Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher Charlie Miller booted from Apple Developer Program

news.cnet.com

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Security researcher Charlie Miller booted from Apple Developer Program

#61

Post by Confusion »

feralchimp wrote: post #7

"I don't think they've ever done this to another researcher. Then again, no researcher has ever looked into the security of their App Store. And after this, I imagine no other ones ever will," Miller said in an e-mail to CNET. "That is the really bad news from their decision." Take your wrist-slap like a man, sir. Apparently the grand are also prone to self-aggrandizement. I have a lot of respect for Miller's skills,…

Don't assume what a news source presents as a quote is actually a quote. God knows what Miller actually said.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#62

Post by ubernostrum »

nodata wrote: post #59
Xuzz wrote: post #19

Earlier quoted context omitted.

I'd agree more if he didn't submit — and get approved — a working exploit in their store. Without telling them about it. Edit: Now, I don't disagree that just banning him from the program isn't a great idea, and that pulling the app and having someone from the security team send him an email isn't a better one. But it's hard to say this that a bad move on Apple's part.

So how do you prove that it's possible to get this kind of exploit into the store unless you submit it to the store?

So how do you prove the DDoS vector exists unless you DDoS someone's site?

How do you prove the SQL injection vector exists unless you take over someone's site?

etc., etc.

This was far from a harmless proof-of-concept app, and "I just wanted to prove I could" isn't sufficient justification for it.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#63

Post by jamesaguilar »

mikeash wrote: post #39
brisance wrote: post #29

Earlier quoted context omitted.

Hold on here. Is Apple expected to know Charlie Miller is a "security guru", and even if they did, why should he be treated any differently? Security researchers should be held to the same standard as regular developers when reporting bugs/flaws. RTM was convicted of a crime because of his curiosity, and here we have a security researcher who knowingly put users at risk. You ask me, Mr Miller got off lightly.

He did not put users at risk. This vulnerability allows apps to download and execute new code, but that new code is still subject to the app's sandbox. This vulnerability is interesting from a research standpoint, but has zero actual consequences to the security of iOS.

Not sure I agree with this. Less scrupulous developers might use this to download code that does things, even from a sandbox, that are bad for users. For example, it could download code that reports your usage habits to third parties, or saves your CC number.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#64

Post by Xuzz »

nodata wrote: post #59
Xuzz wrote: post #19

Earlier quoted context omitted.

I'd agree more if he didn't submit — and get approved — a working exploit in their store. Without telling them about it. Edit: Now, I don't disagree that just banning him from the program isn't a great idea, and that pulling the app and having someone from the security team send him an email isn't a better one. But it's hard to say this that a bad move on Apple's part.

So how do you prove that it's possible to get this kind of exploit into the store unless you submit it to the store?

For one, he could have submitted it and then have it "held for developer release" — at which point he told them about it. There's no reason he had to have it actually in the App Store here, even if he wanted to test the approval process.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#65

Post by JoshTriplett »

eridius wrote: post #57
JoshTriplett wrote: post #51

Earlier quoted context omitted.

In fairness, many of the bugs which enable jailbreaking also represent serious security problems. For instance, the various iterations of web-based exploits fundamentally do represent remote code execution, a serious bug in any browser environment. On any other platform, we'd classify them exclusively as security vulnerabilities; however, on iOS, the user has to take advantage of security vulnerabilities to break int…

s/many/all/

Not necessarily. Remote exploits, definitely, but entirely local jailbreaks that require booting the phone into a specialized firmware-loading mode don't actually impact the user's security, just Apple's anti-tampering guards against the user.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#66

Post by ghshephard »

JoachimSchipper wrote: post #56
ghshephard wrote: post #53

Earlier quoted context omitted.

First - I think just general manners, as well as established protocol, would have the security researcher let Apple know ahead of time what he would be doing. A simple email sent prior to uploading this code would have been sufficient to cover his bases - I'm surprised he didn't do that. Second - Unless I'm mistaken - his proof of concept was more a violation of Apples TOU, it didn't really attempt to copy credit car…

Part of the security of the app store is the review process. "It's possible to download and execute code" is neat, "it's possible to download and execute code and the app store reviewers don't catch that " is much more impressive.

Nothing in the App Store review process will allow them to catch a zero-day exploit. Coming up with a zero-day exploit in IOS is very impressive - but, by definition, once you have it, the App Store review process isn't going to catch it.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#67

Post by redthrowaway »

ubernostrum wrote: post #62
nodata wrote: post #59

Earlier quoted context omitted.

So how do you prove that it's possible to get this kind of exploit into the store unless you submit it to the store?

So how do you prove the DDoS vector exists unless you DDoS someone's site? How do you prove the SQL injection vector exists unless you take over someone's site? etc., etc. This was far from a harmless proof-of-concept app, and "I just wanted to prove I could" isn't sufficient justification for it.

You prove DDoS vectors exist by DDoSing your own site, or one you have permission to work on. Same with SQLi vulnerabilities. If you want to report a vulnerability you've found to a company, include a working exploit in your report, but don't run it. If the company ignores you or tries to brush the vulnerability off, that's where it gets hairy and responsible disclosure comes into play.

We don't know what his level of communication was with Apple, but it doesn't appear that he notified them before testing this exploit. Had they refused to address the issue or otherwise brushed him off, this would be a reasonable escalation. The same story on r/netsec [1] is being linked to a Forbes article [2], which claims he notified Apple three weeks ago. That's not a ton of time.

Ultimately, he very much violated their ToS and Apple is well within their rights to give him the boot. Whether that was a smart decision on their part remains to be seen.

[1] http://www.reddit.com/r/netsec/comments/m48gx/charlie_miller... , http://www.reddit.com/r/netsec/comments/m3uwo/mac_hacker_cha...

[2] http://www.forbes.com/sites/andygreenberg/2011/11/07/apple-e...

Re: Security researcher Charlie Miller booted from Apple Developer Program

#68

Post by smu »

ootachi wrote: post #43
dasil003 wrote: post #18

Earlier quoted context omitted.

The downside is poorer security, which could blow up in their face spectacularly at some point in the future.

I really doubt it. To be blunt, Apple is an existence proof that security on consumer products doesn't provide business value in proportion to its cost. Keeping users safe is seldom worth investing in.

Well, at least not until you get a sony-sized screwup...

Re: Security researcher Charlie Miller booted from Apple Developer Program

#69

Post by rwg »

zobzu wrote: post #27
swixmix wrote: post #24

Earlier quoted context omitted.

He is foolish if he did not expect this. My guess is he's doing it for the notoriety and succeeded. A job well done. Next time he either should submit a bug report to Apple or avoid using their products.

when you submit a security related bug report to apple - granted my experience dates from 99-2005 - you get: A/ ignored (mail auto reply "we might fix it, don't tell anyone or we'll go after you" B/ bug don't get fixed for 2 or 3 years C/ bug get fixed, you get no credits

Submitting a security bug report to the Chromium project was a delight compared to submitting one to Apple. It was obvious that the engineers working on Chromium cared about the problem and were competent. On the other hand, I mightaswell have been reporting the Apple bug to a brick wall or a black hole.

Re: Security researcher Charlie Miller booted from Apple Developer Program

#70

Post by nookiemonster »

brisance wrote: post #47
mikeash wrote: post #39

Earlier quoted context omitted.

He did not put users at risk. This vulnerability allows apps to download and execute new code, but that new code is still subject to the app's sandbox. This vulnerability is interesting from a research standpoint, but has zero actual consequences to the security of iOS.

That's not how it's being explained in the popular press. http://www.forbes.com/sites/andygreenberg/2011/11/07/iphone-...

shocking that the popular press missstates anything tech.

Charlie is extremely well known in the security community. They know who he is. This isnt their first trip to the rodeo with Charlie.

Post reply on HN