Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-Click Calendar invite vulnerability chain in macOS

mikko-kenttala.medium.com

Post reply on HN
Print view View original

141–150 of 166 posts

Re: Zero-Click Calendar invite vulnerability chain in macOS

#141

Post by sho »

tptacek wrote: post #78
LegionMammal978 wrote: post #76

Earlier quoted context omitted.

> The cost of an uncharitable blog post is potentially unbounded (as in: not many people in a large tech company would know how to put a ceiling on the cost), and the cost of a bounty, even a high one, is more or less chump change. Look up "apple bug bounty" on Google, or any other search engine of your choice, and you'll find absolutely no shortage of people complaining of issues with the program. If these complaint…

Look, I believe you, but people complain about all these bounty programs, some of which I know to have been extraordinarily well managed, and usually when you get to the bottom of those complaints it comes down to a misapprehension the researchers have about what the bounty program is doing and what its internal constraints are. I acknowledge that another possibility is that the bounty program itself isn't performing…

> I'm going to push back on, and forcefully, is the idea that bounty programs have an incentive to stiff researchers. They do not

I replied upstream as well, but let me push back here as well. They can actually, if the bounty program is being run for the wrong reasons, which can happen - I know anecdotes aren't data, but I've seen one case first-hand.

If a bounty program is treated as a marketing project and/or an "executive value" project then they can and will be managed as a cost center and those costs will be deliberately minimized. Bang for buck. Now obviously this is perverse but if making your manager happy isn't an incentive then I don't know what to tell you.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#142

Post by smcin »

sho wrote: post #140
tptacek wrote: post #74

Earlier quoted context omitted.

I have no idea about how well the bounty program at Apple is managed, so, without affirming this, I acknowledge this is another plausible explanation: it's just an understaffed team that needs to get its act together. The only crusade I'm on is against the idea that companies ruthlessly avoid paying bounties, which is, on information and belief, flatly false, like, the opposite of the truth. I think it's valuable for…

> the idea that companies ruthlessly avoid paying bounties, which is, on information and belief, flatly false Eh, it's likely usually true, but I've worked for a company which was attracted to the bounty program idea mainly for the optics and very much did push back on/was very reluctant to pay out on bounties. And when I say "for the optics" I mean not only for the company being able to boast about having a bounty p…

Ok but not a company as reputable as Apple, yes?

Apple historically used to have a deservedly good reputation for this. I was quite shocked at this story.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#143

Post by ivan_gammel »

saghm wrote: post #104
ivan_gammel wrote: post #92

Earlier quoted context omitted.

I have never encountered a situation where recruiter starts immediately with an invite without prior conversation (such invite also blocks the time slot of the sender - it would be stupidly ineffective to do that). It is hypothetical and improbable scenario that is not even worth mentioning here.

Okay, so why wouldn't you be able to whitelist them ahead of time then?

It just doesn’t make sense to do it ahead of time in such situations. Email client could simply ask if I trust the email before processing the attachment (and some clients do that). Automated pre-processing of attachments is a general risk that doesn’t apply only to calendar.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#144

Post by tsimionescu »

autoexec wrote: post #16

> An attacker can send malicious calendar invites to the victim that include file attachments...Before fixes were done, I was able to send malicious calendar invitations to any Apple iCloud user and steal their iCloud Photos without any user interaction. What's the scope of this? Can anyone on macOS anywhere really just send random invites to anyone else who uses icloud? Who would even want that?

I don't understand, how is receiving a calendar invite different from receiving any other email? Does MacOS automatically do something with calendar invites by design?

Re: Zero-Click Calendar invite vulnerability chain in macOS

#145

Post by saagarjha »

tptacek wrote: post #105
saagarjha wrote: post #99

Earlier quoted context omitted.

Companies are not set up to accurately and effectively gauge the impact of intangible costs to themselves.

Exactly, which is why intangible costs will tend to be overpriced compared to risks with low cost ceilings, like "paying out an extra bounty".

The cost here is Apple changing their processes which is exceptionally painful for them

Re: Zero-Click Calendar invite vulnerability chain in macOS

#146

Post by tptacek »

saagarjha wrote: post #145
tptacek wrote: post #105

Earlier quoted context omitted.

Exactly, which is why intangible costs will tend to be overpriced compared to risks with low cost ceilings, like "paying out an extra bounty".

The cost here is Apple changing their processes which is exceptionally painful for them

What processes would those be, and do you have actual knowledge of them?

Re: Zero-Click Calendar invite vulnerability chain in macOS

#148

Post by sulandor »

SoftTalker wrote: post #55
kccqzy wrote: post #47

Thankfully I don't use iCloud Photo Library, but it's both weird to learn that when the photo library location has been changed, the new location does not get any protection. I would have expected the exploit to fail after setting /var/tmp/mypictures/Syndication.photoslibrary as the system photo library and opening Photos because the Photos app should know to protect this directory. I just did a quick test on my Sono…

I kind of get it. /tmp has historically been a world-readable/world-writable location in the directory hierarchy. If you want to save something private, it's not a great choice.

mkdir -m 700 /tmp/myprivatedir

you're welcome

Re: Zero-Click Calendar invite vulnerability chain in macOS

#149

Post by klingoff »

tptacek wrote: post #137
throwaway48476 wrote: post #135

Earlier quoted context omitted.

AP is saying they can suffer from the same corporate politics.

That doesn't make sense, because bounty programs can't punish vulnerability researchers other than not awarding bounties, and whistleblower programs can punish whistleblowers. I got what that comment was trying to say, but, no.

Huh? Whistleblower programs exist to defend them and fail to combat the problem, one that directly punishes would be like a bounty program that actually crafts the legal threats to security researchers.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#150

Post by _lvbh »

rvz wrote: post #2

Great write up. Any guess on the bounty amount for this zero-click vulnerability, with a 5 step exploit chain for macOS?

Has to be at least 6 figures. I got $47k on a pretty insignificant flaw with TCC and I would assume this is much more serious. The wait time is crazy though. It took almost a year to get fixed and another 6 months for the bounty to be paid. Then another year for them to even credit me for the CVE.

The fact that security researchers are completely at the mercy of the companies made me choose to do software Eng instead. Much more stable.

Post reply on HN