Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IOHIDeous OS X Local Kernel Vulnerability

siguza.github.io

Post reply on HN
Print view View original

81–90 of 121 posts

Re: IOHIDeous OS X Local Kernel Vulnerability

#81

Post by microtonal »

djrogers wrote: post #74
JohnTHaller wrote: post #38

Earlier quoted context omitted.

I think "irresponsible disclosure" would involve disclosing it to black hats for money.

Well, it has been disclosed to black hats - just not for money. To end users the result is the same; black hats have an unpatched 0day to play with, and we have no mitigations to deploy.

The end result is not the same. You know about the bug as well, whereas if the bug + exploit was sold to black hats, they can use it without your awareness.

This would be a less serious problem if vendors pushed out fixes faster.

Re: IOHIDeous OS X Local Kernel Vulnerability

#82

Post by Narkov »

gok wrote: post #5
mappu wrote: post #2

Responsible disclosure would have been to product-security@apple.com. Do apple have a bug-bounty program?

Why do that when you can wreck a security engineer’s vacation?

Can a company the size of Apple not afford 24x7 security resources? For their installed user-base, I don't think this is unreasonable. Security doesn't have a holiday.

Re: IOHIDeous OS X Local Kernel Vulnerability

#83

Post by yeukhon »

Siguza wrote: post #45
eridius wrote: post #39

Earlier quoted context omitted.

You say you submitted it to the ZDI, but did you try sending it to Apple product security?

No, their bug bounty only extends to iOS.

I suggest contact Google's Project Zero. I think those guys would love to help you...

Re: IOHIDeous OS X Local Kernel Vulnerability

#84

Post by yeukhon »

j1vms wrote: post #52
q3k wrote: post #4

Earlier quoted context omitted.

They don't for macOS. And the iOS one is invite-only.

> They don't for macOS. And the iOS one is invite-only. Which may, unfortunately, speak to what management thinks about the security/quality of the macOS codebase. I wouldn't be surprised the recent and upcoming exploits lead Apple to increase iOS dominance over its future product pipeline.

This is stupid though. macOS is the operating system for its flagship desktop/laptop devices. The lack of bug bounty on macOS (or even an invite one) seems really bizarre.

Re: IOHIDeous OS X Local Kernel Vulnerability

#85

Post by yeukhon »

infamouscow wrote: post #71
j1vms wrote: post #52

Earlier quoted context omitted.

> They don't for macOS. And the iOS one is invite-only. Which may, unfortunately, speak to what management thinks about the security/quality of the macOS codebase. I wouldn't be surprised the recent and upcoming exploits lead Apple to increase iOS dominance over its future product pipeline.

Apple's financial reports and behavior the last few years make it clear their priorities are not with the Mac, but with iOS. For better or worse, Apple is a smartphone company that happens to make computers on the side.

> For better or worse, Apple is a smartphone company that happens to make computers on the side.

Apple makes computer and operating system way before it entered the mobile market. The first part is right, but your second part is inaccurate historically.

Re: IOHIDeous OS X Local Kernel Vulnerability

#86

Post by apecat »

yeukhon wrote: post #85
infamouscow wrote: post #71

Earlier quoted context omitted.

Apple's financial reports and behavior the last few years make it clear their priorities are not with the Mac, but with iOS. For better or worse, Apple is a smartphone company that happens to make computers on the side.

> For better or worse, Apple is a smartphone company that happens to make computers on the side. Apple makes computer and operating system way before it entered the mobile market. The first part is right, but your second part is inaccurate historically.

Yeah but to phrase it pointedly, to what degree does Apple consider Macs to be basically development kits for iOS apps? It's very clear that iPhones make the big cash.

Re: IOHIDeous OS X Local Kernel Vulnerability

#87

Post by apecat »

Siguza wrote: post #66
tischler wrote: post #33

Earlier quoted context omitted.

Incredible work. How did you find the bug and how many hours did it take you in total?

I found it by looking through IOHIDFamily's source, hoping to find a low-hanging fruit affecting iOS. In total? A lot, probably way too much... I had found it in February and started to write an exploit in April. Next to my studies, exams, the Phœnix Jailbreak and Apple trying to mitigate tfp0, it took me until August to get a fully working exploit, at which point I figured I'd wait for High Sierra. And that actually…

I'm a total non-engineer/developer, but I'm increasingly interested in what guys like you think about software QA as it relates to security.

Today's Apple does a lot of security posturing in hardware/platform architecture, like full disk encryption, the iOS device secure enclave thingie, the secure enclave's subsequent inclusion on touchbar Macbook Pros to control the webcam, iOS defaulting to non-networked sandboxing for third party keyboards, etc.

Do you think macOS/iOS development perhaps should slow down from a yearly release cycle to delay releases with continuous big reworking starting with XNU?

With a very rudimentary outsider perspective on QA, it just seems insane to keep pushing big OS changes yearly.

Re: IOHIDeous OS X Local Kernel Vulnerability

#88

Post by tlrobinson »

Godel_unicode wrote: post #65
stevemk14ebr wrote: post #15

Oh my I feel so sorry for apple security engineer's right now. I'm curious the motivations to release such a serious, and complex, 0day on new years eve!? Makes me wonder who brushed this guy the wrong way, or if he just wants to watch the world burn. That said, seriously impressive work and I give him props.

> I'm curious the motivations to release such a serious, and complex, 0day on new years eve!? CVE 2018-0001, it's all about namespaces.

CVE 2018-0002: Flaw in CVE numbering procedure incentivizes dropping zero days on New Year’s Eve.

Re: IOHIDeous OS X Local Kernel Vulnerability

#89

Post by biehl »

geekamongus wrote: post #58
Siguza wrote: post #48

Earlier quoted context omitted.

Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until…

> Also, any decent antivirus shouldn't take long to add this to their malware definitions. Have Mac users finally started running antivirus?

No

Re: IOHIDeous OS X Local Kernel Vulnerability

#90

Post by antaviana »

Siguza wrote: post #48
lopatin wrote: post #42

To all the kernel programmers out there, can we get a HN-level ELI5 for this? It looks like a total system compromise is possible. Under what conditions? Any ways to ensure we don't get pwned?

Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until…

Indeed, I always buy iMacs instead of MacBooks because I can actually pull the plug whenever something takes longer than anticipated.
Post reply on HN