
Exploit Market ‘Flooded’ with iOS Vulnerabilities - electic
https://9to5mac.com/2019/09/03/ios-exploit-market-report/
======
kerng
Interestingly, no one has done a deep dive on what Android exploits were
hosted on the site that Google discovered and talked about last week with the
iOS exploits.

Google has been utterly quiet about it, and kept only talking about iOS
exploits.

Certainly lots of security PR happening and this article is interestingly
timed also.

~~~
arkadiyt
> Interestingly, no one has done a deep dive on what Android exploits were
> hosted on the site that Google discovered

Volexity did [1], although it's not clear if the android exploits were hosted
on the same sites that google was referencing.

[1]: [https://www.volexity.com/blog/2019/09/02/digital-
crackdown-l...](https://www.volexity.com/blog/2019/09/02/digital-crackdown-
large-scale-surveillance-and-exploitation-of-uyghurs/)

~~~
kerng
Thanks for sharing, that's a great resource! This at the grand scheme of
things hasn't gotten much attention I think.

------
mlacks
Does this mean that iOS is more or less just as secure/insecure as Android?
I’m not much of a security expert but I continue using iOS under the
assumption it was ‘safer’ than android

~~~
cjbprime
I'm not expert, but my sense is that Android is open source (easier to find
bugs) but memory safe (Java), whereas iOS is closed source but memory unsafe,
and tooling is recently at the point where it's feasible to find many exploits
despite not having source access, so the lack of memory safety is becoming
more and more untenable over time.

~~~
693471
Android is a Linux kernel written in C, so it's memory unsafe there. The apps
are in a Java-derivative, so they're memory safe. Chrome browser is not
written in this language, so it's memory unsafe.

iOS is a Mach+XNU kernel written in C, so it's memory unsafe there. The apps
are in Swift, so they're memory safe. Safari/Webkit is not written in this
language, so it's memory unsafe.

The only real difference in security here is that Apple has had better
sandboxing and security (hardware) implementations.

~~~
panpanna
Android has better sandboxing for apps (Java virtual machine + process
isolation + user isolation + se-linux + containers & virtualization in some
cases). But the permission system is so badly designed it's almost wide open.

The hardware you are thinking of is mainly used for secure storage and crypto.

~~~
on_and_off
What's wrong with the permission system design ?

(agree otherwise on the refutal of GP, but curious about that point)

~~~
panpanna
Old permissions were too broad. Need a file? Here is a permission to look at
ALL files!

More restrictive permissions (and a new model where you don't need a
permission but user decides what file to access) were added later but it takes
time to get developers to change.

------
berbec
Original source article:

[https://www.vice.com/en_ca/article/mbmgqp/this-is-worst-
year...](https://www.vice.com/en_ca/article/mbmgqp/this-is-worst-year-for-
iphone-security-yet-2019)

