Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

131–140 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#131

Post by millstone »

blinkingled wrote: post #130
millstone wrote: post #124

Earlier quoted context omitted.

I am not confused. Please reread the thread. You asserted that iOS is "unfixable" because the ObjC runtime cannot prevent apps from using "private/internal calls that your app is not supposed to use," whereas "Android gets code access control for free with Java." But as I showed, Java access controls are easily bypassed, so they do not provide any security. This is by design: security is enforced at the process bound…

You should really read this Usenix paper - https://www.usenix.org/system/files/conference/usenixsecurit... . What you are not understanding or ignoring is that iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses by reverse engineering the names of the private APIs and using message passing. Android sure has private APIs and you can access those but you'r…

> You should really read this Usenix paper

I have read it. It describes an attack on the app review process, i.e. a trojan. Their apps require the user to grant privileges. For example, their GreetingCard app requests access to the user's address book, and the user has to grant it.

> iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses

This is not true. Here's the blog: https://sourcedna.com/blog/20151018/ios-apps-using-private-a...

The data they collected was list of installed apps, serial numbers, and some sort of AppleID numeric identifier. In particular, they did not (could not) collect email addresses.

It's bad that the SDK was collecting this stuff, but this data is fairly innocuous. Last I checked, Android provides information like the list of installed apps and various serial numbers without requiring elevated permission.

If you think it's possible to get the user's email address through an iOS private API, I challenge you to tell me what that private API is.

> For example you need to declare android.permission.GET_ACCOUNTS permission to get the user's primary email. Not on iOS apparently

This is wrong. On iOS, the only way to access the user's email is through the Address Book framework, which prompts the user at the time of access.

> your app gets a broad set of permissions on iOS by default

This is completely false. iOS has a comprehensive on-demand permissions model, which is widely recognized as better than the install-time permission model on Android. This is why Android is switching to iOS style on-demand permissions in Marshmallow.

> you aren't calling a private method on Android without declaring the necessary permission

Please stop confusing private methods with elevated permissions. You CAN call private methods without elevated permissions, as my code above demonstrates.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#132

Post by ZenoArrow »

"Microsoft’s latest version of its operating system, Windows 10, has a feature called Windows Hello that allows people to log in to a PC with a scan of their finger, iris or face instead of using a password — weak versions of which are a common cause of data breaches."

Is that more secure in practice?

http://hackaday.com/2015/11/10/your-unhashable-fingerprints-...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#133

Post by ksk »

loginusername wrote: post #37
ksk wrote: post #32

Earlier quoted context omitted.

>How are you ever going to assess the quality of this software in terms of security? I am not aware of a single third party that has reviewed all of the code that goes into a Linux distribution. Do you know of one?

Not sure what Linux has to do with my comment. Are you assuming I use a Linux "distribution"? Sometimes I have done so, but only occasionally when I need to check something on Linux. Anyway, I am missing your point.

Well, I simply highlighted the difference between theory and practice. The average user does not have the money to audit open source software. And even if you get someone to bankroll the cash, you will need to re-do the audit for every single check-in since the audit.

You made a point about Windows being impossible to audit, but in practice you're in pretty much the same boat when it comes to Linux.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#134

Post by TeMPOraL »

cmdrfred wrote: post #121
TeMPOraL wrote: post #83

Earlier quoted context omitted.

They improved the system in the next release, and since Win7 UAC generally works perfectly even with the "badly behaving" software. Sensitive directories are now mirrored elsewhere in the filesystem, so that when your program wants to read from, say, Program Files directly, what it really reads is C:/Users/[username]/AppData/Local/VirtualStore/...

I've never experienced this in writing my own software. If I try to read or write to a directory I'm not allow to I simply get access denied. f = open('C:/windows/test.txt') try: f.write('test') except Exception as ex: print ex IOError: [Errno 13] Permission denied: 'C:/windows'

Try the same with C:/test.txt. Open Explorer and see if the file actually appears in C:/.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#135

Post by blinkingled »

millstone wrote: post #131
blinkingled wrote: post #130

Earlier quoted context omitted.

You should really read this Usenix paper - https://www.usenix.org/system/files/conference/usenixsecurit... . What you are not understanding or ignoring is that iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses by reverse engineering the names of the private APIs and using message passing. Android sure has private APIs and you can access those but you'r…

> You should really read this Usenix paper I have read it. It describes an attack on the app review process, i.e. a trojan. Their apps require the user to grant privileges. For example, their GreetingCard app requests access to the user's address book, and the user has to grant it. > iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses This is not true. H…

>The data they collected was list of installed apps, serial numbers, and some sort of AppleID numeric identifier. In particular, they did not (could not) collect email addresses.

[Edited for unnecessary stuff]

Oh the article you linked has Apple response that is quoted verbatim below - it references user email addresses. Specifically.

“We’ve identified a group of apps that are using a third-party advertising SDK, developed by Youmi, a mobile advertising provider, that uses private APIs to gather private information, such as user email addresses.."

> Please stop confusing private methods with elevated permissions. You CAN call private methods without elevated permissions, as my code above demonstrates.

What I wrote was you are not going to be able to call an Android API via private invocation and succeed if the API requires a specific permission and your app hasn't declared it.

All of this only goes to prove that Apple's security in iOS is not extraordinary as you claim - it is fallible like every other platform except with the exception of fingerprints which are currently believed to be secure - but that's now the case with Android as well - in M they are using ARM Trust Zone with no app access.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#136

Post by EGreg »

tptacek wrote: post #7

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This al…

Apple

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#137

Post by millstone »

blinkingled wrote: post #135
millstone wrote: post #131

Earlier quoted context omitted.

> You should really read this Usenix paper I have read it. It describes an attack on the app review process, i.e. a trojan. Their apps require the user to grant privileges. For example, their GreetingCard app requests access to the user's address book, and the user has to grant it. > iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses This is not true. H…

>The data they collected was list of installed apps, serial numbers, and some sort of AppleID numeric identifier. In particular, they did not (could not) collect email addresses. [Edited for unnecessary stuff] Oh the article you linked has Apple response that is quoted verbatim below - it references user email addresses. Specifically. “We’ve identified a group of apps that are using a third-party advertising SDK, dev…

Maybe there's a private API on iOS that leaks the user's email addresses without the proper permissions. Maybe there's one on Android too. Neither OS has a runtime that will prevent malicious apps from exploiting such an API.

> What I wrote was you are not going to be able to call an Android API via private invocation and succeed if the API requires a specific permission and your app hasn't declared it

Just like on iOS, with the difference that it happens at call time and not installation time.

> All of this only goes to prove that Apple's security in iOS is not extraordinary as you claim

It shows the exact opposite! Notice how ridiculously weak these results are. On one of the most high-profile targets today, an app may (unconfirmed) be able to determine the user's email address and send it to a server. On a trojan app that the user deliberately installed, and then deliberately granted access to Twitter, it can post a tweet without the user's confirmation, if the user has not updated the OS. Fetch the smelling salts!

Meanwhile, millions of Android phones are part of botnets, like NotCompatible.C, at one point reaching 1.5% of mobile devices in the USA. A Chrome 0-day came out last week, allowing full control remotely of fully-patched Android phones. These aren't research papers showing theoretical attacks, this is real life.

Yes, iOS has extraordinary security, and its competition only makes it look better.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#138

Post by lern_too_spel »

tptacek wrote: post #126
Justsignedup wrote: post #113

Earlier quoted context omitted.

Android's security is actaully fantastic. The problem is the inability for google to distribute security updates. In 6.0 I now get monthly security updates and there is even a "security update version" of like "november 2015" in the status. The latest junk even made it into Android 4.1 devices for security updates. But that is neither here nor there, the fact that we have 4.1 devices is a problem.

Android's system security design is inferior to that of iOS. But, iOS's superiority (a) derives in significant part from Apple's total control over the hardware platform†, and (b) comes at the cost of a lot of user control tradeoffs that nerds like us tend to hate. Really, to suggest that Android's security is at parity with Apple's, you'd have to be arguing that Apple does a terrible job at exploiting their inherent…

On the other hand, I'm unaware of any automated analysis of applications on the iTunes App Store, dynamic or static. Doing this properly isn't in Apple's DNA. For example, when XcodeGhost apps infected some hundreds of millions of users, it took Apple days to take down the affected apps, seemingly waiting for third party reports instead of simply scanning the entire store for the XcodeGhost signature themselves.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#139

Post by lern_too_spel »

tim333 wrote: post #86
blinkingled wrote: post #78

Earlier quoted context omitted.

I would not read too much into 'reports' by companies trying to sell you security products. If you want to talk impacts - both iOS and Android have been similarly impacted - big name apps getting into App Store that were compiled by hacked XCode, Ad SDKs using forbidden APIs etc. Likewise most Android malware is due to rooting and side loading apps from questionable sources.

So Android getting about 100x as much malware as iOS is not significant? That's from all reporting I've seen, not just that one. Just because iOS has problems too doesn't make the numbers the same.

Orders of magnitude more iOS users have been infected by malware (via XcodeGhost) than Google-flavored Android users, despite the latter platform having multiple times more users. The reports you're pointing to list malware in Chinese app stores on non-Google-flavored devices.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#140

Post by windexh8er »

tptacek wrote: post #44
hackuser wrote: post #43

Earlier quoted context omitted.

> A lot of Android's security issues are not always Google's fault. Some of them are in generic Linux libraries, some of them are in OEM added components (Samsung), and some of them are security issues unique to an app ecosystem (i.e. on Windows Win32 user applications normally have full permissions as that user, on Android an APK running as a user has a limited set of permissions, if it exceeds those permissions thi…

Apple has many of the same issues, and uses a huge amount of bug-riddled open source. The big difference between Android and iOS is that iOS, which is the same on every platform it runs, is locked down to a far greater extent than Android is. This is a good thing for security and a bad thing for end-user control; Google and Apple just took two different tradeoffs here.

I'm curious of what the general consensus is if we made it [pun] more apples to apples by comparing current state Nexus 5x/6p @ Android 6.x vs iPhone 6s @ iOS 9.x? Android, today, seems to be riddled with the legacy a la Microsoft - wherein XP is still at large, seemingly a similar problem with Android 3/4/5 still in use...

But is the cutting edge comparison really that much more skewed in Apple's favor?

I'd say that prior to the improvement on patch cycles as of recent in Android - iOS had an edge, but - outside of the walled garden I'm still very curious on the quality between the two with specific regard to the SDLC and resulting output.

Post reply on HN