Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

121–130 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#121

Post by pilif »

ecmendenhall wrote: post #115

This bug was pretty serious. I'd better be extra careful and install and verify this myself. Oh, good: there's a standalone installer available ( http://support.apple.com/kb/DL1726 ). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS: $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg HTTP/1.1 302 Moved Temporarily Server: Apache/2.2.24 (Unix) Locatio…

The packages themselves are signed: Mount the .dmg file and use pkgutil --check-signature /path/to/Installer.pkg to check whether the package is signed by a valid CA (if you want to be totally sure, do this check on a machine running 10.8 or earlier)

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#122

Post by yincrash »

jtokoph wrote: post #108

The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM. Sure, they show a SHA1 on this page: http://support.apple.com/kb/DL1726 but that could be MITM'd as well.

Looks like you can get the sha1 via https: https://support.apple.com/kb/DL1726

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#123

Post by ambrop7 »

msbarnett wrote: post #118
jtokoph wrote: post #108

The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM. Sure, they show a SHA1 on this page: http://support.apple.com/kb/DL1726 but that could be MITM'd as well.

Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work. (And no, this bug didn't break client-side signed package verification.)

Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#124

Post by eddieroger »

outside1234 wrote: post #56
sneak wrote: post #22

Ahh, so they probably had to restart the QA on the whole release a few days ago (including FaceTime Audio and associated features) after adding the TLS fix at the last minute. It makes a bit more sense why they'd make us wait a few days, now.

Its totally unacceptable. Even Microsoft does patches of this severity in less than 24 hours. I suspect what this points to is that Apple doesn't have automated testing and they need a bunch of old school "hands on keyboards testers" to run a test case list that takes 4 days.

Microsoft also has a history of not disclosing it until there's a fix.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#125

Post by vacri »

chmars wrote: post #93
SmileyKeith wrote: post #47

I cant believe they don't even mention the SSL bug in this. That's just insulting.

That is normal in the general update notice. There is always a more detailed security update notice, for OS X 10.9.2 it can be found at: http://support.apple.com/kb/HT6150

So in order to show the importance of this security update, they've put it in bland writing in a long, detailed security notice that only the most ardent of admins would read thoroughly, and even then it doesn't particularly stand out as important.

Regular Jane and John Does or even power users would have no idea of the importance of upgrading their system for this. "500MB update? Nah, it can wait, I don't need any of that".

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#126

Post by mrmondo »

ctolsen wrote: post #95
ambrop7 wrote: post #80

Earlier quoted context omitted.

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.

While this is too long IMO, Similarly critical bugs in windows have been left unfixed for years.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#127

Post by msbarnett »

ambrop7 wrote: post #123
msbarnett wrote: post #118

Earlier quoted context omitted.

Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work. (And no, this bug didn't break client-side signed package verification.)

Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

Yes, if we assume you're already fucked, then we can conclude that there is nothing you can do to verify anything and that you are fucked, because we have assumed our conclusion. SHA1s and MD5s are equally pointless in this case because you've already assumed you're fucked, so it should all be assumed to be lying to you.

If, however, we don't engage in circular reasoning and we assume your box isn't currently in the possession of the Russian mafia or (insert preferred APT here), then how can one be reasonably confident that the update one receives through the updater is legitimately the one Apple is distributing?

Because it is signed and the code-signing verification was not broken by this bug.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#128

Post by ne0codex »

e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

Apple hating seems to be the new trend and I see it as the main reason for thus much attention.

That, and also for the fact that if Steve Jobs were still around, he'd be able to sweep this up or else be able to assuage the public about the 1 extra line of goto fail; I think that in the post-Jobs future, we'll see more and more "revelations" about bugs/issues within Apple/iOS/OS X with people aggressively posting as much info as possible to "stick it to Apple"

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#129

Post by josephlord »

microtonal wrote: post #86
Jare wrote: post #45

Earlier quoted context omitted.

You still need a minimal amount of testing and release packing. 4 days for an OS update is pretty good response time IMHO, and I thank the Apple engineers that probably worked their asses off to get this mess sorted out. What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.

4 days for an OS update is pretty good response time IMHO For quite a serious vulnerability, which requires removing one goto statement to solve? I am not sure by what standards that is a good response time. There is surely something wrong with Apple's procedures here.

Yes, if you don't test and it stops all the devices with X installed you will have a lot of unhappy customers. And no fix, however simple is risk free.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#130

Post by nsxwolf »

ambrop7 wrote: post #80
e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

How many malicious exploits have occurred in the last 5 days? I'm genuinely curious if anyone has a guess.

Wouldn't you need to have control of the router Starbucks is using to set up the MITM attack?

Post reply on HN