Crossover: 2014

Chapter 145 Time Regression Vulnerability
……

……

The reason why Lin Hui is short of money is simple:
——There are too many things I want to do.

And what Lin Hui wants to do is basically extremely expensive.

Needless to say, how expensive technology products such as hardware are.

Many projects in software are also gold-eating behemoths.

For a seemingly mediocre AI model, the specific adjustment/teaching process often requires countless real money.

As for the advent of more complex face recognition technology and Fuchisia OS, Jinshan Yinhai is what is needed.

You can't play without money.

Maybe some people don't understand Lin Hui's "ambition".

In fact, Lin Hui also knows that rebirth does not necessarily have to be magnificent.

You can also fish and firewood Jiangzhu, idle clouds and wild cranes.

But Lin Hui felt that he could not do such and such.

At least in the past six months, Lin Ash has been very difficult to do.

Too many things require Lin Hui to do it himself.

Although no one forced Lin Hui to take any route.

But under the subtle influence of family background, educational experience, life encounters and other things, the actual route a person should take is already a definite number.

In addition to reasons other than family factors, educational experience, and life experiences.

It also has a lot to do with Lin Hui's personal thoughts.

Lin Hui feels that a person's destiny can only be closely integrated with the destiny of the country and the destiny of the nation.

Only then can we go higher and further.

With lofty ideals, Lin Hui will naturally not be constrained by the little difficulties in front of him.

Although Lin Hui is short of money, it is not a big problem.

Making money is easy!
For Lin Hui, money is everywhere in this era.

Software can be exchanged for money, algorithms can be exchanged for money, business models can be exchanged for money...

But Lin Hui is not in the mood to tinker with these things for the time being.

For the time being, it is better to find some easy ways to make money.

Speaking of making money easily, Lin Hui first thought of the news he saw a few days ago:
-Apple fully opened the bug bounty program.

Under the program, bugs can be submitted in exchange for payment.

When security personnel submit vulnerabilities to the "bug bounty program".

Apple said it would measure these vulnerabilities based on the complexity and severity of the development chain.

There is a bounty of up to $100 million per security bug.

And if vulnerabilities can be found in Beta (testing) software.

The highest bounty can be won at a time of 150 million US dollars.

The reason why Lin Hui didn't submit the vulnerability immediately a while ago was mainly because he had a wait-and-see attitude.

In case of submitting a vulnerability, it will be more sad if Apple refuses to admit it.

It's not that Apple didn't do this in the previous life.

Not only Apple has done this, but companies such as Google and Microsoft have done this.

However, Lin Hui learned from some public news.

Several security teams have submitted security vulnerabilities through this security website and received nearly a million dollars in exchange.

Of course, this does not mean that Apple abides by the rules.

Lin Hui thinks this is mainly because the bug bounty program has just been launched.

Apple is not going to slap itself in the face so soon.

If this is the reason, then recently.

Lin Hui doesn't seem to need to worry too much, he just needs to follow the same pattern and submit some loopholes.

When it comes to Apple's iOS vulnerabilities, the first thing Lin Hui thinks of is "time regression vulnerability".

The so-called time regression vulnerability refers to the fact that Apple's mobile phone will become bricked after adjusting the time for a period of time.

Adjusting the time will make the phone bricked?
It might sound funny, but the loophole is real.

On earlier versions of iOS 64-bit devices.

As long as you set the time of the iPhone to January 1970, 1, and then restart it, the iPhone will become a brick.

The reason why there is such a loophole has a lot to do with the bottom layer of the iOS system - the Unix system.

The Unix operating system is a powerful multi-user and multi-tasking operating system.

The system supports multiple processor architectures.

According to the classification of the operating system, it belongs to the time-sharing operating system.

The system was first developed at AT&T's Bell Laboratories in 1969 by Ken Thompson, Dennis Ritchie, and Douglas McIlroy.

There are many derivatives of the Unix system.

Darwin, on which iOS is based, is a fork of Unix.

As a system, iOS has inherited the characteristics of Unix to a certain extent.

Since it is a system, it will inevitably involve timing issues.

It is different from the counting format of "year + month + day" that humans generally use.

Unix uses a completely different way of keeping time:

The timing method in the Unix system is to first set (UTC time zone) 1970:1 on January 1, 00 as 00 o'clock.

The number of seconds elapsed so far is then calculated.

Take a chestnut.

2014年6月22日18时30分25秒。

If displayed, it is 1403433025 seconds.

Converted to the corresponding binary to represent the time under the Unix system.

This method of timing is called timestamping.

The iOS system also follows the Unix timing method.

It is precisely because of this that the time setting in iOS can only be traced back to 1970:1 on January 1, 00 in the UTC time zone at most.

If it is just set to this time, there will be no problem.

But when it comes to some special rules for querying past information in local key functions

Setting the time to 1970:1 on January 1, 00 in the UTC time zone is prone to problems.

Although most of the time this vulnerability can be avoided through human factors.

However, when the Apple mobile phone is turned on, there is such a mechanism for forcing the query of past information, which is almost unavoidable.

There is no way to cancel this mechanism, because after the phone is turned off and restarted, it must read some of the previous log data.

In this case, if the timestamp is a normal time, then there is no problem in reading the previous log data.

But when the UTC time zone is 1970:1 on January 1, 00, the time stamp at this time is 00.

When the local time is earlier than timestamp 0 o'clock.

How should we represent times earlier than timestamp 0 o'clock?

There seems to be no good way.

Although there is no other good way, systems are machines.

It is not a creature with intelligence, it also needs to find an earlier time through the query mechanism.

At this time, the -0 operation will be performed on the basis of the timestamp 1.

(This is to subtract the number of seconds difference from the time expressed by the system timestamp to query the previous content)

But -0 on the basis of 1 is more sad.

The result is not -1.

0-1≠-1?

It sounds unbelievable, but in fact this kind of phenomenon is everywhere in the program.

This has to do with the way negative numbers are represented in binary.

Because Unix uses a binary method to store.

Binary data is executing and executing 00...0-1
实际进行的的运算是：（1）00……0-1（ps：省略号中有61个0）

The result is 11...1 (ps: there are 61 1s in the ellipsis)

In this case 0-1≠-1
The number obtained is actually 2 squares of 64-1.

There are many examples of this in the computer world.

For example, the result of adding two positive numbers is 0.

Lin Hui remembered that when he was playing ACM, he often encountered such painful programming problems.

On the surface, two numbers are required to be added.

Sounds like a simple requirement.

But the test data encountered when running the program test are all kind of super large numbers.

But in actual operation, data overflow must be considered.

All in all, the computer world.

A wonderful world.

In Unix, when the timestamp is 0, the difference will encounter a similar situation.

Restart the phone when the time stamp in the Apple phone is set to 0.

The query mechanism of the mobile phone returns the time when querying through the time difference, not only the time before a timestamp 0.

Instead it will return an extremely large time.

The function's time is infinite, while the system's time is 0.

In this case, the time before the query will be wrong.

The consequences of making mistakes are very direct and the entire system goes on strike.

That is, the mobile phone is directly bricked.

Of course, although this loophole exists.

However, it is very troublesome for users with normal brain circuits to trigger this vulnerability in a safe network environment.

If the user wants to trigger this vulnerability.

First, users need to turn on "Date and Time" under "General" settings.

Here, the user must first turn off the "automatically set time" function before the option of manually setting the time will appear.

The next thing the user has to do is slide the selected time.

Since there is no year option, the only way for the user to change it is to swipe the date.

After a very troublesome operation, the time can be set to January 1970, 1.

And that alone doesn't trigger the vulnerability.

After the time is set to January 1970, 1.

The user needs to proceed to the next step: shutdown and restart.

So far, the steps of iPhone bricking have been completed.

If you follow this operation, the phone will always be stuck on the interface where the logo just came out when the Apple phone was turned on.

It sounds like this bug is hard to trigger!

Is there any value in such a hard-to-trigger bug?

Of course there is value.

Everything is afraid of being deliberately used by someone with a heart.

The same goes for bugs.

For ordinary users, this vulnerability is nothing.

But for technicians who are interested in doing things, they can do a lot of things through such a stupid loophole.

When an iOS device is connected to a public network, the iOS system will use the Network Time Protocol service to calibrate the time zone and time.

If a hacker sends a malicious Network Time Protocol attack to calibrate the iOS system time to UTC 0, then all user devices will be affected by this bug, and the device cannot be used after restarting the device.

NTP (Network Time Protocol) is one of the oldest network transmission protocols.

Its purpose is to transmit the time of precise timing devices such as atomic clocks to every networked device through the network, thereby providing the most accurate time synchronization capability.

Even the Network Time Protocol protocol itself has taken into account the possibility of tampering with time.

However, for a long time, cyber attacks using the network time protocol as the entry point have been common.

Although Lin Hui is not very good at this kind of operation, it is easy for hackers to do it.

After all, even Lin Hui, who is not specialized in IT security, knows how to implement the above-mentioned operations.

Just find a public place and set up an open WiFi without a password.

Then resolve Apple's network time protocol request to the IP controlled by itself (the IP here refers to the IP address).

Specific to how the Network Time Protocol attack operates.

First forge a copy of data to a server.

The server will respond automatically.

Instead, send a large number of response messages to a specific IP.

And there is a very large multiple relationship between this data and the data that the victim finally received.

Through the blocking attack of a large amount of data, the network bandwidth of the victim can be affected instantly, and even the network of the victim can be directly paralyzed.

In this case, when the user connects the iPhone to this WiFi, it becomes bricked once it restarts.

All in all, this vulnerability may not be a big deal from the perspective of ordinary users.

But for some unscrupulous technicians.

This vulnerability is easy to exploit.

And this loophole is serious.

There is only one solution for mobile phones that encounter this vulnerability:
Disassemble and power off.

After taking the iPhone apart, you need to disconnect the battery from the motherboard.

And leave it for a period of time, so that the electric energy in the internal capacitor can be fully consumed.

Then connect the battery and turn it on again, so that iOS can return to normal working condition.

The principle is simpler. By completely cutting off the power, the timing function of the electronic components inside the iPhone is cleared, and all relevant data is reset to zero.

This bug can be jumped out after restarting.

Of course, it is only temporarily jumping out of this BUG.

But if you change the time, or the time is changed again to January 1970, 1, the problem will recur.

Although it looks simple.But it is actually very difficult, after all, not so many people are good at dismantling mobile phones.

And the teardown itself has done damage to the iPhone itself.

In short, this incident had a great impact, and Lin Hui remembered that this incident in his previous life had a very bad impact.

This loophole in the previous life involved a wide range.

Almost covered system version: iOS 8.0 -iOS 9.3 beta 3
(For devices equipped with 64-bit processors)
Although the official version of iOS 8 has not yet been released.

But the iOS 8 beta version already exists.

It doesn't make sense that bugs that exist in the official version don't exist in the beta version.

But out of caution, Lin Hui found a spare iPhone5s.

Lin Hui remembered that this seems to have been bought by the way when he bought a bunch of computers not long ago.

Gee tut.

To be honest, the cost of testing vulnerabilities is a bit high.

But this cost is nothing compared to the rewards that are about to be obtained.

Apple's security folks are no fools either.

It will not be clear about the value of Lin Hui's vulnerability submission.

After brushing to the iOS8 beta version.

Lin Hui conducted a test.

Lin Hui also made a video during the test.

Pass some tests.

Lin Hui found that the loophole involving bricking after changing the time and restarting still exists.

Existence makes sense.

It's abnormal not to exist.

As long as the bottom layer of the Apple mobile phone is involved with Unix.

This loophole will always exist.

In fact, the solution adopted by the Apple mobile phone in the previous life related to this vulnerability is only to prevent the user from adjusting the time to January 1970, 1.

It can be said that this is a very wise approach.

Although this vulnerability is powerful.

But when faced with submission.

Lin Hui hesitated a little.

Wouldn't it be a bit of a loss to exchange such a powerful loophole for money?
Maybe it can be of greater use.

But immediately Lin Hui gave up this idea.

What Lin Hui doesn't lack most now is Apple's loopholes.

Much more serious Apple bugs than this time regression bug abound.

The reason why Lin Hui immediately thought of the time regression loophole was not because it was the most serious loophole.

But because this vulnerability is relatively classic.

In the future, if Lin Hui really wants to use loopholes to do things, he can use other loopholes to arrange a wave.

In the case of lack of money at this time, it is still necessary to submit the vulnerability.

During the actual vulnerability submission process, Lin Hui used a new computer bought some time ago.

Even the proxy IP.

It's a bit of a hassle, but be careful.

These so-called vulnerability submission sites are, to put it bluntly, a lot like hacker forums.

It's not good if you accidentally touch it.

In the first step of the vulnerability incentive plan, Lin Hui got stuck.

What id should I choose?

This made it really difficult to name Abandoned Forest Ash.

After struggling for a while, Lin Hui simply named it "admin".

(End of this chapter)