4 ms·

Apple is able to scan iOS code for e.g. use of nonpublic API's; certainly they can grep a binary for a recognizable chunk of OpenSSL code, too. (Neither the iO

Apple is able to scan iOS code for e.g. use of nonpublic API's; certainly they can grep a binary for a recognizable chunk of OpenSSL code, too. (Neither the iOS scans nor the OpenSSL scan will catch everything, of course.)

joosters 11y ago
A recognizable chunk of OpenSSL code? It could be any statically linked and custom-compiled version, that's millions of possible versions, once you take into account compile options, optimisation levels and linking techniques. Good luck grepping for it! Even if the version number is in there somewhere, there's probably all kinds of false positives that you would hit. Plus, it could be due to other SSL libraries, not just OpenSSL. In short, there's no realistic way to do what you are asking.
- lstamour 11y ago
  I disagree. Finding recognizable chunks of code is what antivirus software does every day. And while they're not perfect, the OpenSSL code in question here isn't exactly trying to hide, unlike viruses in real life. This was obviously an oversight, but I would expect that after this, they run occasional tests of the app verification process across all apps, and not just verify the apps themselves don't crash. In fact, they must be doing this kind of thing right now -- how else could they contact all the affected developers?
- dikaiosune 11y ago
  I'm not terribly familiar, but these guys appear to be achieving some pretty sophisticated introspection into binary library usage: https://sourcedna.com/ https://sourcedna.com/ It would be interesting to see this applied to non-mobile apps.
- vsl 11y ago
  Not what the parent said, true, but you can test for this easily: launch the app, see if it terminates with exit code 173 (receipt check fail) in the first few seconds if fed SHA-2 receipt but not the old SHA-1 one. Won't catch all (apps may validate later during runtime), will catch enough to give you some idea about the scope.

joosters 11y ago

A recognizable chunk of OpenSSL code? It could be any statically linked and custom-compiled version, that's millions of possible versions, once you take into account compile options, optimisation levels and linking techniques. Good luck grepping for it! Even if the version number is in there somewhere, there's probably all kinds of false positives that you would hit. Plus, it could be due to other SSL libraries, not just OpenSSL. In short, there's no realistic way to do what you are asking.

lstamour 11y ago
I disagree. Finding recognizable chunks of code is what antivirus software does every day. And while they're not perfect, the OpenSSL code in question here isn't exactly trying to hide, unlike viruses in real life. This was obviously an oversight, but I would expect that after this, they run occasional tests of the app verification process across all apps, and not just verify the apps themselves don't crash. In fact, they must be doing this kind of thing right now -- how else could they contact all the affected developers?
dikaiosune 11y ago
I'm not terribly familiar, but these guys appear to be achieving some pretty sophisticated introspection into binary library usage: https://sourcedna.com/ https://sourcedna.com/ It would be interesting to see this applied to non-mobile apps.
vsl 11y ago
Not what the parent said, true, but you can test for this easily: launch the app, see if it terminates with exit code 173 (receipt check fail) in the first few seconds if fed SHA-2 receipt but not the old SHA-1 one. Won't catch all (apps may validate later during runtime), will catch enough to give you some idea about the scope.