Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boffins reveal password-killer 0days for iOS and OS X

theregister.co.uk

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Boffins reveal password-killer 0days for iOS and OS X

#131

Post by TheLoneWolfling »

logfromblammo wrote: post #116
acdha wrote: post #100

Earlier quoted context omitted.

That's technically correct but it violates the principle of least surprise. Most users find the behaviour unexpected even though it's fairly easy to remember and real-world analogues abound (e.g. you can shred an envelope without reading the contents). It's not clear to me that this is a common-enough situation to warrant changing anything so the best answer is probably to make sure documentation is easily found.

It seems like under these conditions-- 1. The user has write permission for the directory. 2. The user does not have write permission for the file. 3. The file has only one hard link. 4. The user deletes the file. --that the last hard link should be moved to ~owner home directory, rather than deleted. Otherwise, I don't see a problem.

That's a major security bug waiting to happen. You're effectively granting everyone the right to create files in anyone's home directory.

Re: Boffins reveal password-killer 0days for iOS and OS X

#132

Post by tptacek »

patsplat wrote: post #124
tptacek wrote: post #103

It's not bad work but it looks like The Register has hyped it much too far. Breakdown: * OSX (but not iOS) apps can delete (but not read) arbitrary Keychain entries and create new ones for arbitrary applications. The creator controls the ACL. A malicious app could delete another app's Keychain entry, recreate it with itself added to the ACL, and wait for the victim app to repopulate it. * A malicious OSX (but not iOS…

https://blog.agilebits.com/2015/06/17/1password-inter-proces... This particular attack is worrisome because it doesn’t require “admin” or “root” access, unlike other attacks that depend on the presence of malicious software on the system. It's a weakness.

It clearly is a weakness on OSX (apparently much less so on iOS). The issue is, it's not a new weakness.

Re: Boffins reveal password-killer 0days for iOS and OS X

#133

Post by layman »

soylentcola wrote: post #68
skrowl wrote: post #28

Earlier quoted context omitted.

I'm surprised that you're surprised! After The Fappening and the SMS of doom (amongst many others), you can't still believe that Apple gives a sh*t about security, can you? I mean, I understand that there are still a lot of Apple fans here at HN, but Apple's security has been a laughing stock of the industry for a while now.

I'm far from an Apple apologist (I probably complain about them more than I praise them) but "failing to be flawless" about security is not the same thing as "not giving a shit" about security. I've yet to see any massive platform that is both flexible and open to millions of users that has zero security flaws or exploits developed for them. Not saying it's a good thing, but it's certainly a common thing, even among…

There is a difference between "has zero security flaws" and "not fixing a security flaw for 6 months after being made aware"

Re: Boffins reveal password-killer 0days for iOS and OS X

#134

Post by josteink »

Aloisius wrote: post #106
josteink wrote: post #45

Once again goes to show that Apple is mostly interested in the security of its iStore, platform lock down and DRM. I'm not exactly shocked. Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?

> Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Well in 2006 when those ads were first being shown, XP was still the newest version of Windows and it had no privilege separation. As viruses that patched MBR sectors or system DLLs were extremely common, MacOS X was in fact "magically" (inherently) more secure since that vector of attack on a Mac…

> Well in 2006 when those ads were first being shown, XP was still the newest version of Windows and it had no privilege separation

That's probably false. Windows introduced this feature in Windows 2000 (from 1999) and you could define a "normal" user and a "power" user. Only when you needed to install something would you run as the power-user.

This all worked inside the same desktop session.

That maybe only 1% of the users (the "paranoid" ones) used it, doesn't mean it wasn't there.

Re: Boffins reveal password-killer 0days for iOS and OS X

#135

Post by acdha »

eridius wrote: post #112
DennisP wrote: post #31

Earlier quoted context omitted.

Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.

I bet it was submitted before they informed Apple of the problem. If you were to submit such an app today, it seems likely that they now look for stuff like this.

This is something many people forget: Apple has a challenge changing system APIs since they need to avoid breaking other apps but they can start scanning App Store submissions immediately and take action with absolute certainty that there won't be collateral damage.

Re: Boffins reveal password-killer 0days for iOS and OS X

#136

Post by FerrisDr »

Aloisius wrote: post #106
josteink wrote: post #45

Once again goes to show that Apple is mostly interested in the security of its iStore, platform lock down and DRM. I'm not exactly shocked. Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?

> Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Well in 2006 when those ads were first being shown, XP was still the newest version of Windows and it had no privilege separation. As viruses that patched MBR sectors or system DLLs were extremely common, MacOS X was in fact "magically" (inherently) more secure since that vector of attack on a Mac…

I agree. I guess the guys down here in the greyed out area are more after some kind of justice. It's more the arrogance of apple that people want to give back to apple.

Re: Boffins reveal password-killer 0days for iOS and OS X

#137

Post by kinofcain »

MagerValp wrote: post #97
kinofcain wrote: post #77

Earlier quoted context omitted.

The URL Schemes are unauthenticated, but the main problem is that duplicates are resolved by the host OS at install time, either as first-installed app wins (OSX) or last installed app wins (iOS).

Both of which seem like a valid strategy to me. The OS has never guaranteed that a particular URL scheme goes to a particular app, and developers are wrong to assume that it goes to their app and not someone else's. I realize that there aren't that many alternatives on iOS, but a sharing extension at least gives the user complete control. On OS X there are a wealth of different IPC options, including sockets and mach…

Indeed. The insecurity of the scheme handling is not a new development and should be better known.

Re: Boffins reveal password-killer 0days for iOS and OS X

#138

Post by pilsetnieks »

MaysonL wrote: post #107
pilsetnieks wrote: post #42

Earlier quoted context omitted.

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-keychain -a` in terminal - it lists all keychain items and their access control lists. It's still a big and unwieldy list but not as bad as clicking each keychain item. Someone better at this stuff could probably think of a way to make it easier. (This would on…

I'm curious: do you have any idea why after running this command would security start asking for password for various keychains?

It goes over all keychains so I'm assuming (at least it was so for me) that it asked for password for locked keychains.

`security` is a built-in system utility, basically Keychain Access for terminal, the same way that `diskutil` is Disk Utility but in the terminal.

Re: Boffins reveal password-killer 0days for iOS and OS X

#139

Post by Someone »

mordocai wrote: post #94
Someone wrote: post #87

Earlier quoted context omitted.

Malware apparently can also create items in advance as a sort-of honeypot for passwords. For me, that is worse, as when "Next time the banking app needs credentials, it will ask me to reenter them" would occur, my reaction would be "I do not know my password; it's in the keychain" (for most services)

I'd imagine that unless you suspect an attack, at that point you'd reset your password and enter it into the keychain: Giving them your new password.

First one? Probably. If it happened twice or thrice within a few hours, I would start being suspicious and reach for a backup. But maybe, I'm too paranoid.

Re: Boffins reveal password-killer 0days for iOS and OS X

#140

Post by logfromblammo »

TheLoneWolfling wrote: post #131
logfromblammo wrote: post #116

Earlier quoted context omitted.

It seems like under these conditions-- 1. The user has write permission for the directory. 2. The user does not have write permission for the file. 3. The file has only one hard link. 4. The user deletes the file. --that the last hard link should be moved to ~owner home directory, rather than deleted. Otherwise, I don't see a problem.

That's a major security bug waiting to happen. You're effectively granting everyone the right to create files in anyone's home directory.

But you have to be superuser to chown.
Post reply on HN