Pull to refresh

All streams

Show first
  • New
  • Top
Rating limit
  • All
  • ≥0
  • ≥10
  • ≥25
  • ≥50
  • ≥100

How malware gets into the App Store and why Apple can't stop that

Information Security *Development for iOS *Development of mobile applications *Reverse engineering *Swift *

Only after I had published a post detailing three iOS 0-day vulnerabilities and expressing my frustration with Apple Security Bounty Program, I received a reply from Apple:

We saw your blog post regarding this issue and your other reports.

We apologize for the delay in responding to you. We want to let you know that we are still investigating these issues and how we can address them to protect customers. Thank you again for taking the time to report these issues to us, we appreciate your assistance.

Please let us know if you have any questions.

Indeed, I do have questions. The same ones that you have ignored. I'm gonna repeat them. Why was the fix for analyticsd vulnerability quietly included in iOS 14.7 update but not mentioned on its security content list? Why did you promise to include it in the next update's list but broke your words not once but trice? Why do you keep ignoring these questions?

After my previous post, some people have expressed doubts that such code can make its way into the App Store. It's understandable why they think this way. That's because Apple makes people believe that the App Store is safe by repeating it over and over. Moreover, they claim that they disallow alternative stores and application sideloading to keep users safe and otherwise they would be in great danger. Android has alternative stores and unrestricted sideloading, and have you heard about any kind of security problems with Android recently? I haven't. But it the last few months alone there were so many reports about security and privacy issues on Apple platforms. And the real reason that Apple doesn't allow any alternatives to the App Store is that they receive 30% commission on all purchases made inside any app and it's a tremendously lucrative business for them. They also enact censorship by choosing to allow or disallow any app into the App Store based purely on subjective opinions of their employees and managers.

So in this article I'm going to dispute the claim that the App Store is safe, voice my complaints about the App Store review process and provide a detailed explanation (including source code) how malicious apps on the App Store conceal their functionality from the App Store review team and are able to sneak into the App Store.

Read more
Total votes 31: ↑30 and ↓1 +29
Views 33K
Comments 8

Why we need dynamic code analysis: the example of the PVS-Studio project

PVS-Studio corporate blog C++ *Visual Studio *Development for Windows *

In May 2021, CppCast recorded a podcast called ABI stability (CppCast #300). In this podcast, Marshall Clow and the hosts discussed rather old news — Visual Studio compilers support the AddressSantitzer tool. We have already integrated ASan into our testing system a long time ago. Now we want to tell you about a couple of interesting errors it found.


Read more →
Total votes 4: ↑3 and ↓1 +2
Views 393
Comments 0

Difficulties You Might Encounter When Using vue-i18n

JavaScript *Language localisation *VueJS *

After few months of frustration with trying to use the "de-facto" internationalization library for Vue.js - vue-i18n, I've decided it is time to replace it. And that is why I have created fluent-vue - a Vue.js internationalization plugin that uses Mozilla's Fluent syntax to allow for natural-sounding translations.

In this post, I try to explain what problems I have encountered when trying to use vue-i18n library in my app, and how Fluent syntax solves them.

Read more
Total votes 3: ↑3 and ↓0 +3
Views 526
Comments 0

Creating Roslyn API-based static analyzer for C#

PVS-Studio corporate blog Programming *.NET *Visual Studio *C# *

After you read this article, you'll have the knowledge to create your own static analyzer for C#. With the help of the analyzer, you can find potential errors and vulnerabilities in the source code of your own and other projects. Are you intrigued? Well, let's get started.

Read more
Total votes 2: ↑1 and ↓1 0
Views 757
Comments 0

Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program

Information Security *Development for iOS *Development of mobile applications *Reverse engineering *

I want to share my frustrating experience participating in Apple Security Bounty program. I've reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page. When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time.

Read more to learn the specifics of 0-day vulnerabilities.

Read more
Total votes 59: ↑59 and ↓0 +59
Views 142K
Comments 8

Insights Into Proactive Threat Hunting

Information Security *

Proactive search for complex threats seems to be a useful technology but inaccessible for many organizations. Is it really so? What do companies need to do to start Threat Hunting? What tools are needed for threat hunting? What trends in this area can be seen on the market in the coming years? These are some of the questions I would like to answer in my article today.

What is Threat Hunting?

Threat Hunting is a search for threats in a proactive mode when the information security specialist is sure that the network is compromised. He should understand how his network operates in order to be able to identify various attacks by examining the existing anomalies.

Threat Hunting is a search for threats that have already bypassed automated detection systems. Moreover, most often, you do not have signals or alerts that allow you to detect an intrusion.

From the SOC perspective, Threat Hunting is an extension of the service that allows you to counter any level of intruders, including those who use previously unknown tools and methods.

Threat Hunting can be based on some data obtained by a security specialist, or it can be based on a hypothesis. If after testing the hypothesis, the test gives a positive result, then later, it can be used to improve the processes and mechanisms of detecting threats. And also, Threat Hunting allows you to find blind spots in the security system and expand the monitoring area.

What organizations need Threat Hunting?

Proactive threat hunting is relevant to those organizations that can become the target of a complex, targeted APT attack. At the same time, given the trend towards supply chain attacks, a small company may also become a target for motivated attackers.

Read more
Total votes 3: ↑3 and ↓0 +3
Views 388
Comments 0

MISRA C: struggle for code quality and security

PVS-Studio corporate blog C++ *IT Standards *C *Programming microcontrollers *

A couple of years ago the PVS-Studio analyzer got its first diagnostic rules to check program code compliance with the MISRA C and MISRA C++ standards. We collected feedback and saw that our clients were interested in using the analyzer to check their projects for MISRA compliance. So, we decided to further develop the analyzer in this direction. The article covers the MISRA C/C++ standard and the MISRA Compliance report. It also shows what we already managed to do and what we plan to achieve by the end of the year.


Read more →
Rating 0
Views 348
Comments 0

Who controls App Store: Martians or AI? Closed session of Russia's Federation Council and Apple leaked online

Legislation in IT IT-companies

Video recording of a closed session of the upper house of Russia's parliament was leaked online by Telegram channel A000MP97. In the video, Andrei Klimov, head of the Ad Hoc Sovereignty and Preventing Interference in the Domestic Affairs Commission, demands Apple to disclose who controls the App Store: people from Mars or artificial intelligence?

On September 16th, a closed session of the Commission took place, and representatives of Apple and Google were among those who were invited. The session discussed ways to protect sovereignty of the country, in particular, the fact that the Navalny app was still available in Apple App Store and Google Play. The services were accused of being complicit with organisations deemed extremist and banned in Russia as well as interference with Russian elections.
Read more →
Total votes 17: ↑17 and ↓0 +17
Views 2.4K
Comments 0

High-level pipelining in TL-Verilog, RISC-V from Imagination, formal tools and open-source EDA on ChipEXPO in Moscow

Algorithms *Industrial Programming *FPGA *Programming microcontrollers *Manufacture and development of electronics *

This year ChipEXPO conference in Moscow invited several Western speakers to present in English the emerging technologies in high-level HDLs, formal verification, open-source EDA and using industrual RISC-V cores for education. You can join these presentations on September 14-16 for free using this link (you may need to use google translate from Russian to go through the registration) https://eventswallet.com/en/events/282/

The whole program is here

The English-speaking presentations and tutorials include:

Read more
Total votes 3: ↑2 and ↓1 +1
Views 856
Comments 2

UAVCAN HITL UAV Simulator for PX4

Robotics development *Programming microcontrollers *Manufacture and development of electronics *Robotics Multicopters

Hi from RaccoonLab, a team of enthusiasts in field robotics! We want to share our true-HITL UAVCAN-based simulator for PX4.

We believe a unified UAVCAN bus for drone onboard electronics will become a mainstream approach shortly. Our simulator is already based on UAVCAN (in opposition to UART-MAVLINK) and emulates exactly the same messages as real UAVCAN-sensors.

Read more
Total votes 2: ↑2 and ↓0 +2
Views 973
Comments 0

Access the power of hardware accelerated video codecs in your Windows applications via FFmpeg / libavcodec

Intel corporate blog Working with video *Programming *
Since 2011 all Intel GPUs (integrated and discrete Intel Graphics products) include Intel Quick Sync Video (QSV) — the dedicated hardware core for video encoding and decoding. Intel QSV is supported by all popular video processing applications across multiple OSes including FFmpeg. The tutorial focuses on Intel QSV based video encoding and decoding acceleration in Windows native (desktop) applications using FFmpeg/libavcodec for video processing. To illustrate concepts described, the open source 3D Streaming Toolkit is used.
Read more →
Total votes 3: ↑3 and ↓0 +3
Views 871
Comments 0

Comparing Huawei ExaGear to Apple's Rosetta 2 and Microsoft's solution

Huawei corporate blog Compilers *CPU

November 10, 2020 was in many ways a landmark event in the microprocessor industry: Apple unveiled its new Mac Mini, the main feature of which was the new M1 chip, developed in-house. It is not an exaggeration to say that this processor is a landmark achievement for the ARM ecosystem: finally an ARM architecture chip whose performance surpassed x86 architecture chips from competitors such as Intel, a niche that had been dominated for decades.

But the main interest for us is not the M1 processor itself, but the Rosetta 2 binary translation technology. This allows the user to run legacy x86 software that has not been migrated to the ARM architecture. Apple has a lot of experience in developing binary translation solutions and is a recognized leader in this area. The first version of the Rosetta binary translator appeared in 2006 were it aided Apple in the transition from PowerPC to x86 architecture. Although this time platforms were different from those of 2006, it was obvious that all the experience that Apple engineers had accumulated over the years, was not lost, but used to develop the next version - Rosetta 2.

We were keen to compare this new solution from Apple, a similar product Huawei ExaGear (with its lineage from Eltechs ExaGear) developed by our team. At the same time, we evaluated the performance of binary translation from x86 to Arm provided by Microsoft (part of MS Windows 10 for Arm devices) on the Huawei MateBook E laptop. At present, these are the only other x86 to Arm binary translation solution that we are aware of on the open market.

Read more
Total votes 2: ↑2 and ↓0 +2
Views 1.3K
Comments 0

Mēris botnet, climbing to the record

Яндекс corporate blog Qrator Labs corporate blog Information Security *IT Infrastructure *Network technologies *


For the last five years, there have virtually been almost no global-scale application-layer attacks.

During this period, the industry has learned how to cope with the high bandwidth network layer attacks, including amplification-based ones. It does not mean that botnets are now harmless.

End of June 2021, Qrator Labs started to see signs of a new assaulting force on the Internet – a botnet of a new kind. That is a joint research we conducted together with Yandex to elaborate on the specifics of the DDoS attacks enabler emerging in almost real-time.

Read more
Total votes 28: ↑28 and ↓0 +28
Views 14K
Comments 0

How Visual Studio 2022 ate up 100 GB of memory and what XML bombs had to do with it

PVS-Studio corporate blog Information Security *.NET *Visual Studio *C# *


In April 2021 Microsoft announced a new version of its IDE – Visual Studio 2022 – while also announcing that the IDE would be 64-bit. We've been waiting for this for so long – no more 4 GB memory limitations! However, as it turned out, it's not all that simple...

Read more →
Total votes 2: ↑2 and ↓0 +2
Views 1.9K
Comments 0

Why do you need the MISRA Compliance report and how to generate one in PVS-Studio?

PVS-Studio corporate blog Information Security *C++ *C *Programming microcontrollers *

If you are strongly interested in MISRA and would like to understand whether your project meets one of the MISRA association's standards, there is a solution. It's name is MISRA Compliance. PVS-Studio has recently learned how to generate the MISRA Compliance report. This article describes how you can use this feature. This can make somebody's life better.

Read more
Rating 0
Views 271
Comments 3

A note on small-signal modeling of SEPIC CM CCM

CAD/CAM *Circuit design *Manufacture and development of electronics *DIY Electronics for beginners

Knowing parameters of small-signal control-to-output transfer functions makes it easier for engineers to design compensation networks of DC/DC converters. The equations for SEPIC can be found in different works and Application Notes, but there are differences. A work has been done to solve this problem.

Simplified design equations for SEPIC with Current Mode control (CM) in Continuous Conduction Mode (CCM) suitable for practical design of compensation networks are shown.

Read more
Total votes 3: ↑3 and ↓0 +3
Views 1.1K
Comments 0

Business trips with a cat on my lap or how to diversify remote work life

ISPsystem corporate blog

It has been a year since most of our life has become online. We at ISPsystem are used to working from the office and seeing all team members every day at arm's length. I adapted quickly to the new format. However, I will be honest; working remotely is not as easy as it may seem from the outside. Many fail to cope. The lack of live communication and the too familiar four walls make you not notice how the seasons change.

So how can one adapt to the situation? How to diversify your work, get new experiences and pump up your skills without leaving home? I want to share our experience with internal mission trips. It can be useful for companies that have several product teams at once.

Read more
Total votes 3: ↑3 and ↓0 +3
Views 1K
Comments 0