Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of Security Update 2017-001

support.apple.com

Post reply on HN
Print view View original

141–150 of 158 posts

Re: About the security content of Security Update 2017-001

#141

Post by matthewmacleod »

rdslw wrote: post #122
0x0 wrote: post #58

Earlier quoted context omitted.

Why is all communication from Apple on this case, both yesterday and today, being channeled via screenshots of text appended to random twitter users posts or blogs? It's weird that there's no official page on apple.com for these statements. (Beyond the actual "security update 2017-001" announcement webpage, which wasn't published until the patch was available)

easy: apple never acknowledged and confirmed that it made a serious mistake/offence/liability. big difference in court if someone decides to sue. disgusting.

This is nonsense. There are plenty of real issues here - please don’t make more up and waste our time.

Re: About the security content of Security Update 2017-001

#142

Post by slrz »

rimliu wrote: post #55
pandalicious wrote: post #35

Does their patch also disable root accounts that were enabled using the exploit?

I've enabled root myself and set password on it. After installation of the patch root account was disabled.

Wow. Automatic security update locks me out of my computer without any explicit notice given. How very nice of them.

Re: About the security content of Security Update 2017-001

#143

Post by elliotec »

vinceguidry wrote: post #51
blinkingled wrote: post #24

Earlier quoted context omitted.

> We are auditing our development processes to help prevent this from happening again. That's great to hear even if it took multiple stumbles for them to finally admit - but surely they should be also audit their QA/testing processes? Or does development in AppleSpeak mean everything?

I don't know how you could expect QA to be able to have a rigorous process to catch security problems of this type. It's one thing to audit the strength of crypto protocols, quite another to rigorously test every conceivable attack surface for privilege escalation. That space is vast.

What do you mean? That is literally the job of QA. Even the worst QAs I've worked with test every input field into oblivion.

Re: About the security content of Security Update 2017-001

#144

Post by Macha »

zbentley wrote: post #81
Bogdanp wrote: post #26

Earlier quoted context omitted.

That's kind of what it was: https://objective-see.com/blog/blog_0x24.html

It seems to me that the biggest problem highlighted by the link in parent is backwards compatibility of authentication metchanisms. OSX seems to support typical /etc/passwd hashed-user-credential authentication. However, it tries to "upgrade" that authentication mode to "shadowhash or securetoken", which appear to be two new auth schemes integrated with Open Directory. All of those things might be fine, on their own.…

After all the shit MS got for very strongly nudging users into using MS accounts instead of local accounts and Apple's low key effort to promote OSX and iOS as better for the user (including privacy) than Windows/Android, I can't see mandatory apple account usage being a realistic probability.

Re: About the security content of Security Update 2017-001

#145

Post by Macha »

cptskippy wrote: post #107
benchaney wrote: post #89

Earlier quoted context omitted.

People weren't upset about windows installing security updates. If this update adds nagware to OSX or forces people to restart their computer in the middle of whatever they are working on, your comment will be a fair point. Until then, it is an stupid comparison.

People were upset with Windows 10 for it's update policies for a number of different reasons but those very different reasons have all been lumped together into a singular general objection so that addressing one of those reasons will never solve the objection thus making the only possible solution disabling Windows Update. It's silly. Feature updates and quality updates are handled differently in Windows 10. You can…

Really? How do you do that? My windows machine informed me it was going to install the fall creators update when I shut it down for the night with no option not to (only to choose a different 8 your max active period)

Re: About the security content of Security Update 2017-001

#146

Post by pkamb »

sccxy wrote: post #79

Real problem is that if you are nobody then your private bug reports mean nothing. Only public shaming helps here. https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo... Author of this tweet said that Apple was informed at least week before tweet, but zero response.

> On Nov 23, the staff members informed Apple about it.

For everyone kvetching yesterday about "responsible disclosure".

Re: About the security content of Security Update 2017-001

#147

Post by prophesi »

geofft wrote: post #121
prophesi wrote: post #59

I heard the bug was working on El Capitan for some people [1]. Some Mac devices aren't able to upgrade past El Capitan; will they just forever have this vulnerability? [1] https://news.ycombinator.com/item?id=15800817

The link you post claims that root/empty password worked on the first try, not the second, which probably means that the system in question had the root account enabled with an empty password already (which is a thing you can intentionally configure and then forget about).

Ah, that makes sense. I haven't heard of any other instances of this, so I think it's safe to say El Cap isn't vulnerable.

Re: About the security content of Security Update 2017-001

#148

Post by cptskippy »

Macha wrote: post #145
cptskippy wrote: post #107

Earlier quoted context omitted.

People were upset with Windows 10 for it's update policies for a number of different reasons but those very different reasons have all been lumped together into a singular general objection so that addressing one of those reasons will never solve the objection thus making the only possible solution disabling Windows Update. It's silly. Feature updates and quality updates are handled differently in Windows 10. You can…

Really? How do you do that? My windows machine informed me it was going to install the fall creators update when I shut it down for the night with no option not to (only to choose a different 8 your max active period)

Argh! It looks like it's only an option on Pro, my Home machine doesn't have it. That's lame...

It's under Settings -> Updates & Security -> Advanced Options on Pro.

Re: About the security content of Security Update 2017-001

#149

Post by zbentley »

biggieshellz wrote: post #101
zbentley wrote: post #81

Earlier quoted context omitted.

It seems to me that the biggest problem highlighted by the link in parent is backwards compatibility of authentication metchanisms. OSX seems to support typical /etc/passwd hashed-user-credential authentication. However, it tries to "upgrade" that authentication mode to "shadowhash or securetoken", which appear to be two new auth schemes integrated with Open Directory. All of those things might be fine, on their own.…

Mac OS X has always used POSIX compliance as a selling point. Would the change you're suggesting break that?

I think they have already broken POSIX compliance in this area. A lot of the /etc/passwd entries don't do anything by default (like the root entry, in this case, whose significance in that file changes based on an external, second, unrelated-to-POSIX auth system).

While the file is still there in the same form it would be on a truly POSIX compliant system, the functionality is not.

The change I proposed, or other equivalent changes, might "loudly"/fatally break programs that rely on the /etc/passwd style of auth, but if those programs are depending on POSIX-compliant behavior based on that file on OSX systems already, they are likely "silently"/more subtly broken (which, when it comes to code that interacts with the security system, is a much worse thing, I think). It's the same old accessibility/security compromise as ever though.

Re: About the security content of Security Update 2017-001

#150

Post by danso »

matthewmacleod wrote: post #141
rdslw wrote: post #122

Earlier quoted context omitted.

easy: apple never acknowledged and confirmed that it made a serious mistake/offence/liability. big difference in court if someone decides to sue. disgusting.

This is nonsense. There are plenty of real issues here - please don’t make more up and waste our time.

I don't think it's particularly cynical-conspiracy-minded to believe that Apple's messaging, here and in every situation, is guided by a legal team. That's standard practice for every major company.
Post reply on HN