Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

111–120 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#111

Post by saurik »

ctolsen wrote: post #100
saurik wrote: post #90

Earlier quoted context omitted.

This is true with or without this bug.

Without this bug, they wouldn't be able to use BofA's own certificate to do it.

Why does this matter? The browser isn't even at bankofamerica.com, it is at bankofamericaa.com: it "adds insult to injury", but it doesn't affect the attack. No browser would notice, even with the fanciest watchdog services and certificate pinning, that the certificate of an unrelated website is "authentic" or not. The only way you are going to notice the name being wrong is if the user opens the certificate details dialog and reads the content; do you seriously think someone is going to do this and not look at the URL ;P? What this bug makes possible are not the age-old "wrong URL" attack, but an active MITM on the real URL.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#112

Post by rch »

cpach wrote: post #89
rch wrote: post #73

I'm still not upgrading to Mavericks. I have a lot of work to do, and I dislike being asked to upend my system on somebody else's schedule.

If you don’t run Mavericks you’re not affected by the goto fail.

Yep, I know. As discussed a couple of days ago.

I think I'm just bothered by my perception that this Mavericks upgrade is being presented as a fix for an OS X security issue, rather than just offering a patch to Mavericks users.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#113

Post by davexunit »

jordanthoms wrote: post #63
rdl wrote: post #49

Earlier quoted context omitted.

I wonder if their hope is everything transitions to something like iOS before this is falsified in a widespread way on OSX in public. In corporate settings with desktop management, Macs are actually a huge pain to deal with; Windows maybe starts from crappier defaults but there's a much more mature industry around locking it down.

Hence why you want to be the odd one out with a Mac at Corporates: IT leaves you alone and you can manage it yourself.

If you really want IT to leave you alone you need a GNU/Linux machine.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#114

Post by saurik »

lawnchair_larry wrote: post #99
saurik wrote: post #90

Earlier quoted context omitted.

This is true with or without this bug.

The difference is this bug will grant you the lock icon, and your browser will "guarantee" you're speaking to the real bankofamerica. Practically speaking, that probably doesn't matter, because someone who understands that won't click on an email and log in to bankofamericaa.com. But there is a difference.

It is very easy to get a lock icon on bankofamericaa.com and to get your browser to insist you are speaking to the real bankofamericaa. What makes this bug interesting is you can get a lock icon for a fake website on bankofamerica.com using a MITM attack: making convincing "secure" websites on alternative URLs has always been possible.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#115

Post by ecmendenhall »

This bug was pretty serious. I'd better be extra careful and install and verify this myself.

Oh, good: there's a standalone installer available (http://support.apple.com/kb/DL1726). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS:

  $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg
  HTTP/1.1 302 Moved Temporarily
  Server: Apache/2.2.24 (Unix)
  Location: http://download.info.apple.com/Mac_OS_X/031-3279.20140225.Zzasf/OSXUpdCombo10.9.2.dmg
Nope. Well, at least I can verify the SHA1 sum displayed on the download page. Wait, no, that was served over HTTP, too.

Okay, I'll follow Apple's instructions for checking the certificate fingerprint in the installer (http://support.apple.com/kb/ht5044). But that page (Last modified November 2011) displays a different fingerprint (9C864771 vs FA02790F)...and that fingerprint was also served over HTTP.

Gives up and opens the App Store.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#116

Post by stusmall »

jtokoph wrote: post #108

The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM. Sure, they show a SHA1 on this page: http://support.apple.com/kb/DL1726 but that could be MITM'd as well.

That wouldn't even need an SSL bug to MITM

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#117

Post by zorked »

e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

This got famous because:

- It really is a severe bug in a major platform (and by that I mean iOS not MacOS)

- It is easy to understand once spotted, so everybody who can read code in the entire planet can write about how stupid Apple is because they refuse to see the light and switch over to their favorite pet language/coding standard/methodology

- The NSA has massive MITM capabilities and is known to sabotage American products and this looks like a very, very convenient bug to have for them, leading to speculation that this could not be a mistake

- Apple haters.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#118

Post by msbarnett »

jtokoph wrote: post #108

The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM. Sure, they show a SHA1 on this page: http://support.apple.com/kb/DL1726 but that could be MITM'd as well.

Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work.

(And no, this bug didn't break client-side signed package verification.)

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#119

Post by rmoriz »

cpr wrote: post #110
rmoriz wrote: post #44

Damn, I was close… :-) http://i.imgur.com/vKnXhJ8.png

Isn't yours just a manifestation of the general TLS bug? Or does it differ somehow?

No, it's just a bug of the SecureTransport backend in curl [1]. I thought Apple maintains the backend as nobody else uses it (homebrew curl uses OpenSSL) and that's why I've submitted the issue to Apple instead to the curl maintainer.

So maybe it brought some eyes on the "gotofail" but that's just speculation…

Thanks anonymous Apple guy :)

[1] https://github.com/bagder/curl/pull/93/files

Post reply on HN