5 ms·

There's writing a nicely worded letter, and sending it in a rose scented envelope. And then there's scribbling a note, tying it to a rock, and throwing it throu

There's writing a nicely worded letter, and sending it in a rose scented envelope. And then there's scribbling a note, tying it to a rock, and throwing it through the window. Telling the world via a fully working exploit causes a ton of collateral damage, and the author made no effort at all to reduce the impact. Waiting for 10.10.5 and releasing it on a Saturday afternoon makes it seem like the point was to cause as big a mess as possible.

mikeash 11y ago
Maybe Saturday afternoon just happened to be when he finished. And no, it's not like throwing a rock through somebody's window. The information may be used by other people to cause damage, but the mere act of releasing it is not by itself damaging. Let's put blame where it belongs: on the people actually using exploits for bad purposes. If you want to encourage responsible disclosure, don't lead with bad analogies about what happens when you announce a vulnerability to the world, because it just reduces your credibility.
- qwertyoruiop 11y ago
  for the record: i had no idea yesterday was saturday at the time I dropped the code.
  - mikeash 11y ago
    Nothing says "hardcore hacker at work" quite like forgetting what day of the week it is.
    - gress 11y ago
      Nothing says 'irresponsible' like not thinking at all about the impact of releasing information you know people will use for harm. Publishing to github comes after the hacking. If qwertyoruiop had instead come up with plans for making a suitcase nuke from household ingredients, or for breeding an Ebola analog using a home beer making kit, your argument would imply that you think that posting them on the Internet would not be bad. I disagree.
      - mikeash 11y ago
        And again with the ridiculous analogies. It's really difficult to have a serious discussion about computer security vulnerabilities when people keep comparing it to throwing rocks through windows or weapons of mass destruction. And yes, it's relevant, because the severity of a problem can and does influence how problematic various approaches are. This is a local root exploit. Those are common and not generally problematic. The barrier to escalating from a normal user to root is at best the absolute last line of defense, and often completely irrelevant. It's a problem that should be fixed, don't get me wrong, but the severity is about 2 out of 10. The fact that I think it's not a bad thing to release information like this has no bearing on what I would think about releasing information on building a suitcase nuke from household ingredients. Could we try to keep the conversation grounded, here?
        gress 11y ago
        If you had been saying before now that this wasn't a severe bug and so we shouldn't be too concerned about disclosure, then you wouldn't have been presented with these strong counterarguments. But that isn't what you've been saying - rather, you've been making the general argument that releasing information is not damaging or bad, and that we should only hold the people who exploit vulnerabilities responsible - not those who disclose them. Multiple people have argued against you on this. Now you have switched your position to 'It's not bad to disclose vulnerabilities unless they are severe'. This seems much more reasonable, and came as the consequence of you being presented with what you are calling 'ridiculous' analogies. To me this seems like a serious discussion done right.
qwertyoruiop 11y ago
> and the author made no effort at all to reduce the impact http://github.com/kpwn/NULLGuard http://github.com/kpwn/NULLGuard
- MagerValp 11y ago
  Thank you. Any particular reason you decided to lead with the exploit and not this patch?
  - qwertyoruiop 11y ago
    I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publicly. I've had this for months, and I did not intend on disclosing at all. Proof of my "for months" assertion: https://www.youtube.com/watch?v=8arPid8GtFk https://www.youtube.com/watch?v=8arPid8GtFk > As a bare minimum Apple needs a few hours to analyze the bug Again, for the record: Apple has full details of the underlying bug. They won't even need to check my github at all.
    - scintill76 11y ago
      The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?
      - qwertyoruiop 11y ago
        iOS is vulnerable too as far as the vulnerability is concerned. It is not directly exploitable on iOS, however having a NULL task_t still does give you some abilities, even if not (directly?) SVC code exec.
    - MagerValp 11y ago
      That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.

mikeash 11y ago

Maybe Saturday afternoon just happened to be when he finished. And no, it's not like throwing a rock through somebody's window. The information may be used by other people to cause damage, but the mere act of releasing it is not by itself damaging. Let's put blame where it belongs: on the people actually using exploits for bad purposes. If you want to encourage responsible disclosure, don't lead with bad analogies about what happens when you announce a vulnerability to the world, because it just reduces your credibility.

qwertyoruiop 11y ago
for the record: i had no idea yesterday was saturday at the time I dropped the code.
- mikeash 11y ago
  Nothing says "hardcore hacker at work" quite like forgetting what day of the week it is.
  - gress 11y ago
    Nothing says 'irresponsible' like not thinking at all about the impact of releasing information you know people will use for harm. Publishing to github comes after the hacking. If qwertyoruiop had instead come up with plans for making a suitcase nuke from household ingredients, or for breeding an Ebola analog using a home beer making kit, your argument would imply that you think that posting them on the Internet would not be bad. I disagree.
    - mikeash 11y ago
      And again with the ridiculous analogies. It's really difficult to have a serious discussion about computer security vulnerabilities when people keep comparing it to throwing rocks through windows or weapons of mass destruction. And yes, it's relevant, because the severity of a problem can and does influence how problematic various approaches are. This is a local root exploit. Those are common and not generally problematic. The barrier to escalating from a normal user to root is at best the absolute last line of defense, and often completely irrelevant. It's a problem that should be fixed, don't get me wrong, but the severity is about 2 out of 10. The fact that I think it's not a bad thing to release information like this has no bearing on what I would think about releasing information on building a suitcase nuke from household ingredients. Could we try to keep the conversation grounded, here?
      - gress 11y ago
        If you had been saying before now that this wasn't a severe bug and so we shouldn't be too concerned about disclosure, then you wouldn't have been presented with these strong counterarguments. But that isn't what you've been saying - rather, you've been making the general argument that releasing information is not damaging or bad, and that we should only hold the people who exploit vulnerabilities responsible - not those who disclose them. Multiple people have argued against you on this. Now you have switched your position to 'It's not bad to disclose vulnerabilities unless they are severe'. This seems much more reasonable, and came as the consequence of you being presented with what you are calling 'ridiculous' analogies. To me this seems like a serious discussion done right.

qwertyoruiop 11y ago

> and the author made no effort at all to reduce the impact http://github.com/kpwn/NULLGuard http://github.com/kpwn/NULLGuard

MagerValp 11y ago
Thank you. Any particular reason you decided to lead with the exploit and not this patch?
- qwertyoruiop 11y ago
  I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publicly. I've had this for months, and I did not intend on disclosing at all. Proof of my "for months" assertion: https://www.youtube.com/watch?v=8arPid8GtFk https://www.youtube.com/watch?v=8arPid8GtFk > As a bare minimum Apple needs a few hours to analyze the bug Again, for the record: Apple has full details of the underlying bug. They won't even need to check my github at all.
  - scintill76 11y ago
    The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?
    - qwertyoruiop 11y ago
      iOS is vulnerable too as far as the vulnerability is concerned. It is not directly exploitable on iOS, however having a NULL task_t still does give you some abilities, even if not (directly?) SVC code exec.
  - MagerValp 11y ago
    That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.