31–40 of 144 posts
So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?
It's not remotely exploitable --- it requires installing a malicious app ; that makes it far less severe than something that could be done through e.g. just visiting a webpage.
I wonder if the new "Rootless" feature prevents this, and if it was developed because of this.
Edit - I seldom downvote others and the few times I do, I comment as to why I think the post was inappropriate. What is inappropriate about my post?
Few people stop and think about the burden of keeping state and the problems that introduces with password storage. Many even compound the problems by keeping state in the Cloud (solve device syncing issues). It's worth discussing. There are other ways.
I wonder if the new "Rootless" feature prevents this, and if it was developed because of this.
Rootless is more about securing the OS files and processes from malware.
Anyone on the new Mac version want to test this?
• The keychain can be compromised by a malicious app that plants poisoned entires for other apps, which when they store entries that should be private end up readable by the malicious app.
• A malicious app can contain helper apps, and Apple fails to ensure that the helper app has a unique bundle ID, giving it access to another app's sandbox.
• WebSockets are unauthenticated. This seems to be by design rather than a bug though, and applications would presumably authenticate clients themselves, or am I missing something?
• URL schemes are unauthenticated, again as far as I can tell by design, and not a channel where you'd normally send sensitive data.
So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?
> "and are doing NOTHING" Citation needed. An article (and on the Register at that) is not any indication that "they're doing nothing"...
> We reported this vulnerability to Apple on Oct. 15, 2014, and communicated with them again in November, 2014 and early 2015. They informed us that given the nature of the problem, they need 6 months to fix it.
However, doing nothing seems to be unfair:
> We checked the most recent OS X 10.10.3 and beta version 10.10.4 and found that they attempted to address the iCloud issue using a 9-digit random number as accountName. However, the accountName attribute for other services, e.g. Gmail, are still the user’s email address. Most importantly, such protection, based upon a secret attribute name, does not work when the attacker reads the attribute names of an existing item and then deletes it to create a clone under its control, a new problem we discovered after the first keychain vulnerability report and are helping Apple fix it.
So not nothing, but their iCloud 'fix' doesn't work and there's no fix for the real issues. But the researchers say they're helping Apple fix it, so nothing does seem unfair.
I hope it's being readied for inclusion in 8.4. We all know how it bruises Apple's ego to have to patch stuff without acting like it'a a feature enhancement.
Oh God. After reading the paper I wouldn't expect a fix from Apple anytime soon :(
This is something that apps can go forward with. But doesn't close the door if it was already opened.
Overall, this is just a brutal suite of bugs though, and a great paper.