Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero click vulnerability in Apple’s macOS Mail

mikko-kenttala.medium.com

Post reply on HN
Print view View original

251–260 of 269 posts

Re: Zero click vulnerability in Apple’s macOS Mail

#251

Post by gumby »

glennpratt wrote: post #205
gumby wrote: post #150

Earlier quoted context omitted.

> Pixel which encrypt your device backups with on-device hardware encryption. Can you set up a new android phone from an old phone’s backup? If so, how could this work? This is a standard way to set up a new iPhone: “restore” from a backup of your previous phone. Especially handy when your old phone is no longer available (lost/broken)

Yes, decryption requires the original device's unlock PIN/pattern/password: https://security.googleblog.com/2018/10/google-and-android-h... Not that I fully understand how hard it is to circumvent.

Oh, I see. Apple has done that since the original iPhone too, and I believe iPod before it. I thought you meant they used a hardware key.

Re: Zero click vulnerability in Apple’s macOS Mail

#252

Post by spockz »

runeks wrote: post #221
spitfire wrote: post #104

Earlier quoted context omitted.

Bug bounty factoring! From wikipedia: > Factoring is a financial transaction and a type of debtor finance in which a business sells its accounts receivable (i.e., invoices) to a third party (called a factor) at a discount.[1][2][3] A business will sometimes factor its receivable assets to meet its present and immediate cash needs.[4][5] Forfaiting is a factoring arrangement used in international trade finance by expo…

This sounds like discounting a Bill of Exchange. Although the Bill of Exchange is drawn only against the delivery of a physical good, so this may be the difference between the two. For example, let's say I own a sheep farm. I hire people to trim the sheep, and they produce a bunch of cotton. Without the Bill of Exchange, if I want to pay the people I've hired then I will need to ship this cotton to the spinner, who t…

I think the general category this falls under is supply chain finance.

Re: Zero click vulnerability in Apple’s macOS Mail

#253

Post by treis »

asdfasgasdgasdg wrote: post #199
jonny_eh wrote: post #164

Earlier quoted context omitted.

That may be considered black-mail by some courts.

It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.

No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.

Re: Zero click vulnerability in Apple’s macOS Mail

#254

Post by Wowfunhappy »

Wowfunhappy wrote: post #237
Wowfunhappy wrote: post #185

Earlier quoted context omitted.

I'm on 10.9 and I don't want to use anything newer. I can deal with some risk, but this vulnerability is unacceptably bad. The core problem is that really dumb feature which auto-expands certain zip files. I need to turn that off. MailWebAttachment.h contains a method: - (BOOL)isAutoArchiveAttachment; I bet that if I Swizzle that to always return false, this "feature" will go away. I'll found out this weekend... Edit…

^ Yeah, that didn't work, the method never gets called. I'll have dig more...

Got it. Made very quickly but is working for me (which is all that really matters.) https://github.com/Wowfunhappy/Fix-Apple-Mail-CVE-2020-9922

Had to make `-(BOOL)isAutoArchivePart` in `MCMimePart` return false.

Re: Zero click vulnerability in Apple’s macOS Mail

#255

Post by rnikander »

codemac wrote: post #115
rnikander wrote: post #91

Earlier quoted context omitted.

What part of iCloud is the problem?

The part where it backs up all your messages without using a device specific key. The only things end to end encrypted are listed on this page: https://support.apple.com/en-us/HT202303 If you turn on iCloud syncing, basically you're falling back to simple "in transit" and "at rest" encryption. A lot of iPhone cracks involve just attacking your iCloud account, and then reading all of your messages from backups. This i…

Okay, so if I understand correctly, the data in those Apple products is not secured, but turning on iCloud on a device does not ruin encryption for other apps that take it seriously. So if I have an app that uses Keychain (end-to-end encrypted) and encrypts it's data properly, it is still secure.

Unless Apple is really bad and somehow collects my keys from keychain, or collects keys passed to CryptoKit, etc., straight out of RAM, and sends them to 3-letter agencies ... if I think that's happening, then I will look for new devices.

Re: Zero click vulnerability in Apple’s macOS Mail

#256

Post by Wowfunhappy »

Hnrobert42 wrote: post #195
Wowfunhappy wrote: post #185

Earlier quoted context omitted.

I'm on 10.9 and I don't want to use anything newer. I can deal with some risk, but this vulnerability is unacceptably bad. The core problem is that really dumb feature which auto-expands certain zip files. I need to turn that off. MailWebAttachment.h contains a method: - (BOOL)isAutoArchiveAttachment; I bet that if I Swizzle that to always return false, this "feature" will go away. I'll found out this weekend... Edit…

I’m curious and not attacking. Do you follow all security-related announcements for Mac OS and do your own back ports and fixes? How did you decide 10.9 is the right balance of risk for you?

I use 10.9 because out of all the OS's I've ever used, I like 10.9 the most by far, and I consider that worth the security risks. I browse the web in an up-to-date version of Chromium[0], I keep my computer behind an up-to-date router, and I trust my local software. An experienced hacker who wants to spend a few days getting into my computer will succeed, but they'd probably succeed anyway, and that's why I take measures like keeping backups in cold storage.

This was the first time I've actually backported a security fix. Apple Mail is easily where I'm most vulnerable, because it's not merely an outdated app which opens untrusted content—it opens untrusted content which anyone can push to me!

0: https://github.com/blueboxd/chromium-legacy

Re: Zero click vulnerability in Apple’s macOS Mail

#257

Post by codemac »

rnikander wrote: post #255
codemac wrote: post #115

Earlier quoted context omitted.

The part where it backs up all your messages without using a device specific key. The only things end to end encrypted are listed on this page: https://support.apple.com/en-us/HT202303 If you turn on iCloud syncing, basically you're falling back to simple "in transit" and "at rest" encryption. A lot of iPhone cracks involve just attacking your iCloud account, and then reading all of your messages from backups. This i…

Okay, so if I understand correctly, the data in those Apple products is not secured, but turning on iCloud on a device does not ruin encryption for other apps that take it seriously. So if I have an app that uses Keychain (end-to-end encrypted) and encrypts it's data properly, it is still secure. Unless Apple is really bad and somehow collects my keys from keychain, or collects keys passed to CryptoKit, etc., straigh…

I'm not sure I understand your keychain point. With iMessage you can message others with just your iCloud credentials if you turn it on, and you have access to full conversation history - without needing any particular device keys.

Re: Zero click vulnerability in Apple’s macOS Mail

#258

Post by codemac »

gumby wrote: post #251
glennpratt wrote: post #205

Earlier quoted context omitted.

Yes, decryption requires the original device's unlock PIN/pattern/password: https://security.googleblog.com/2018/10/google-and-android-h... Not that I fully understand how hard it is to circumvent.

Oh, I see. Apple has done that since the original iPhone too, and I believe iPod before it. I thought you meant they used a hardware key.

For your backups - but once you use iCloud to sync devices in real time, they just use their service keys, and your iCloud credentials are enough to read your iMessage history.

Re: Zero click vulnerability in Apple’s macOS Mail

#259

Post by albntomat0 »

twox2 wrote: post #241
philosopher1234 wrote: post #121

Earlier quoted context omitted.

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.

Bug bounty doesn't mean that the reporter is selling the bug they find for a reward. It's a gesture of gratitude from the company. This whole conversation is coming from a place of entitlement.

Here's an alternative view:

- Apple is a $2T company, that we trust with our data. That valuation is in part based on that trust. It's entitled of Apple to produce a product that contains shitty exploitable symlink handling and continue to have no meaningful repercussions (which is true in the industry as a whole).

If this was a bug in a small, under-resourced FOSS email client, or the exploit required many highly skilled person-years to find, maybe I'd feel differently.

Re: Zero click vulnerability in Apple’s macOS Mail

#260

Post by albntomat0 »

Itsdijital wrote: post #166
jonny_eh wrote: post #164

Earlier quoted context omitted.

That may be considered black-mail by some courts.

I guess that's true. Whats the end state if Apple refuses to pay?

Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.
Post reply on HN