Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-Click Calendar invite vulnerability chain in macOS

mikko-kenttala.medium.com

Post reply on HN
Print view View original

151–160 of 166 posts

Re: Zero-Click Calendar invite vulnerability chain in macOS

#151

Post by zer0c00ler »

latexr wrote: post #116
tptacek wrote: post #39

Lots of comments on this thread about bounty payouts. If a tech giant with a standing bounty program isn't paying a bounty, the odds are very strong that there's a good reason for that. All of the incentives for these programs are to award bounties to legitimate submissions. This is a rare case where incentives actually align pretty nicely: companies stand up bounty programs to incentivize specific kinds of research;…

Have you ever reported security and privacy issues to Apple? I have. In fact, I have more than one incident open with them right now. One of them could be fixed in one line of code with no adverse consequences. It’s been open for two years. Apple’s Security team is either highly disinterested or highly incompetent. I don’t care which, neither is good. It’s one of the most infuriating and frustrating experiences I eve…

[dead]

Re: Zero-Click Calendar invite vulnerability chain in macOS

#152

Post by Moru »

klingoff wrote: post #149
tptacek wrote: post #137

Earlier quoted context omitted.

That doesn't make sense, because bounty programs can't punish vulnerability researchers other than not awarding bounties, and whistleblower programs can punish whistleblowers. I got what that comment was trying to say, but, no.

Huh? Whistleblower programs exist to defend them and fail to combat the problem, one that directly punishes would be like a bounty program that actually crafts the legal threats to security researchers.

That is being done too. Teenagers showing vulnerabilities in school systems have been prosecuted in Sweden... Needless to say, they didn't get much help with looking for holes after that so who knows how many security holes they still have.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#153

Post by 1oooqooq »

kccqzy wrote: post #47

Thankfully I don't use iCloud Photo Library, but it's both weird to learn that when the photo library location has been changed, the new location does not get any protection. I would have expected the exploit to fail after setting /var/tmp/mypictures/Syndication.photoslibrary as the system photo library and opening Photos because the Photos app should know to protect this directory. I just did a quick test on my Sono…

Linux now you can trivially isolate everything better than osx. Even without apparmor or firejail, most services gets their private tmp by default.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#154

Post by 1oooqooq »

btown wrote: post #123
paperplatter wrote: post #121

Step 1 is a crazy vulnerability on its own. How did Apple not consider this? > The attacker can exploit this to conduct a successful directory traversal attack by setting an arbitrary path to a file in the ATTACH section with: “FILENAME=../../../PoC.txt”.

I think this speaks to a larger problem that likely exists in every company: certainly someone at Apple had written a library function to do this safely, but how do you enforce that that function is used, rather than reimplemented unsafely from scratch? Especially if code reviewers are also unfamiliar with the library. Are there any modern solutions for this?

Easy, by not firing people left and right.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#155

Post by tikkabhuna »

btown wrote: post #123
paperplatter wrote: post #121

Step 1 is a crazy vulnerability on its own. How did Apple not consider this? > The attacker can exploit this to conduct a successful directory traversal attack by setting an arbitrary path to a file in the ATTACH section with: “FILENAME=../../../PoC.txt”.

I think this speaks to a larger problem that likely exists in every company: certainly someone at Apple had written a library function to do this safely, but how do you enforce that that function is used, rather than reimplemented unsafely from scratch? Especially if code reviewers are also unfamiliar with the library. Are there any modern solutions for this?

Static code analysis tools that can flag for the use of the insecure function?

Re: Zero-Click Calendar invite vulnerability chain in macOS

#156

Post by fulafel »

tptacek wrote: post #39

Lots of comments on this thread about bounty payouts. If a tech giant with a standing bounty program isn't paying a bounty, the odds are very strong that there's a good reason for that. All of the incentives for these programs are to award bounties to legitimate submissions. This is a rare case where incentives actually align pretty nicely: companies stand up bounty programs to incentivize specific kinds of research;…

I'm betting Hanlon's razor (= incompetence) helps with divining the reasons of the tech giant in question here.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#157

Post by mozzieman »

latexr wrote: post #116
tptacek wrote: post #39

Lots of comments on this thread about bounty payouts. If a tech giant with a standing bounty program isn't paying a bounty, the odds are very strong that there's a good reason for that. All of the incentives for these programs are to award bounties to legitimate submissions. This is a rare case where incentives actually align pretty nicely: companies stand up bounty programs to incentivize specific kinds of research;…

Have you ever reported security and privacy issues to Apple? I have. In fact, I have more than one incident open with them right now. One of them could be fixed in one line of code with no adverse consequences. It’s been open for two years. Apple’s Security team is either highly disinterested or highly incompetent. I don’t care which, neither is good. It’s one of the most infuriating and frustrating experiences I eve…

Not saying any about Apples bug bounty program, i manage my companies bug bounty program and for every good submission we get about 10 from India where they xss themselves in web browser console or similar hard to read texts that lead to nothing.

And now we starting to get a lot of AI generated submitted stuff. Take a lot of effort just sort trough the bullshit to accept the good ones, and then to manage it and fix things within SLA when not critical is very easy it gets pushed very down the backlog, competing with all different kind of request from customers to fix things. Code changes might be a one liner but testing etc can blow up stuff to be a very long process.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#158

Post by factormeta »

wannacboatmovie wrote: post #111
bakztfutur3 wrote: post #68

Earlier quoted context omitted.

No, it's because Apple's 'product security' team that investigates and pays out bug bounties is horribly mismanaged and ineffective. It was recently moved from the SWE program office to SEAR (security engineering & arch), and the manager was recently shown the door and went to AirBNB. The team members are mostly new college grads (ICT2's and 3's) who wouldn't pass a coding interview elsewhere in the company, and most…

Getting paid to fuck off at conferences and hang out with hackers on the company dime instead of staring at a screen in a cubicle all day sounds pretty awesome. Do I detect some jealousy or resentment that you haven't mastered the art of the corporate grift?

practice of the art of the corporate grift does take a toll on one's soul. Usually only pyscho/sociapath can do master this and do it for a long time without any emotional/mental consequences.

Re: Zero-Click Calendar invite vulnerability chain in macOS

#159

Post by factormeta »

tptacek wrote: post #32
vessenes wrote: post #9

Don’t love the bounty state here — security researchers, is it typical to wait this long with Apple or other FAANG type companies?

Very yes.

seems this just encourage researchers to sell zero-day exploits to organize crime and/or alphabet letter agencies. No wonder we have no digital security at all! Big tech don't really care about security or privacy. Why are we even using their stuff?
Post reply on HN