Beeper 宣佈新的手機號碼註冊方式,另外後續應該不會再更新了

Beeper 連續兩篇更新:「iMessage and Phone Registration Are Back - Kinda」、「Beeper - Moving Forward」。

第一篇提到新的手機號碼註冊方式,需要用舊的 iPhone 手機 jailbreak (iPhone 6iPhone X):

📱 Have an old iPhone (6/6s/SE1/7/8/X) and a Mac or Linux computer (Raspberry Pi works) - you’re in luck! Follow our instructions (takes only 10-15 minutes) to jailbreak your iPhone, install a Beeper tool to generate iMessage registration code, then update to the latest Beeper Mini app and enter your code. Phone number registration will now work! Leave the iPhone plugged into power, at home, connected to wifi.

從「How To - Register Phone Number With iMessage」可以看到是用 jailbreak 的方式取得對應的 token (code) 再丟進 Beeper Mini:

第二篇則是提到貓與老鼠的競賽中不太可能贏:

As much as we want to fight for what we believe is a fantastic product that really should exist, the truth is that we can’t win a cat-and-mouse game with the largest company on earth.

然後後續會把力氣放到新的 IM 開發:

In the new year, we’re shifting focus back to our long-term goal of building the best chat app on earth.

故事差不多就到這邊...?

蘋果的衛星 SOS 服務對 iPhone 14 用戶免費延長一年

去年十二月蘋果對 iPhone 14 開通了衛星 SOS 服務:「iPhone 14 的 Emergency SOS via satellite (衛星求救服務) 在北美開通」,然後蘋果決定延長一年:「Apple extends Emergency SOS via satellite for an additional free year for existing iPhone 14 users」。

而且看起來已經開放到十六個區域了:

Now also available on the iPhone 15 lineup in 16 countries and regions, this innovative technology — which enables users to text with emergency services while outside of cellular and Wi-Fi coverage — has already made a significant impact, contributing to many lives being saved. Apple today announced it is extending free access to Emergency SOS via satellite for an additional year for existing iPhone 14 users.

在「Use Emergency SOS via satellite on your iPhone」這邊有找到目前開放的地區,算了一下的確是十六個:

Emergency SOS via satellite is available in Australia, Austria, Belgium, Canada, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, New Zealand, Portugal, Spain, Switzerland, the U.K., and the U.S.

北美洲 (美加) 與大西洋洲 (紐澳) 沒什麼問題,不過歐洲那些區域看起來偏西歐,有點像是衛星訊號的涵蓋性,另外可能還有當地法規的問題?不然以義大利與奧地利的涵蓋範圍,摩納哥與斯洛維尼亞看起來應該也是可以被涵蓋的...

最近 AV1 的支援度

HN 上「AV1 video codec gains broader hardware support (fullystacked.net)」這篇在說 AV1 的支援度變得更好了,原文不長,在「The AV1 video codec gains broader hardware support」這邊。

Can I Use 上的 AV1 video format 可以看的比較清楚:

不過在瀏覽器上離直接取代掉其他的 video codec 還早,但算是個起頭,至少 iPhone 15 Pro 與 iPhone 15 Pro Max 上的 Safari 支援了,接下來就是看桌機的 Edge 什麼時候才又想到要把 AV1 開回來:

Edge has stopped supporting AV1 completely at some point prior to version 116 (additional information required).

iPhone 5S 又拿到安全性更新了:iOS 12.5.7 (2023/01/23)

Apple 又針對 iOS 12 釋出安全性更新了:「About the security content of iOS 12.5.7」。

Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation)

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.

Description: A type confusion issue was addressed with improved state handling.

這次的更新是 backport 去年十二月在 Safari 16.2 上修正的 CVE-2022-42856

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution.

所以這包跟上次一樣 (參考先前寫的 「iOS 12.5.6」這篇),也是在修正 RCE 類的漏洞,這樣對於 iPhone 5S 等於是進入第九年的支援了。

之前在網路上有看到有人在猜是因為海外有很多異議人士拿這隻手機,所以美國政府「希望」Apple 能夠針對一些高危險性的安全漏洞提供更新?

iPhone 14 的 Emergency SOS via satellite (衛星求救服務) 在北美開通

iPhone 14 的 Emergency SOS via satellite 先在北美開通了,包括美國與加拿大地區:「Emergency SOS via satellite available today on the iPhone 14 lineup in the US and Canada」,另外也有提到歐洲的一些區域預定在十二月開通:

iPhone 14 users can now connect with emergency services when cellular and Wi-Fi coverage are not available; the service extends to France, Germany, Ireland, and the UK in December

然後有一些 screenshot 出來了,在沒有 WiFi 與電信訊號的時候打 911 (美國與加拿大的緊急號碼) 會出現透過衛星聯絡的選項:

然後用選擇的方式快速先分類,然後手機要對天空:

這些資訊會先被傳遞,後面緊急聯絡中心可能會再問一些資訊:

另外有提供 satellite demo,可以讓使用者不去打擾緊急聯絡中心的前提下熟悉這套流程:

Using the built-in Emergency SOS via satellite demo, users can test satellite connectivity on their iPhone by connecting to a real satellite in range without calling emergency services, allowing them to experience the process and familiarize themselves with the service.

台灣從五家電信業者的 coverage 資料看起來,五家都沒有覆蓋的地區主要是山區:

目前在台灣類似的功能 (要求救的話) 應該是 Garmin inReach 這個產品線,先前在 YouTube 上有看到開箱...

歐盟 2024 年年底強制使用 USB-C 充電頭 (終於,iPhone...)

Hacker News Daily 上看到「EU Passes Law to Switch iPhone to USB-C by End of 2024」,裡面指到了歐盟的新聞稿:「Long-awaited common charger for mobile devices will be a reality in 2024」。

2024 年年底 (所以是 2025 年) 將強制手機與平板都使用 USB-C 充電頭,2026 年則是延伸涵蓋到筆電:

By the end of 2024, all mobile phones, tablets and cameras sold in the EU will have to be equipped with a USB Type-C charging port. From spring 2026, the obligation will extend to laptops.

終於定案公告了,之前傳言好久了...

iOS 12.5.6

早上發現 iPhone 6 Plus 被自動更新到 iOS 12.5.6,查了一下發現是八月底的時候 Apple 推了一版 WebKitACECVE-2022-32893:「About the security content of iOS 12.5.6」。

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: An out-of-bounds write issue was addressed with improved bounds checking.

上個更新的版本 12.5.5 是 2021/09/23 出的,本來大家都以為已經沒有任何更新了,沒想到居然回過頭來發了一包,照蘋果的敘述看起來是因為這個洞被廣泛使用的關係?

iPhone 5S (目前 iOS 12 支援列表裡最早出的手機) 是 2013 下半年出的,到現在也九年了...

Apple 在 iOS 16、iPadOS 16 與 macOS Ventura 上推出 Lockdown Mode

AppleiOS 16、iPadOS 16 與 macOS Ventura 上推出了 Lockdown Mode:「Apple expands industry-leading commitment to protect users from highly targeted mercenary spyware」。

Lockdown Mode 主要是透過降低被攻擊的面積以提昇安全性,依照 Apple 的預想,主要是針對被政府單位盯上的族群:

Apple is previewing a groundbreaking security capability that offers specialized additional protection to users who may be at risk of highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware.

在 Lockdown Mode 下目前列出來的限制:

  • Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.
  • Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.
  • Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.
  • Wired connections with a computer or accessory are blocked when iPhone is locked.
  • Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

列出來的這些的確都是之前 0-day 常被拿來打的東西,把攻擊面積縮小的確會有不少幫助。

這應該是業界第一個大咖跳進來做這個 (也就兩個大咖?),第一次搞未必會完美,但算是個開始,後面應該會有更多的面積被考慮進去...

居然在安全性漏洞的 PoC 上面看到拿 Bad Apple!! 當作範例

人在日本的資安專家 Hector Martin 找到了 Apple M1 的安全漏洞,可以不用透過 macOS Big Sur 提供的界面,直接透過 M1 的漏洞跨使用者權限傳輸資料,這可以用在突破 sandbox 的限制。而也如同目前的流行,他取了一個好記的名字:「M1RACLES: M1ssing Register Access Controls Leak EL0 State」,對應的 CVECVE-2021-30747

先講比較特別的點,PoC 的影片放在 YouTube 上,作者拿 Bad Apple!! 當作示範,這很明顯是個雙關的點:

這應該是當年的影繪版本,看了好懷念啊... 當年看到的時候有種「浪費才能」的感覺,但不得不說是個經典。

Hacker News 上有討論可以翻翻:「M1racles: An Apple M1 covert channel vulnerability (m1racles.com)」。

依照作者的說明,Apple A14 因為架構類似,也有類似的問題,不過作者沒有 iPhone,沒辦法實際測試:

Are other Apple CPUs affected?

Maybe, but I don't have an iPhone or a DTK to test it. Feel free to report back if you try it. The A14 has been confirmed as also affected, which is expected, as it is a close relative of the M1.

另外作者覺得這個安全漏洞在 macOS 上還好,主要是你系統都已經被打穿可以操控 s3_5_c15_c10_1 register 了,應該會有更好的方式可以用:

So you're telling me I shouldn't worry?

Yes.

What, really?

Really, nobody's going to actually find a nefarious use for this flaw in practical circumstances. Besides, there are already a million side channels you can use for cooperative cross-process communication (e.g. cache stuff), on every system. Covert channels can't leak data from uncooperative apps or systems.

Actually, that one's worth repeating: Covert channels are completely useless unless your system is already compromised.

比較明顯的問題應該是 iOS 這邊的 privacy issue,不過 iOS 上的 app store 有基本的保護機制:(不過想到作者可以故意寫成 RCE 漏洞...)

What about iOS?

iOS is affected, like all other OSes. There are unique privacy implications to this vulnerability on iOS, as it could be used to bypass some of its stricter privacy protections. For example, keyboard apps are not allowed to access the internet, for privacy reasons. A malicious keyboard app could use this vulnerability to send text that the user types to another malicious app, which could then send it to the internet.

However, since iOS apps distributed through the App Store are not allowed to build code at runtime (JIT), Apple can automatically scan them at submission time and reliably detect any attempts to exploit this vulnerability using static analysis (which they already use). We do not have further information on whether Apple is planning to deploy these checks (or whether they have already done so), but they are aware of the potential issue and it would be reasonable to expect they will. It is even possible that the existing automated analysis already rejects any attempts to use system registers directly.

FBI 手上的 GrayKey 可以解 iPhone 11 Pro Max

在「FBI Successfully Unlocks iPhone 11 Pro in Ohio, Casting Doubt on Claims it Needs Apple's Help in Florida Mass Shooter Case」這邊看到的消息,看起來 FBI 手上的 GrayKey 可以解開 iPhone 11 Pro Max 了...

先前 GrayKey 只有舊型的可以解,像是之前揭露的 iPhone 5 或是 iPhone 7,現在看起來找到新的漏洞可以打穿新的版本,所以升級了:

Forbes has previously revealed a GrayKey brochure that showed it worked on older devices, and the two iPhones acquired by the FBI in the most recent Pensacola case are an ‌iPhone‌ 5 and an ‌iPhone‌ 7, which strongly suggests that investigators are already capable of unlocking them.

魔與道的競爭...