PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Lỗ hổng trong Google Photos giúp người dùng iPhone hưởng lợi

blog.viettelcybersecurity.com | blog | #heic | #iphone | #cloud-storage | #google-photos | #bug | #free-storage
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Google Photos stores iPhone HEIC photos at original quality for free: files under 16MB skip compression, effectively granting unlimited full-resolution backups that even Pixel 4 owners don't get.
Published
Collected

Related coverage

blog · bishopfox.com
On Apple, Encryption, and Privacy: A Word About Decryption
Follow-up on the Apple-FBI encryption standoff after the iPhone was unlocked without Apple: speculation on the technique, Secure Enclave's limits, and untested legal ground for compelled OS changes.
blog · hackerone.com
Tips for Migrating to a New Computer for Programmers
Tips for developers switching machines: keep a dotfiles repository, move working files to cloud storage, and revoke old SSH and GPG keys before generating fresh credentials on the new computer.
blog · hackerone.com
Introduction to Firebase Storage - Part 2
Part two of the Firebase Cloud Storage guide: listing files with listAll(), resolving download URLs into state, and deleting individual files with refFromURL().delete().
blog · hackerone.com
Introduction to Firebase Storage - Part 1
Introduction to Firebase Cloud Storage: how its Google Cloud Storage buckets store user-generated content, plus a first tutorial project for uploading and viewing images.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · projectzero.google
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
Back