Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero click vulnerability in Apple’s macOS Mail

mikko-kenttala.medium.com

Post reply on HN
Print view View original

131–140 of 269 posts

Re: Zero click vulnerability in Apple’s macOS Mail

#131

Post by eertami »

sixstringtheory wrote: post #23
tasogare wrote: post #15

Earlier quoted context omitted.

What’s right with it? I tried it a few times and always returned to web-based clients (on desktop) and third-party apps (outlook, gmail, protonmail) on iOS.

What web-based client will allow you to read email without an Internet connection in Safari? What marginal advantage does a third-party iOS client provide, that outweighs the risks of installing another app that is going to spy on me, have weaker integration with the OS and force me to relearn every new UI design language they come up with that in no way resembles the rest of the OS or its function and behavior?

>What web-based client will allow you to read email without an Internet connection in Safari?

I understand why it might be a deal breaker for you, but browsing email offline is not a use case everyone has.

Re: Zero click vulnerability in Apple’s macOS Mail

#132

Post by hn_throwaway_99 »

musicale wrote: post #66

> Mail will parse it to find out any attachments with x-mac-auto-archive=yes header in place. Mail will uncompress those files automatically. What could possibly go wrong? ;-/

Perhaps someone more knowledgeable could explain it to me, but uncompressing the files automatically doesn't seem like that big a deal to me. The much bigger sin appears to be allowing symlinks or a reference of any kind outside of a sandboxed directory.

Re: Zero click vulnerability in Apple’s macOS Mail

#133

Post by 2OEH8eoCRo0 »

jagger27 wrote: post #126
btheshoe wrote: post #123

Earlier quoted context omitted.

is there any reason to not just sell to zerodium and then report to apple afterwards?

From Zerodium’s FAQ: “By signing the agreement, you will accept an exclusive sale of your research to ZERODIUM and transfer all related intellectual property rights to us, meaning that the research becomes the exclusive property of ZERODIUM and you are not allowed to re-sell, share, publish, or report the research to any other person or entity.”

How would they enforce that? Even if Apple patches it Zerodium would have to sue Apple to find out.

Re: Zero click vulnerability in Apple’s macOS Mail

#134

Post by megous »

coder543 wrote: post #109
swiley wrote: post #33

It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account list for probably a decade which just hasn't been fixed.) Mutt may look old but at least it actually works.

Mutt has also had a number of remote code execution vulnerabilities over the years: https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor...

I don't use mutt with IMAP, so the last of those CVE issues that could have an effect was in 2005. And most of the rest of code execution bugs are related to IMAP. Pretty good.

Though I certainly shouldn't trust mutt to be bug free, given that it processes data that someone can send me freely. Gladly TUI programs are fairly easy to isolate in their own UNIX user account.

Re: Zero click vulnerability in Apple’s macOS Mail

#135

Post by brundolf »

slimsag wrote: post #106
swiley wrote: post #33

It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account list for probably a decade which just hasn't been fixed.) Mutt may look old but at least it actually works.

Important to note this isn't a memory corruption bug, though. This is a case of the application working as designed, but in unintended ways. A logic flaw. I say this because I don't see a lot of effort being put into solving these types of security issues, compared to e.g. memory safety issues.

Unlike memory safety issues it's not really a category that tends to have category-wide solutions

Re: Zero click vulnerability in Apple’s macOS Mail

#136

Post by sillysaurusx »

cozzyd wrote: post #127
sillysaurusx wrote: post #124

Earlier quoted context omitted.

Nice morals. In reality, people often take their morals with a side of cash. Let's turn it around. In Russia, the average salary is around $600 per year. Would you turn down a $50k payout? That's 83 years of an average salary. Consider that you may be in a privileged position if you can say no to that kind of money. The solution to this is for vendors to match what the market is paying. If an RCE is worth $50k on Zer…

$600 / month is the average salary per month (according to probably the same Google search you did). Presumably someone reporting security vulnerabilities makes well more than the average.

Oof. It's what I get for groggily typing something.

7 years of salary is a lifechanging amount of money too, but I admit the thrust of the argument isn't quite as strong with a basic error. :)

A better comment is probably "We've tried the alternative, and it doesn't seem to work. It's better to pay market rate."

Re: Zero click vulnerability in Apple’s macOS Mail

#137

Post by pbhjpbhj »

hn_throwaway_99 wrote: post #132
musicale wrote: post #66

> Mail will parse it to find out any attachments with x-mac-auto-archive=yes header in place. Mail will uncompress those files automatically. What could possibly go wrong? ;-/

Perhaps someone more knowledgeable could explain it to me, but uncompressing the files automatically doesn't seem like that big a deal to me. The much bigger sin appears to be allowing symlinks or a reference of any kind outside of a sandboxed directory.

Whilst we wait on someone knowledgeable I'll butt in, I once listened to a podcast on pentesting: other than zip bombs the issue I see is that other vulns can have code execution exploits against them if only the haxor can get the code on to the host. With automatic uncompression the code can be placed on a host by emailing a user -- no need to convince them to click anything.

Re: Zero click vulnerability in Apple’s macOS Mail

#138

Post by isaacg »

hn_throwaway_99 wrote: post #132
musicale wrote: post #66

> Mail will parse it to find out any attachments with x-mac-auto-archive=yes header in place. Mail will uncompress those files automatically. What could possibly go wrong? ;-/

Perhaps someone more knowledgeable could explain it to me, but uncompressing the files automatically doesn't seem like that big a deal to me. The much bigger sin appears to be allowing symlinks or a reference of any kind outside of a sandboxed directory.

Uncompressing files is a big complicated task with lots of fiddly little details. There are tons and tons of options, and that means tons and tons of attack surface. Besides symlinks, there could easily be all sorts of other errors that would produce a similar kind of exploit.

Re: Zero click vulnerability in Apple’s macOS Mail

#139

Post by whimsicalism »

megablast wrote: post #85
Zhenya wrote: post #19

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

Does it? It seems the priority should be fixing the issue.

Presumably not paying out has a chilling effect on bug identification by good guys.

Re: Zero click vulnerability in Apple’s macOS Mail

#140

Post by whimsicalism »

distribot wrote: post #103
rfd4sgmk8u wrote: post #96

For all those people who are complaining that Apple is taking its time paying out a bounty, and suggesting Zerodium: The end result of selling 0-click RCE vectors like this to brokers is sliced up bodies in embassies. Do folks think where the money coming from, and who would pay? No, its an 'easy' pay day. Some of us fix security bugs to keep people safe. Some of us try to earn an honest living doing so. Others try t…

I agree with and appreciate your position. I'm more annoyed with Apple than with the security researchers. Apple is preying on your desire to do good. They could easily afford to pay a reasonable amount and promptly.

I don't see how selling to zerodium is more morally bankrupt than working for defense contractors, which plenty of tech people do.
Post reply on HN