Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

221–230 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#221

Post by cerberusss »

guid wrote: post #131

Interesting: After the update, ocspd downloaded roughly 40MB of ... certificate revocation lists? ocspd /usr/sbin/ocspd Total: 196 B sent, 45.8 MB received Outgoing to devimages.apple.com (92.122.207.101), Port http (80), Protocol TCP (6), 196 B sent, 45.8 MB received

I think that's not related to the SSL/TLS bug, but instead to the curl problem that also came with the update to 10.9.2. This is the description from Apple's security mailing list:

"curl Available for: OS X Mavericks 10.9 and 10.9.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: When using curl to connect to an HTTPS URL containing an IP address, the IP address was not validated against the certificate. This issue does not affect systems prior to OS X Mavericks v10.9. CVE-ID CVE-2014-1263 : Roland Moriz of Moriz GmbH"

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#222

Post by yuhong »

eridius wrote: post #141
chimeracoder wrote: post #101

Earlier quoted context omitted.

> But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. And even then they don't mention it on the…

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

From https://gotofail.com/faq.html: "I have been seeing Apple IP addresses hitting the site with fixed browsers identifying as OS X 10.9.2 since Saturday morning Cupertino time."

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#223

Post by cbsmith »

eslaught wrote: post #156
ambrop7 wrote: post #80

Earlier quoted context omitted.

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

This is so different from Pwn2Own I don't even know where to start. This failure case shows up in the most basic test case of what the library is supposed to do. The whole point of having certificate validation is that you identify invalid certificates. Try to come up with a reason why there are no regression tests with the library and why there wasn't a regression test that verified that for the default case, an invalid certificate was reported as such.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#224

Post by cbsmith »

e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

> That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies.

You got it! Really when you think about it, why do we even bother with crypto on the Internet in the first place? It's not like your data is traveling over a series of networks and nodes with different owners/operators that you don't even know and certainly haven't vetted for trustworthiness. That'd be crazy.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#225

Post by cbsmith »

zaroth wrote: post #154
e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

Easy to understand definitely drives the reporting. Compare the reporting of this to the Chrome vulnerability in TLS patched yesterday... https://news.ycombinator.com/item?id=7295785

That's actually a quite easy to understand problem as well.

The difference is pretty major. It's believable that someone forgot to consider the case where a new certificate was negotiated. It's downright inconceivable that no one tested whether a bad certificate failed validation. That's like selling a pregnancy test without testing what happens if the person isn't pregnant.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#226

Post by phlo »

aethr wrote: post #179
eslaught wrote: post #156

Earlier quoted context omitted.

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

While it's true that almost all software has bugs that can result in exploits, I think most of the exploits used in Pwn2Own are typically the result of complex interactions between subsystems that are hard to predict. As software gets more complex, the attack surface increases. The Apple bug isn't really in that class of exploit. It's a simple coding/merge error, and it's actually a regression from previously working…

In this case, the very test you're describing would not have worked. For a better writeup, see agl's post[1] on the matter. The basic gist of it: On affected systems, the server may use any combination of private key and certificate. Most SSL libraries used on the server side will make sure the moduli of cert and private key match (and abort if this isn't the case). Unit testing would thus require a server with some modifications to its SSL library (OpenSSL, in most cases).

What would have caught the bug: automatic code indentation or any sort of compile-time warnings about dead code.

[1] https://www.imperialviolet.org/2014/02/22/applebug.html

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#227

Post by ralfd »

gwu78 wrote: post #207

A compelling way to get holdouts to upgrade iOS/OSX. Get those iPhone 4 folks who are content with iOS 6.x to install iOS 7.x. God only knows what incompetence and disregard for user privacy and sanity awaits in these "new" versions. What are they adding that we really need? Oh, the ability to use SSL PKI. Yeah, I guess you have to upgrade. Why isn't HN discussing the effects this screw up has on email? Email is bigg…

Don't be a ignorant. Together with 7.0.6 there was also a security update to iOS 6.1.6.

http://support.apple.com/kb/HT6146

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#228

Post by nicholassmith »

res0nat0r wrote: post #169
ambrop7 wrote: post #158

Earlier quoted context omitted.

As I said: It's not just another security bug. It's an easy to spot bug, in the most critical part of the code, of a fundamental security library. THIS is what makes it unacceptable. It pretty much means the change has never gone through code review, or has been planted.

While working at AWS and seeing outages being posted here, and the wildly inaccurate summaries (guesses) of what the problems were, and the wildly simplistic fixes that are assumed to easily be put in place I can say: systems like this are more complicated than you think they are.

Agreed, everyone enjoys playing armchair critic and in the majority of the time have no idea how the internal systems are structured or managed.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#230

Post by teacup50 »

nknighthb wrote: post #215
teacup50 wrote: post #213

Earlier quoted context omitted.

As a fellow Mac user: your apologism is showing. There is no justification for this bug. It never should have shipped. It never should have gone unnoticed for so long. It never should have been announced prior to a patch being available. No matter how you slice it, Apple failed miserably, and "iOS was probably being exploited" is not an excuse. Apple has how much money? How much money do you think it costs to put the…

In arguing that they should add more people in order to ship faster, the only incompetence on display is your own. That's not how software development works, which you should know if you've done it professionally.

Huh? It's a one line change. The patch has to be validated across the entire testing matrix of their entire product line. That is a trivially parallelizable problem.

Don't cargo cult 'common wisdom'; the only incompetence on display here is your axiomation of things you don't understand.

Post reply on HN