41–50 of 144 posts
So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?
So as good as nothing, but not nothing.
Quick summary of the keychain "crack": Keychain items have access control lists, where they can whitelist applications, usually only themselves. If my banking app creates a keychain item, malware will not have access. But malware can delete and recreate keychain items, and add both itself and the banking app to the ACL. Next time the banking app needs credentials, it will ask me to reenter them, and then store them i…
(This would only show if you've been exploited already, not that some app is capable of doing it.)
Earlier quoted context omitted.
According to the article, they were aware
This doesn't seem like something a quick patch can fix. The section of the paper on mitigation suggests that it is non-trivial to correct without significantly re-architecting the app-OS relationship, if the paper is accurate, Apple is in a very difficult situation.
It seems that stating just a fact from the article is not liked by some
Earlier quoted context omitted.
It's not remotely exploitable --- it requires installing a malicious app ; that makes it far less severe than something that could be done through e.g. just visiting a webpage.
Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.
I'm not exactly shocked.
Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?
The fundamental design flaw of all of these compromised password managers, keychains, etc. is that they keep state in a file. That causes all sorts of problems (syncing among devices, file corruption, unauthorized access, tampering, backups, etc.). Edit - I seldom downvote others and the few times I do, I comment as to why I think the post was inappropriate. What is inappropriate about my post? Few people stop and th…
The fundamental design flaw of all of these compromised password managers, keychains, etc. is that they keep state in a file. That causes all sorts of problems (syncing among devices, file corruption, unauthorized access, tampering, backups, etc.). Edit - I seldom downvote others and the few times I do, I comment as to why I think the post was inappropriate. What is inappropriate about my post? Few people stop and th…
Once again goes to show that Apple is mostly interested in the security of its iStore, platform lock down and DRM. I'm not exactly shocked. Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?
Not strange if you grasp the fact that malware is just a program that has elevated access.
For me it was strange how can Apple market their system as virus-free. Now that's ridiculous.
Earlier quoted context omitted.
Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.
Good thing there are 1,500,000 apps in the store and getting visibility is the biggest challenge for developers/publishers :-)