be on the hall of fame of cool kids? This affects users much more than it affects Apple.
- dirkgently 12y ago
  Then go and tell Apple.

lukeqsee 12y ago

I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in their apps). I was primarily referring to the major players who do have the bug and whose primary responsibility the bug is.

algorithm_dk 12y ago
I can't do responsible disclosure when there are tens of thousands of apps using webView. The number of vulnerable apps is way too high for any kind of responsible disclosure.
- eyeareque 12y ago
  You could have told Apple. They could fix this in iOS, blocking the apps via a software update. If it was me, I would have notified Apple and all of the companies who have bug bounty programs.
  - deleted 12y ago
    [deleted]
  - gepeto42 12y ago
    Apple knows. Look at the security content of iOS 7.1. http://support.apple.com/kb/HT6162 http://support.apple.com/kb/HT6162 I reported CVE-2013-6835. They fixed Facetime-Audio from Safari, but not from other browsers (yet?). This is quite a wide issue. I do not think letting every individual developer know is feasible. I did it for a few bad issues, but there's a limit to what can be done. And a lot of these can be found in a matter of minutes anyways.
    - eyeareque 12y ago
      It might not be feasible, but why not if they might pay you money for it?
deleted 12y ago
[deleted]

biscuittt 12y ago

So are you investigating security to find security holes or to be on the hall of fame of cool kids? This affects users much more than it affects Apple.

dirkgently 12y ago
Then go and tell Apple.