Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of iOS 7.0.6

support.apple.com

Post reply on HN
Print view View original

121–130 of 155 posts

Re: About the security content of iOS 7.0.6

#121

Post by jamiesonbecker »

pencilo wrote: post #61
lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

CloudFlare just opensourced "Red October", which implements the two-man rule for any cryptographic checkout, but it could be really good for code checkins to catch things like this.

http://blog.cloudflare.com/red-october-cloudflares-open-sour...

Re: About the security content of iOS 7.0.6

#122

Post by Someone »

d0 wrote: post #72
pencilo wrote: post #64

Earlier quoted context omitted.

You don't need fancy software, compilers warn about this kind of thing.

Just eyeballs and a clue stick! However I can't see a valid case for this pattern so static analyser rule to knock it on the head would be a good idea.

Oops. I was doing this from an iPad, and iOS Safari is extremely bad at rendering source code (it's plain text, so it wraps it. It also chooses an incredibly large font size, so lines wrap at 50 characters or so in portrait mode. That made me bail out early, after reading this and not spotting the SRVR = SERVER abbreviation:

    clientRandom.data = ctx->clientRandom;
    clientRandom.length = SSL_CLIENT_SRVR_RAND_SIZE;
    serverRandom.data = ctx->serverRandom;
    serverRandom.length = SSL_CLIENT_SRVR_RAND_SIZE;
That is something that I think static analysis tools could signal. It would be a red herring, though.

Re: About the security content of iOS 7.0.6

#123

Post by nuxi »

PhantomGremlin wrote: post #92
hahainternet wrote: post #89

Earlier quoted context omitted.

How could this not happen in Python?

Python does not allow an assignment to occur within an expression. They deliberately chose that restriction, to avoid that hard-to-see bug.

True, but in languages with operator overloading you (may) end up with other issues. Unless you look at the source you have no idea what the '==' operator will do.

Re: About the security content of iOS 7.0.6

#124

Post by joveian »

staticfish wrote: post #111
PhantomGremlin wrote: post #92

Earlier quoted context omitted.

Python does not allow an assignment to occur within an expression. They deliberately chose that restriction, to avoid that hard-to-see bug.

I have always wondered why all languages don't enforce this?

Because it is often really convenient, particularly with a simple macro preprocessor like cpp but in other circumstances too. I like gcc's approach of forcing you (if you have the right warning enabled) to put an extra pair of unnecessary parentheses around assignments in expressions.

Re: About the security content of iOS 7.0.6

#125

Post by cnvogel »

staticfish wrote: post #111
PhantomGremlin wrote: post #92

Earlier quoted context omitted.

Python does not allow an assignment to occur within an expression. They deliberately chose that restriction, to avoid that hard-to-see bug.

I have always wondered why all languages don't enforce this?

because, for example in C, such a incompatible change would alienate most developers used to the very ideomatic

        if((val = function(args)) != expected)
            return val;

Re: About the security content of iOS 7.0.6

#126

Post by joveian »

mau wrote: post #69
pencilo wrote: post #61

Earlier quoted context omitted.

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

Don't C compilers warn about code that is never executed? I'm actually pretty impressed how this bug was not caught before. The compiler warning is just one thing that came to my mind but test coverage should have been the strongest hint. A linter could have also make the thing easier for a code review. Probably these parts of the code should have stricter coding guideline.

I agree that they should. This is one of the types of errors that lint was traditionally used to find.

Re: About the security content of iOS 7.0.6

#127

Post by [deleted] »

pencilo wrote: post #61
lstamour wrote: post #57

As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

[deleted]

Re: About the security content of iOS 7.0.6

#128

Post by grkhetan »

gojomo wrote: post #93
alex1 wrote: post #87

Earlier quoted context omitted.

Good point. I just checked that file ever since it was open-sourced in 10.8 and it stays exactly the same throughout all of 10.8.x (10.8 - 10.8.5) and only changes in 10.9. (You can check for yourself here: http://opensource.apple.com/ ) It doesn't seem like what you said is the case here but obviously we're still missing changesets that may have been committed between 10.8.5 (Security-55179.13) and 10.9 (Security-55…

Thanks for clarifying. I know silly errors like this can slip in, but I hope Apple does a deep x-ray on all circumstances surrounding the change.

This bug of an extra duplicate line looks like a merge issue to me.

Re: About the security content of iOS 7.0.6

#129

Post by lectrick »

alex1 wrote: post #78
pencilo wrote: post #61

Earlier quoted context omitted.

Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

Here's a diff of that file from OS X 10.8.5 (Security-55179.13) to 10.9 (Security-55471): https://gist.github.com/alexyakoubian/9151610/revisions Check line 631. Appears seemingly out of nowhere.

Goto considered harmful, indeed!

Re: About the security content of iOS 7.0.6

#130

Post by lectrick »

PhantomGremlin wrote: post #92
hahainternet wrote: post #89

Earlier quoted context omitted.

How could this not happen in Python?

Python does not allow an assignment to occur within an expression. They deliberately chose that restriction, to avoid that hard-to-see bug.

A better solution is gcc's which forces you (if you enable the restriction) to put an extra pair of parens around inline assignments.
Post reply on HN