Ryan Pickren

> I wish people would qualify their “Apple Hate” every time they mention it.

Sure, let me do that: Apple is a corporation and it is stupid to believe that they care more about you than making profits.

This applies to any corporation. I've particularly noticed that the US citizens are increasingly buying into this propaganda that corporations can better protect their rights than a democratically elected government. And that is just sad and dangerous. We should be campaigning for our privacy rights directly with the government, and not just hope that some corporation will act benevolent towards us.

(And it is not a coincidence that this "news" came up in the social media feeds when the [news about exploits that granted unauthorised access to your camera through Safari is going around](https://www.ryanpickren.com/webcam-hacking-overview).)

The issue here is that instead of adding a physical switch to disable the microphone and camera, Apple is again asking its users to blindly trust it. We just have to take their word for it that it will work. They can always blame a bug in the firmware if somebody finds a way to exploit it tomorrow ...

(Note: I mentioned the Safari exploit only to point out that there is some negative news which obviously a corporation would like to bury with some positive publicity. It is commendable that Apple paid the discoverer a nice bounty and will be fixing it soon.)

Edit: And, ofcourse, the downvotes begin as the social media management team…

Is it me or does "webcam hacking" really undersell the bug here?

From the write up at https://www.ryanpickren.com/webcam-hacking , the bug chain appears to allow script execution in "arbitrary" domain context, which at first glance seems much bigger than just webcam extraction. Sticking up someone's face is attention grabbing compared to what could be done with that kind of power.

Is it because of the first bug in the chain that only the media-permissions was affected by the context confusion?

For example being able to extract cookies or local storage from other contexts would be a much bigger deal (local storage is sometimes used to store XSRF protection keys or other credentials), so I assume that wasn't at all affected?

Did any other parts of safari use the same broken context awareness as the media permissions or do we know that it was it isolated to media permissions?

A much better technical explanation than this ‘landing page’ edition is here: https://www.ryanpickren.com/webcam-hacking

This is amazing work. You’ll never see XFO the same way again.

It says that Safari 13.0.4 (macOS) and earlier is required to reproduce; Safari 13.1 was released last week, so if you’re allowing macOS to stay up to date, you’re okay there. I didn’t see a clear answer for iOS, but if they published, it has likely been fixed in iOS as well (or else they’d miss out on a $75k bounty).

Don't [0] worry, they're[1] perfectly happy[2] to catch[3] up on the[4] critical vulnerability[5] front.

[0] https://jonbottarini.com/2021/12/09/dont-reply-a-clever-phishing-method-in-apples-mail-app/

[1] https://www.theverge.com/2022/1/16/22886809/safari-15-bug-leak-browsing-history-personal-information

[2] https://nvd.nist.gov/vuln/detail/CVE-2021-30858

[3] https://www.ryanpickren.com/safari-uxss

[4] https://www.cvedetails.com/cve/CVE-2021-30954/

[5] https://www.exploit-db.com/exploits/11567

Reading that point reminded me of a recent article where a security researcher found an exploit due to the URL parser in Safari:

Unauthorized access to cameras in Safari on macOS and iOS - https://www.ryanpickren.com/webcam-hacking

And another one related to URL parsing:

The unexpected Google wide domain check bypass - https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/