Go to LinkedIn, and check how many ex Unit 8200 (a group you never really quit until you are 50)...work for the Apple iOS dev team...
replyTons of SV companies really... it's quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it with no consideration for the security implications.
replyI think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
deleted
replyWith all the AI decompilation going on would it not be possible to find these things in the binary by now?
replyYeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
replyShrink the surface to scan. Not foolproof but can be an improvement. After watching many conference videos on mobile OS hacking, the strategy should really be to focus on components that were touched recently in new updates (and the most popular components like messaging). Once software is mature, they don't go and change everything with every release. It's been a few years, but an interesting insight I learned at CCC was that the most touched components in new OS releases are the ones most likely to have contributions by junior developers trying to push some commit to satisfy their boss and thus have security flaws. Testing can only catch so much.
replyIt's routine for apps like Messenger to pre-download attachments (eg to compute a resized preview of the image etc)
replywell yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
reply