6 ms·

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to cat

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make careers, though, so there's a strong incentive to go public. [1] https://twitter.com/i0n1c/status/624172774915973120 https://twitter.com/i0n1c/status/624172774915973120

hurin 11y ago
> Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export" I don't think of this as strictly career advancement. I think he is making an important legal and political point. If there were never serious issues while we operate under said laws, then they would never be changed or subject to question either.
lawnchair_larry 11y ago
How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.
- enneff 11y ago
  https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
- acomjean 11y ago
  From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not."" So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..
  - 13 11y ago
    Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.
    - jsjohnst 11y ago
      Stefan is not just some random guy on the Internet. I can assure you the relevant folks at Apple know him and most likely he knows them.
      - oldmanjay 11y ago
        oh, well as long as you can assure us of that orthogonal point, I guess it's all good mr anonymous internet person
        jsjohnst 11y ago
        It's easy to prove. Just go look at the number of iOS and OSX security fixes attributed to him. Or you can go do a simple search on any reputable site posting security info and you'll see him all over it.
- code_sterling 11y ago
  You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out. I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...
  - geofft 11y ago
    A better analogy would be your doorman, whose one job is to watch who gets into your building, leaving the key cabinet unlocked and going to lunch. I don't mean to blame any individual human here, but I'm baffled at the process by which debugging environment variables were added to dyld without being carefully vetted for bad interactions with setuid binaries. This is a well-known easy place to screw up, and I'm surprised that someone was working on dyld without knowing that (although yes, humans forget things sometimes), and much more surprised that this made it past code review and into a shipping product. This isn't a random screw up in regular software. dyld is security-sensitive; it's one of the small number of libraries that bears a responsibility to be paranoid about setuid.
  - odonnellryan 11y ago
    That's kind-of a bad analogy. It'd be better of: 1) The person who left the house open was certain to get the message quicker because of the tweet than just a text. 2) It was possible to quickly and remotely lock the door. Apple can and should fix this bug very quickly, as that is certainly possible for them.
  - kordless 11y ago
    I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.
    - 11y ago
x0054 11y ago
Could you explain the dual-use export issue. I read a little about it here [1], but I don't understand. So, if Esser was to contact Apple and provide them with the vulnerability info for free, but with out first registering it as a dual-use export, he could get in trouble? Even if he didn't receive any compensation from Apple? Is that the case? [1] https://www.justsecurity.org/5703/export-control-arrangement-apply-computer-exploits/ https://www.justsecurity.org/5703/export-control-arrangement...
- rjaco31 11y ago
  He could basically be sent to jail for weapon smuggling, receiving any compensation is irrelevant.
  - gpvos 11y ago
    Even if Apple is the only place that he can reasonably contact to have the vulnerability fixed, instead of exploited? This law is weird.
  - x0054 11y ago
    That's a really sad state of affairs. Instead of promoting security, which is what the law claims to do, the law is actually promoting insecurity. Which is probably the true end goal of the law any way, if that's the way it's written. Threaten people with jail unless they first register security vulnerabilities with the government, than, when they do so, threaten them with even more jail time if they ever speak again about the said vulnerability, and keep the vulnerability for your self. I guess EU is just pissed that NSA has better toys. Really, truly sad state of affairs.
geofft 11y ago
Dynamic linkers trusting variables during setuid operation has long been a place known to be security-sensitive (or alternatively a fruitful source of privilege escalation bugs; see CVE-2010-3847 re LD_AUDIT, http://seclists.org/bugtraq/2004/Aug/281 http://seclists.org/bugtraq/2004/Aug/281 re LD_DEBUG, CVE-1999-1182 (!) re LD_DEBUG, etc.). The bug had never been particularly hidden from those with a malicious eye. Frankly, I find myself reading dyld's source code every so often when tracking down something or another with OS X program loading. I'm not saying I would have caught it, but I'm pretty sure I'm not the only one who reads it non-maliciously. Furthermore, it was fixed in 10.11 betas, so Apple themselves already knew about it [edit: apparently not]: https://twitter.com/i0n1c/status/624103245233917952 https://twitter.com/i0n1c/status/624103245233917952
- acomjean 11y ago
  Repost from the comments in the original article indicates it may have be fixed because apple changed something in the way it handles permissions. >EdisonCarter 3 days ago >It's only really "fixed" in El Capitan as a side effect of Apple introducing the new - and widely reported - "rootless" security feature which introduces fine grained file permissions.
feelix 11y ago
> Stefan Esser for flinging the vulnerability into the breeze for anyone to catch Then let me help you with this one. The former is responsibility of the worlds most profit corporation with tens of thousands of employees, and the latter is under the responsibility of a random guy on the internet.
- dspillett 11y ago
  Both are in the wrong. The behaviour of neither is a valid defence for the behaviour of the other. Apple are irresponsible for not addressing the issue in good time (they have known about it for long enough). This fellow is irresponsible for not following decent "responsible disclosure" procedure. He released information of a serious exploitable problem without first making any attempt to inform the people who could do something about it or otherwise checking to see if they were already aware. Relative size, income, employment/employee status, and so forth, are all irrelevant here.
  - feelix 11y ago
    You can pin responsibility onto a huge corporation. They can be liable for it. But you cannot control the behavior of random people on the internet without seriously impinging upon the general freedom of people everywhere. So the question of liability and responsibility is irrelevant if placed upon a random individual (unless you want a police state). It's best to hold the huge corporation liable.
    - foldr 11y ago
      >But you cannot control the behavior of random people on the internet without seriously impinging upon the general freedom of people everywhere. This isn't true at all. Shaming people for unethical or unprofessional actions which they make publicly is quite effective in altering behavior and doesn't require a police state.
beedogs 11y ago
Apple doesn't really seem to care much about its users once their money has changed hands. Look at how long every iPhone in the world was able to be remotely rebooted via a single text message. That took nearly two months to fix. They're much more interested in getting you to sign up for their new music service than they are in making sure the devices you use it on are secure.
_pmf_ 11y ago
> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. > Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. You're suggesting that he should feel ethically obliged to break the law for helping out a company that takes part in the usual tax and labor law evasion tactics (not to mention customer protection evasion in the US)?
- hueving 11y ago
  I believe parent is implying he should feel ethically obliged not to put everyone at risk that has a laptop. It has nothing to do with what's good for the company. That's not what responsible disclosure is about.
- dspillett 11y ago
  > helping out a company that takes part in the usual tax and labor law evasion tactics Irrelevant. The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour, not about helping Apple itself. Just because Apple does it (by sitting on the problem) does not make it right for other people to put the public at risk as well. Both parties can be in the wrong at the same time, the behaviour of neither of them is not valid defence for the other. You do have to be very careful in these cases because of the way the law is set out and how easily companies turn to litigious defence instead of actually fixing problems. In this case I would recommend anonymously informing the controlling party. Of course if he had already done that then things are different and public disclosure is probably the only other thing he could have done.
  - zamalek 11y ago
    > The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? > anonymously informing the controlling party With government surveillance could he have had any guarantee that his disclosure wouldn't have been snooped? Either way this discussion can be argued ad infinitum. The real villain here is the European Commission for such a brain-dead policy.
nothrabannosir 11y ago
> Disclosures make careers, though, so there's a strong incentive to go public. And Apple is doing their part by not emphasizing the role of the person who did disclose responsibly: This is obviously very bad news. Apple has evidently known about this issue for a while now – not due to Esser, but thanks to a responsible researcher going by the Twitter handle @beist, who had alerted Apple some time before Esser discovered the bug. As an outside observer, all I see here is: Don't alert Apple.
yAnonymous 11y ago
So are you suggesting to wait with the disclosure until Apple release a patch? Because there's a good chance that would never happen without it going public.

hurin 11y ago

> Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export" I don't think of this as strictly career advancement. I think he is making an important legal and political point. If there were never serious issues while we operate under said laws, then they would never be changed or subject to question either.

lawnchair_larry 11y ago

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

enneff 11y ago
https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
acomjean 11y ago
From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not."" So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..
- 13 11y ago
  Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.
  - jsjohnst 11y ago
    Stefan is not just some random guy on the Internet. I can assure you the relevant folks at Apple know him and most likely he knows them.
    - oldmanjay 11y ago
      oh, well as long as you can assure us of that orthogonal point, I guess it's all good mr anonymous internet person
      - jsjohnst 11y ago
        It's easy to prove. Just go look at the number of iOS and OSX security fixes attributed to him. Or you can go do a simple search on any reputable site posting security info and you'll see him all over it.
code_sterling 11y ago
You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out. I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...
- geofft 11y ago
  A better analogy would be your doorman, whose one job is to watch who gets into your building, leaving the key cabinet unlocked and going to lunch. I don't mean to blame any individual human here, but I'm baffled at the process by which debugging environment variables were added to dyld without being carefully vetted for bad interactions with setuid binaries. This is a well-known easy place to screw up, and I'm surprised that someone was working on dyld without knowing that (although yes, humans forget things sometimes), and much more surprised that this made it past code review and into a shipping product. This isn't a random screw up in regular software. dyld is security-sensitive; it's one of the small number of libraries that bears a responsibility to be paranoid about setuid.
- odonnellryan 11y ago
  That's kind-of a bad analogy. It'd be better of: 1) The person who left the house open was certain to get the message quicker because of the tweet than just a text. 2) It was possible to quickly and remotely lock the door. Apple can and should fix this bug very quickly, as that is certainly possible for them.
- kordless 11y ago
  I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.
  - 11y ago

x0054 11y ago

Could you explain the dual-use export issue. I read a little about it here [1], but I don't understand. So, if Esser was to contact Apple and provide them with the vulnerability info for free, but with out first registering it as a dual-use export, he could get in trouble? Even if he didn't receive any compensation from Apple? Is that the case? [1] https://www.justsecurity.org/5703/export-control-arrangement-apply-computer-exploits/ https://www.justsecurity.org/5703/export-control-arrangement...

rjaco31 11y ago
He could basically be sent to jail for weapon smuggling, receiving any compensation is irrelevant.
- gpvos 11y ago
  Even if Apple is the only place that he can reasonably contact to have the vulnerability fixed, instead of exploited? This law is weird.
- x0054 11y ago
  That's a really sad state of affairs. Instead of promoting security, which is what the law claims to do, the law is actually promoting insecurity. Which is probably the true end goal of the law any way, if that's the way it's written. Threaten people with jail unless they first register security vulnerabilities with the government, than, when they do so, threaten them with even more jail time if they ever speak again about the said vulnerability, and keep the vulnerability for your self. I guess EU is just pissed that NSA has better toys. Really, truly sad state of affairs.

geofft 11y ago

Dynamic linkers trusting variables during setuid operation has long been a place known to be security-sensitive (or alternatively a fruitful source of privilege escalation bugs; see CVE-2010-3847 re LD_AUDIT, http://seclists.org/bugtraq/2004/Aug/281 http://seclists.org/bugtraq/2004/Aug/281 re LD_DEBUG, CVE-1999-1182 (!) re LD_DEBUG, etc.). The bug had never been particularly hidden from those with a malicious eye. Frankly, I find myself reading dyld's source code every so often when tracking down something or another with OS X program loading. I'm not saying I would have caught it, but I'm pretty sure I'm not the only one who reads it non-maliciously. Furthermore, it was fixed in 10.11 betas, so Apple themselves already knew about it [edit: apparently not]: https://twitter.com/i0n1c/status/624103245233917952 https://twitter.com/i0n1c/status/624103245233917952

acomjean 11y ago
Repost from the comments in the original article indicates it may have be fixed because apple changed something in the way it handles permissions. >EdisonCarter 3 days ago >It's only really "fixed" in El Capitan as a side effect of Apple introducing the new - and widely reported - "rootless" security feature which introduces fine grained file permissions.

feelix 11y ago

> Stefan Esser for flinging the vulnerability into the breeze for anyone to catch Then let me help you with this one. The former is responsibility of the worlds most profit corporation with tens of thousands of employees, and the latter is under the responsibility of a random guy on the internet.

dspillett 11y ago
Both are in the wrong. The behaviour of neither is a valid defence for the behaviour of the other. Apple are irresponsible for not addressing the issue in good time (they have known about it for long enough). This fellow is irresponsible for not following decent "responsible disclosure" procedure. He released information of a serious exploitable problem without first making any attempt to inform the people who could do something about it or otherwise checking to see if they were already aware. Relative size, income, employment/employee status, and so forth, are all irrelevant here.
- feelix 11y ago
  You can pin responsibility onto a huge corporation. They can be liable for it. But you cannot control the behavior of random people on the internet without seriously impinging upon the general freedom of people everywhere. So the question of liability and responsibility is irrelevant if placed upon a random individual (unless you want a police state). It's best to hold the huge corporation liable.
  - foldr 11y ago
    >But you cannot control the behavior of random people on the internet without seriously impinging upon the general freedom of people everywhere. This isn't true at all. Shaming people for unethical or unprofessional actions which they make publicly is quite effective in altering behavior and doesn't require a police state.

beedogs 11y ago

Apple doesn't really seem to care much about its users once their money has changed hands. Look at how long every iPhone in the world was able to be remotely rebooted via a single text message. That took nearly two months to fix. They're much more interested in getting you to sign up for their new music service than they are in making sure the devices you use it on are secure.

_pmf_ 11y ago

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. > Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. You're suggesting that he should feel ethically obliged to break the law for helping out a company that takes part in the usual tax and labor law evasion tactics (not to mention customer protection evasion in the US)?

hueving 11y ago
I believe parent is implying he should feel ethically obliged not to put everyone at risk that has a laptop. It has nothing to do with what's good for the company. That's not what responsible disclosure is about.
dspillett 11y ago
> helping out a company that takes part in the usual tax and labor law evasion tactics Irrelevant. The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour, not about helping Apple itself. Just because Apple does it (by sitting on the problem) does not make it right for other people to put the public at risk as well. Both parties can be in the wrong at the same time, the behaviour of neither of them is not valid defence for the other. You do have to be very careful in these cases because of the way the law is set out and how easily companies turn to litigious defence instead of actually fixing problems. In this case I would recommend anonymously informing the controlling party. Of course if he had already done that then things are different and public disclosure is probably the only other thing he could have done.
- zamalek 11y ago
  > The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? > anonymously informing the controlling party With government surveillance could he have had any guarantee that his disclosure wouldn't have been snooped? Either way this discussion can be argued ad infinitum. The real villain here is the European Commission for such a brain-dead policy.

nothrabannosir 11y ago

> Disclosures make careers, though, so there's a strong incentive to go public. And Apple is doing their part by not emphasizing the role of the person who did disclose responsibly: This is obviously very bad news. Apple has evidently known about this issue for a while now – not due to Esser, but thanks to a responsible researcher going by the Twitter handle @beist, who had alerted Apple some time before Esser discovered the bug. As an outside observer, all I see here is: Don't alert Apple.

yAnonymous 11y ago

So are you suggesting to wait with the disclosure until Apple release a patch? Because there's a good chance that would never happen without it going public.