Doesn’t it require a separate process to be using the cryptographic algorithm in the first place in order to fill the cache in question?

Yes, that’s my understanding. I haven’t looked at the code, but their high level explanation sounds like their app is making calls to an API which could result in the under-the-hood crypto “service” pulling the keys into the cache, and there’s an element of luck to whether they snag portions of the keys at that exact moment. So it seems like the crafted app doesn’t have the ability to manipulate the crypto service directly, which makes sense if this is only a user-land app without root privileges.

why wouldn’t the app just steal your password and avoid all of this in the first place?

I believe it would be due to the app not having root privileges, and so being constrained with going through layers of abstraction to get its crypto needs met. I do not know the exact software architecture of iOS/macOS, but I guarantee there’s a notion of needing to call an API for these types things. For instance, if your app needs to push/pull an object it owns in/out of iCloud, you’d call the API with a number of arguments to do so. You would not have the ability to access keys directly and perform the encrypt/decrypt all by yourself. Likewise with any passwords, you would likely instead make an API call and the backing code/service would have that isolated/controlled access.

Thanks for looking and not just zipping by. I’ll practice better restrain from feeding the trolls, I don’t want to make the mods lives any harder.

So it’s been a while since I had my OS and microcomputer architecture classes, but it really looks like GoFetch could be a real turd in the punch bowl. It appears like it could be on par with the intel vulns of recent years.

which would have this hardware issue but don’t have actual background processing

So I’ve read the same about iOS only allowing one user-space app in the foreground at a time, but… that still leaves the entirety of kernal-space processes allowed to run at anytime they want. So it’s not hard to imagine that a compromised app could be running in the foreground, all the the while running GoFetch trying to mine, while the OS might be shuffling crypto keys in the background on the same processor cluster.

The other thing I’d like to address, is you’re assuming this code would necessarily require physical access to compromise a machine. That is certainly one vector, but I’d posit there’s other simpler ways to do the same. The two that come to mind really quick, are (1) a compromised app via official channels like the app store, or even more scary, (2) malicious javascript hidden on compromised websites. The white paper indicates this code doesn’t need root, it only needs to be executed on the same cluster where the crypto keys keep passing through by chance; so either of these vectors seem like very real possibilities to me.

Edit to add:

I seem to recall reading a paper on the tiktok apps with stock installation were actually polyglot, in that the app would actually download a binary after installation, such that what’s executed on an end user’s machine is not what went through the app store scanners. I had read of the same for other apps using a similar technique for mini-upgrades, which is a useful way to not have to go through app store approval everytime you need to roll out a hotfix or that latest minor feature.

If these mechanisms haven’t already been smacked down by apple/google, or worse, aren’t detectable by apple/google, this could be a seriously valuable tool for state level actors able to pull off the feat of hiding it in plain sight. I wonder if this might be part of what congress was briefed about recently, and why it was a near unanimous vote to wipe out tiktok. “Hey congress people, all your iphones are about to be compromised… your tinder/grindr/onlyfans kinks are about to become blackmail fodder.”

and you’re not a mod or an instant admin

How do you know?

I bet I can keep you going all day.

I’m going to exhibit, the self-control of blocking you

So another lie. Also, you lose.

So let’s tally it up:

• Extremely similar profile aesthetics, down to colors and style

• Same exact account birthdays, 23 Aug 2023

• Similar comment history, also confrontational, and many downvotes from the community

• Both accounts reporting my exact comments, “hudson” sandwiched between your “gregorum” account

• Each of my comments downvoted twice

It’s extremely delusional/insulting for you to expect anyone to believe all that’s coincidence. Oh the irony of you posting the NP when you can’t even come clean when caught in your own lies.

Have you changed your profile pics yet? Are you going to go back and edit your comments more to try and look better for when a mod gets around to your complaints? You are acting so see through right now, and it’s not a good look.

Enjoying it so much that you’re now reporting my comments as breaking rule 1 and 3, huh?

Also, might not want to brigade by reporting with your other account @hudson@sh.itjust.works. Did you forget to sign out on that one? Just needed a little more umph and downvoting in this thread? Pretty sure that’s against the rules too.

Pro tip: If you’re going to use a diff account to brigade, you might want to change the profile up a bit so they don’t all resemble each other.

Removed by mod

Removed by mod

Removed by mod

Removed by mod

Removed by mod

Saying one is wrong, or doesn’t know what they’re talking about, is not ad hominem. Maybe it’s a language thing, but to me saying someone is wrong is equivalent to saying their argument is wrong. And saying someone is out of their element/depth is the same as saying they’re wrong on the subject, aka their argument is wrong.

There was a post about an older dude that went camping with his girlfriend and popped an ol’ blue to get freaky. They wrapped up and fell asleep, but the dude woke up 4 hours in excruciating pain - his erection had never gone down. They rushed down the mountain to the hospital, another two hours later… ER docs told him it was too late, amputation time.

So it’s always a good idea to stay awake long enough to flush the pipes with a good piss to avoid a uti, the story just reinforced that notion for me about 1000% more.

Submerged duration: approx. 4 weeks

Pffft, bush league. The Titan has been submerged for checks watch 272 days with no end in sight.

Any place I’ve ever worked, it was definitely grounds for immediate termination. You most certainly should not be fucking your subordinates. Even if you’re 100% certain the relationship is consensual, the subordinate could feel as if it’s not, but is too fearful of losing their livelihood to object otherwise.

“Yup, that’s $blank for you.”

Same shit’s been said ever since the caveman developed complex enough language to say. That’s a lazy, tired, and vacuous trope you’re mindlessly spouting there, tiger.

The most important step in making Pembroke cheese.

Panda Express

They test some fuggin chicken in my stomach every 4-6 months.

“Reasoning will never make a Man correct an ill Opinion, which by Reasoning he never acquired”

• Jonathan Swift, 1721

Interesting.

If they’ve built an app that can target non-christian demographics, then they’ve also built an app to target christians.

I wonder if they’ve made that realization yet.