duckJan 13, 2023
Ivan Fratric
New Project Zero blog post in which I dissect Apple DER-encoded entitlements and tell a story about how I found a fun (albeit short-lived) bug in the way they were decoded. https://googleprojectzero.blogspot.com/2023/01/der-entitlements-brief-return-of.html
DER Entitlements: The (Brief) Return of the Psychic Paper

Posted by Ivan Fratric, Project Zero Note: The vulnerability discussed here, CVE-2022-42855, was fixed in iOS 15.7.2 and macOS Monte...

Jan 12, 2023 at 5:02pmWeb
Show threadグレェ「grey」Jan 12, 2023

@ifsecure "The fix for the Psychic Paper bug: originally, the problem occurred because Apple had four XML parsers in the OS, so, surprisingly, the fix was to add a fifth one."

Gotta keep Wirth's law stable I guess?

Here's hoping Apple deprecates SHA-1 usage entirely sooner than later (I thought it was already considered worth deprecating way back in 2005 at least)?