Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher Charlie Miller booted from Apple Developer Program

news.cnet.com

Post reply on HN
Print view View original

21–30 of 116 posts

Re: Security researcher Charlie Miller booted from Apple Developer Program

#21

Post by mpyne »

pvg wrote: post #10
guan wrote: post #2

It’s rude when according to the article he withheld details of the exploit to give Apple time to fix the bug, but the decision is understandable since he did violate the developer agreement. I’m not so sure about “interfering with Apple's software and services” but his activites seem to be covered under “hiding features from [Apple] when submitting them.”

Putting the exploit in the App Store isn't particularly polite either and doesn't seem to serve any purpose other than generating some publicity for the researcher. It'd be different if he believed Apple wasn't going to fix it or that the exploit was being used or was about to be used in malicious apps - but he doesn't claim that was his motivation.

Except that how else is he supposed to prove that it works other than actually demonstrating it with a real app on the real App Store?

Re: Security researcher Charlie Miller booted from Apple Developer Program

#22

Post by 5hoom »

mahmud wrote: post #17
sigzero wrote: post #5

He uploaded malware to the store in violation of his developers agreement. FAIL.

Developer agreements are not a security mechanism.

And security research does not trump the developer agreement.

The guy submitted a real live exploit to the Joe-User facing App Store. What on earth did he expect would happen?

Re: Security researcher Charlie Miller booted from Apple Developer Program

#23

Post by pvg »

mpyne wrote: post #21
pvg wrote: post #10

Earlier quoted context omitted.

Putting the exploit in the App Store isn't particularly polite either and doesn't seem to serve any purpose other than generating some publicity for the researcher. It'd be different if he believed Apple wasn't going to fix it or that the exploit was being used or was about to be used in malicious apps - but he doesn't claim that was his motivation.

Except that how else is he supposed to prove that it works other than actually demonstrating it with a real app on the real App Store?

It seems he was pretty sure it was going to work - there's nothing magical about the App Store, he'd found a way to get around the code signing checks. I'm sure that once the vulnerability was fixed, he'd get credit. It's just that this sort of thing won't get you in forbes.

I personally don't really think there's anything at all wrong with a bit of harmless, nerdy limelight-seeking to boot, if that's what he was doing. Acting like he was somehow mistreated is what seems a bit iffy.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#24

Post by swixmix »

jjguy wrote: post #11

It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…

He is foolish if he did not expect this. My guess is he's doing it for the notoriety and succeeded.

A job well done.

Next time he either should submit a bug report to Apple or avoid using their products.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#25

Post by angelbob »

jjguy wrote: post #11

It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…

Unfortunately, if he submitted an exploit and didn't get banned, we'd see more criticizing Apple for favoritism in enforcing the rules.

They deserve that criticism and it's true, but I can see where they would prioritize actually enforcing those rules, especially in a big publicly-visible incident.

Obviously the best choice from HN's moral point of view is to be more open, more even-handed and less draconian about rules in the first place. But failing that, I can see why they try for "even-handed" over "less draconian," given their own priorities.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#26

Post by eridius »

kstenerud wrote: post #12
btn wrote: post #9

Earlier quoted context omitted.

In this case, he didn't only probe the approval process, but he also released the app containing the exploit into the store for public consumption. Apple's process allows for submitting an app for approval without releasing it into the store once it has been approved.

If the exploit potentially allows downloading and running of unsigned code after release in the app store, how else could one prove that it is in fact a hole, other than by releasing it into the app store to confirm the behavior?

Apps that you load onto the device yourself from Xcode are still signed, and are still governed by the sandboxing rules. You can demonstrate that the exploit works in your app by loading it on via Xcode, at which point the only difference submitting it to the AppStore makes is proving that it gets past the AppStore submission process (which isn't the interesting part about this exploit).

Re: Security researcher Charlie Miller booted from Apple Developer Program

#27

Post by zobzu »

swixmix wrote: post #24
jjguy wrote: post #11

It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…

He is foolish if he did not expect this. My guess is he's doing it for the notoriety and succeeded. A job well done. Next time he either should submit a bug report to Apple or avoid using their products.

when you submit a security related bug report to apple - granted my experience dates from 99-2005 - you get: A/ ignored (mail auto reply "we might fix it, don't tell anyone or we'll go after you" B/ bug don't get fixed for 2 or 3 years C/ bug get fixed, you get no credits

Re: Security researcher Charlie Miller booted from Apple Developer Program

#28

Post by mikeash »

Bud wrote: post #20
jjguy wrote: post #11

It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…

A few points: 1. This "guy" apparently didn't try very hard, at all, to cooperate, as evidenced by him putting the exploit itself in the App Store before notifying Apple about it, in direct violation of the dev guidelines. What good is it to have such guidelines at all if you display in public that you won't enforce them? 2. Microsoft is doing a great job at this? So are we to assume that their security is therefore…

How was he supposed to verify that the exploit works in the wild without submitting it to the store?

Re: Security researcher Charlie Miller booted from Apple Developer Program

#29

Post by brisance »

jjguy wrote: post #11

It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…

Hold on here. Is Apple expected to know Charlie Miller is a "security guru", and even if they did, why should he be treated any differently? Security researchers should be held to the same standard as regular developers when reporting bugs/flaws.

RTM was convicted of a crime because of his curiosity, and here we have a security researcher who knowingly put users at risk. You ask me, Mr Miller got off lightly.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#30

Post by 5hoom »

kstenerud wrote: post #15
jjtheblunt wrote: post #14

He's got great skills, and NSA training is as good as it gets, but he explicitly violated the rule to not download and run code from a server, to see if the rule would be enforced. They enforced it, just as he'd known they would. There was no point to his doing that other than to get headlines.

No, he explicitly violated the rule in order to test the hypothesis that a security hole he'd uncovered would allow unsigned code to be downloaded after release into the app store and run on the device. The sane response to this would be "Oh, we better fix that. Thanks. We're removing your app BTW." The Apple response was typical of a bureaucracy.

The lesson I would take away from this is that Apple should provide a mechanism for security vulnerabilities to be reported officially so that researchers don't have to engage in these sort of dubious activities. Whether they listen to the reports or not is another matter.

Anyway, is there any special reason why reporting via https://ssl.apple.com/support/security/ won't work?

Post reply on HN