About the security content of iOS 7.0.6 • Hacker News Board

Re: About the security content of iOS 7.0.6

#21

Post by teraflop » Sat, Feb 22, 2014, 12:18 AM UTC

noclip wrote: post #16

It's not just cURL. It's much bigger, and much worse. http://pastebin.com/Yb6pUvr6

I don't know what you think that pastebin shows, but that error is not specific to OS X or to ssl.apple.com. OpenSSL is failing to validate the server certificate because you forgot to specify the -CAfile option.

EDIT: I'm an idiot, see below.

Re: About the security content of iOS 7.0.6

#22

Post by noclip » Sat, Feb 22, 2014, 12:19 AM UTC

teraflop wrote: post #21

noclip wrote: post #16

It's not just cURL. It's much bigger, and much worse. http://pastebin.com/Yb6pUvr6

I don't know what you think that pastebin shows, but that error is not specific to OS X or to ssl.apple.com. OpenSSL is failing to validate the server certificate because you forgot to specify the -CAfile option. EDIT: I'm an idiot, see below.

Except it isn't failing.

Re: About the security content of iOS 7.0.6

#23

Post by shawn-butler » Sat, Feb 22, 2014, 12:20 AM UTC

Doesn't affect any app using SSL pinning.

I have been trying to work on an implementation of TACK to mitigate headaches involved in pinning. Wish I had more free time.

http://tack.io/index.html

Re: About the security content of iOS 7.0.6

#24

Post by kryptiskt » Sat, Feb 22, 2014, 12:22 AM UTC

This is so bad that it is hard to imagine how it could have escaped notice until now, Apple really need to beef up their security competence. Lets hope that malevolent hackers were similarly asleep.

Re: About the security content of iOS 7.0.6

#25

Post by teraflop » Sat, Feb 22, 2014, 12:23 AM UTC

noclip wrote: post #22

teraflop wrote: post #21

Earlier quoted context omitted.

I don't know what you think that pastebin shows, but that error is not specific to OS X or to ssl.apple.com. OpenSSL is failing to validate the server certificate because you forgot to specify the -CAfile option. EDIT: I'm an idiot, see below.

Except it isn't failing.

Oh wow, you're right, sorry. I saw the error code at the top, and missed the fact that it was reporting success anyway at the bottom. That's... pretty terrible.

Re: About the security content of iOS 7.0.6

#26

Post by theboss » Sat, Feb 22, 2014, 12:24 AM UTC

shawn-butler wrote: post #23

Doesn't affect any app using SSL pinning. I have been trying to work on an implementation of TACK to mitigate headaches involved in pinning. Wish I had more free time. http://tack.io/index.html

Yeah the biggest problem with mobile devices I see that desktop applications have less often is crypto problems..It will get better as the time goes on.

Re: About the security content of iOS 7.0.6

#27

Post by mikeash » Sat, Feb 22, 2014, 12:53 AM UTC

nekitamo wrote: post #14

Looks like they weren't checking the hostname in the certificate. This would allow anyone with a certificate signed by a trusted CA to do a MITM attack on iOS devices. Very very bad vulnerability.

It seems to be a bit more than that, as I've verified that iOS 7.0.4 and Mac OS X 10.9.1 both refuse to connect to a server with a certificate for a different hostname. Sounds like verification is somehow different when connecting to a raw IP address. Safari treats that case differently, anyway: if I try to connect to a hostname that's different from what the certificate says, it simply refuses to establish the connection at all. If I try to connect to the raw IP address, it says the certificate is wrong, but gives me the choice to ignore the error and proceed anyway. Odd stuff.

Re: About the security content of iOS 7.0.6

#28

Post by homakov » Sat, Feb 22, 2014, 1:10 AM UTC

d0 wrote: post #19

tlrobinson wrote: post #18

Heh... "congrats to the Apple iOS team on adding SSL/TLS hostname checking in their latest update! very cool feature." https://twitter.com/will_sargent/status/436985812878491648

Comedic derision appreciated :) However this is a pretty damn serious oversight. I've just shut down my MacBook and picked up my ThinkPad.

Mac os is not vulnerable

Re: About the security content of iOS 7.0.6

#29

Post by [deleted] » Sat, Feb 22, 2014, 1:11 AM UTC

d0 wrote: post #19

tlrobinson wrote: post #18

Heh... "congrats to the Apple iOS team on adding SSL/TLS hostname checking in their latest update! very cool feature." https://twitter.com/will_sargent/status/436985812878491648

Comedic derision appreciated :) However this is a pretty damn serious oversight. I've just shut down my MacBook and picked up my ThinkPad.

[deleted]

Re: About the security content of iOS 7.0.6

#30

Post by LawnGnome » Sat, Feb 22, 2014, 1:28 AM UTC

homakov wrote: post #28

d0 wrote: post #19

Earlier quoted context omitted.

Comedic derision appreciated :) However this is a pretty damn serious oversight. I've just shut down my MacBook and picked up my ThinkPad.

Mac os is not vulnerable

It appears to be, per https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 (and my own testing on OS X 10.9.1).