101–110 of 121 posts
Earlier quoted context omitted.
> I'm curious the motivations to release such a serious, and complex, 0day on new years eve!? CVE 2018-0001, it's all about namespaces.
Bonus points if they issue it as CVE-2018-65536 (pen-test the world, so to speak) EDIT: "No one would ever store the CVE incrementing fragment as a 16-bit unsigned int!"
For additional fun, find a buffer overrun based on the CVE ID.
Earlier quoted context omitted.
The problem is that allowing the vendor to define what is responsible, which seems these days to be expanding into giving them unlimited time to fix it, is to allow them to take unlimited time to fix it. Cooperation or even coordination takes willingness from both parties. Let's look at the actual page apple has on reporting security issues [0] "When we receive your email, we send an automatic email as acknowledgment…
You imply by framing without explicitly stating that "coordinated disclosure" is "unlimited time", but that's not the time frame under discussion. I consider 24 hours notice bare minimum responsible disclosure, and 1 business day in the operating timezone of the company as an polite courtesy to the human beings who have to respond to uncoordinated security disclosures with emergency builds of their product. What do y…
You can't possibly be serious? Have I fallen for some trolling here?!
Earlier quoted context omitted.
I don't understand why Apple doesn't have a well-funded bug bounty program. You would think that companies would welcome people finding bugs in their software. Hell, they could give away free MacBook Pro laptops, phones, and IPads along with CASH!!!
They do have a well-funded and well-publicized bounty program for security exploits.
Earlier quoted context omitted.
> I'm curious the motivations to release such a serious, and complex, 0day on new years eve!? CVE 2018-0001, it's all about namespaces.
CVE 2018-0002: Flaw in CVE numbering procedure incentivizes dropping zero days on New Year’s Eve.
I was unlucky and it didn't work out, but come December time I do wonder if I should dedicate more time to audits ..
Earlier quoted context omitted.
Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until…
> Also, any decent antivirus shouldn't take long to add this to their malware definitions. Have Mac users finally started running antivirus?
Earlier quoted context omitted.
Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until…
Indeed, I always buy iMacs instead of MacBooks because I can actually pull the plug whenever something takes longer than anticipated.
Earlier quoted context omitted.
You can just press and hold the power button to shut a Macbook off. I assume this is a hardware level interrupt as I’ve never seen it fail. Granted not quite as satisfying as physically pulling the plug!
When they had power buttons you could
Responsible disclosure would have been to product-security@apple.com. Do apple have a bug-bounty program?
Earlier quoted context omitted.
You imply by framing without explicitly stating that "coordinated disclosure" is "unlimited time", but that's not the time frame under discussion. I consider 24 hours notice bare minimum responsible disclosure, and 1 business day in the operating timezone of the company as an polite courtesy to the human beings who have to respond to uncoordinated security disclosures with emergency builds of their product. What do y…
> I consider 24 hours notice bare minimum responsible disclosure You can't possibly be serious? Have I fallen for some trolling here?!
Rabble-rouse all you like, but unless you respond with whatever your personal bare minimum delay is, you risk being perceived as the troll in this exchange.
Earlier quoted context omitted.
Well, it has been disclosed to black hats - just not for money. To end users the result is the same; black hats have an unpatched 0day to play with, and we have no mitigations to deploy.
The end result is not the same. You know about the bug as well, whereas if the bug + exploit was sold to black hats, they can use it without your awareness. This would be a less serious problem if vendors pushed out fixes faster.