Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of iOS 7.0.6

support.apple.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: About the security content of iOS 7.0.6

#61

Post by pencilo »

lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l...

specifically check the function SSLVerifySignedServerKeyExchange

I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

Re: About the security content of iOS 7.0.6

#63

Post by Someone »

pencilo wrote: post #61
lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

For the likely error I spot, you don't even need To know C. Anything remotely algol-like Will do.

I wonder whether the software from the guys at viva64.com would spot that.

Re: About the security content of iOS 7.0.6

#64

Post by pencilo »

Someone wrote: post #63
pencilo wrote: post #61

Earlier quoted context omitted.

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

For the likely error I spot, you don't even need To know C. Anything remotely algol-like Will do. I wonder whether the software from the guys at viva64.com would spot that.

You don't need fancy software, compilers warn about this kind of thing.

Re: About the security content of iOS 7.0.6

#65

Post by jey »

pencilo wrote: post #62

SSLVerifySignedServerKeyExchange in http://opensource.apple.com/source/Security/Security-55471/l... If you want to see my favorite SSL bug ever.

Oh god, that's horrifying. Get ready to check certificate validity, then report success before actually checking validity!

Re: About the security content of iOS 7.0.6

#66

Post by F30 »

LawnGnome wrote: post #30
homakov wrote: post #28

Earlier quoted context omitted.

Mac os is not vulnerable

It appears to be, per https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 (and my own testing on OS X 10.9.1).

I'm able to reproduce your results with cURL. However, Safari on OS X correctly shows a warning. Can anybody explain that?

Re: About the security content of iOS 7.0.6

#68

Post by gojomo »

pencilo wrote: post #62

SSLVerifySignedServerKeyExchange in http://opensource.apple.com/source/Security/Security-55471/l... If you want to see my favorite SSL bug ever.

Wow. Maybe the inconsistent indentation and brackets-optional formatting helped the bug both arrive and persist?

Perhaps a preferable practice for security-conscious code would be to only set a success value after all checks have passed, rather than trust intervening logic to reset a default-success value, to an error-value, before return.

Re: About the security content of iOS 7.0.6

#69

Post by mau »

pencilo wrote: post #61
lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

Don't C compilers warn about code that is never executed?

I'm actually pretty impressed how this bug was not caught before. The compiler warning is just one thing that came to my mind but test coverage should have been the strongest hint. A linter could have also make the thing easier for a code review. Probably these parts of the code should have stricter coding guideline.

Re: About the security content of iOS 7.0.6

#70

Post by guycook »

pencilo wrote: post #61
lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

Whoops. goto fail indeed
Post reply on HN