20 ms·

The security content of iOS 10.3.3

170 points by codezero 9y ago

0x0 9y ago
Interestingly, the changelogs are silent about a fairly major change to the filesystem when going from 10.3.x to 10.3.3. It seems like APFS was originally intended to use a different unicode normalization setup than HFS, but it turned out to be very problematic. After iOS 10.3.0 silently converted all iOS devices from HFS to APFS (!) (and not only was this not specified in the user-visible changelogs, earlier iOS 10.x.x releases did the same dry-run conversion without notice - only stopping short of committing the final type flip - which may explain why iOS OTA upgrades have been somewhat slow to execute - https://www.macobserver.com/analysis/apple-dry-run-apfs-prior-ios-10-3/ https://www.macobserver.com/analysis/apple-dry-run-apfs-prio... ), iOS 10.3.3 adds runtime normalization to the file system. It's unclear what kind of performance hit this has (but I seem to remember reading something about how samba on UNIX taking a hit on file opens in order to support clients specifying incorrect casing, which sounds similar). Apparently an unspecified later version of iOS will perform yet another conversion, from APFS-normalization-preserving to APFS-native-normalization. More details: https://mjtsai.com/blog/2017/06/27/apfs-native-normalization/ https://mjtsai.com/blog/2017/06/27/apfs-native-normalization... By the way, if you ever rsync between macOS and Linux you may have noticed (or not) how this unicode normalization messes up filenames and cause duplicates and stale copies when roundtripping, see https://serverfault.com/questions/397420/converting-utf-8-nfd-filenames-to-utf-8-nfc-in-either-rsync-or-afpd https://serverfault.com/questions/397420/converting-utf-8-nf... .. Also, unrelated, it seems this version of iOS fixes the Broadpwn wifi chip vulnerability (which perhaps could also continue on to compromise the main OS kernel via a DMA attack after compromising the wifi chip) ( http://boosterok.com/blog/broadpwn2/ http://boosterok.com/blog/broadpwn2/ , https://nvd.nist.gov/vuln/detail/CVE-2017-9417 https://nvd.nist.gov/vuln/detail/CVE-2017-9417 )
- timcederman 9y ago
  > After iOS 10.3.0 silently converted all iOS devices from HFS to APFS (!) (and not only was this not specified in the user-visible changelogs Are you suggesting Apple didn't disclose APFS was coming to 10.3? There was plenty of media coverage ahead of time (e.g. https://9to5mac.com/2017/03/21/what-is-apples-upcoming-apfs-apple-file-system-and-what-it-means-to-you/ https://9to5mac.com/2017/03/21/what-is-apples-upcoming-apfs-...), and it's specifically mentioned in the 10.3 release notes.
  - urda 9y ago
    It was absolutely disclosed all over, so I'm not sure if this is simply the commentor being wrong (most likely) or a weak jab at Apple. https://developer.apple.com/library/content/releasenotes/General/RN-iOSSDK-10.3/index.html https://developer.apple.com/library/content/releasenotes/Gen...
    - sixstringtheory 9y ago
      Those release notes are intended for their developer audience, not the general end user base. Parent was pointing out that the actual release notes Apple shows you on the device you're about to upgrade did not mention APFS.
      - reaperducer 9y ago
        The general audience doesn't even know that its phone has a file system, let alone care whether it's HFS, HPFS, APFS, or CP/M. You're complaining that Apple didn't disclose something that only developers care about to the masses.
        0x0 9y ago
        Then at least we can agree that a fairly major operation such as converting the entire disk between file systems in a "minor" update wasn't disclosed to the masses, and I think that fact (and that it worked out quite well, apparently, besides the normalization shenanigans) is interesting it its own right.
        otterley 9y ago
        I think it's important to distinguish a major change from an impactful one. The APFS change is major, but not necessarily impactful in any meaningful sense to users. Apple's not the kind of company that's going to emphasize non-impactful changes to its customer base.
        9y ago
- noja 9y ago
  > By the way, if you ever rsync between macOS and Linux... Syncthing handles this with automatic normalization: https://docs.syncthing.net/advanced/folder-autonormalize.html https://docs.syncthing.net/advanced/folder-autonormalize.htm...
- vvhn 9y ago
  >from APFS-normalization-preserving to APFS-native-normalization. The developer documentation at [1] seems to suggest that "native" normalization is normalization preserving as well and that native normalization is based on storing the hash of the normalized name instead of storing the normalized name itself. " and preserves both case and normalization of the filename on disk in all variants. " and " APFS preserves the normalization of the filename and uses hashes of the normalized form of the filename to provide normalization insensitivity, whereas HFS+ stores the normalized form of the filename on disk to provide normalization insensitivity. " edit - Even the linked blog post says the same thing " macOS 10.13 will also support case-sensitive APFS, which will use native normalization. This is new in the developer beta. The filenames are still stored in the same way as prior APFS (not normalized like with HFS+), but APFS now uses normalization-insensitive hashes ... " >how this unicode normalization messes up filenames and cause duplicates and stale copies when roundtripping Being normalization preserving should fix that, right ? 1 https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html https://developer.apple.com/library/content/documentation/Fi...
- acranox 9y ago
  I wonder if the change to the filesystem is why my phones performance feels so sucky the last few months. I have an iPhone 6. it starting hanging for several seconds at various times. It didn't used to suck this much.
  - Eric_WVGG 9y ago
    Most reports say it's faster, the experience on my iPhone SE has certainly been just fine. I would consider backing up, wiping, and restoring from backup perhaps.
pjmlp 9y ago
2 x "A buffer overflow issue was addressed through improved memory handling." 7 x "A memory corruption issue was addressed with improved bounds checking." Oh well....
- pqdbr 9y ago
  With 13x arbitrary code execution, being 5x with either kernel or system privileges.
  - hellbanner 9y ago
    Yes, and previous decimal versions had similarly powerful exploits.
- PhantomGremlin 9y ago
  This is depressing. I normally shrug off security vulnerabilities in iOS. But so many in such a minor release? I know it's not a valid extrapolation ... but if there are so many being fixed just today, that means there are hundreds if not thousands of still undiscovered ones remaining. And Android is probably even worse. To repeat myself: this is depressing.
  - ccrush 9y ago
    https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... This is Microsoft's patch covering ShadowBrokers-leaked ETERNALBLUE SMB remote code execution 0day. The iOS 10.3.3 is likely the response to either the CIA Vault7 Wikileaks stash or the ShadowBrokers NSA EquationGroup stash. These exploits are probably out there in the hands of many people, and Apple had to respond.
    - WalterGR 9y ago
      That Microsoft link lists 6 CVEs. Apple's security content page lists 48. That's probably an unfair comparison. How many vulnerabilities have been patched for all of those leaks / stashes by Apple and Microsoft? It seems like we'd need to know those numbers in order to fairly judge whether PhantomGremlin should feel depressed or not.
p0ppe 9y ago
I'm still perplexed that Apple doesn't offer over the air updates, especially for security updates. 137 MB shouldn't be that big a deal on a normal 4G connection.
- 0x0 9y ago
  Agreed, this is super annoying. You can install dozens of 99MB apps over 4G every day but nooo you can't have your broadpwn fix on the move. Except if you happen to have two devices with 4G, then you can wifi-hotspot-tether one to the other and vice versa for the update just fine.
- spike021 9y ago
  Not everybody has unlimited data plans. 4G can certainly handle 137 MB in speed, but that doesn't mean users want to use their data plan for updates.
  - 0x0 9y ago
    Then at least allow it for manual update requests. Just like 99MB app installs or updates don't have a problem with 4G :)
  - p0ppe 9y ago
    But that should be up to the users to decide. I'll be much happier to use up 137 MB for a critical security update than 354 MB for the latest Facebook app update (version 132.0).
    - justinv 9y ago
      FYI even though it says 324mb, App Store updates are delta updates as of iOS 6 https://developer.apple.com/library/content/qa/qa1779/_index.html https://developer.apple.com/library/content/qa/qa1779/_index...
      - tedmiston 9y ago
        Coming from 10.3.2, the 10.3.3 update was 84.4 MB for me.
ProfessorLayton 9y ago
They still haven't addressed the permanent website data bug in Safari. Go to Settings> Safari> Advanced> Website Data and try and clear it. Some websites won't delete arbitrarily, and if they do, others will stick. This happens even in private browsing.
- GeneticGenesis 9y ago
  Have you filed a radar bug?
  - nikanj 9y ago
    In my experience, those are about as useful as telling your dog about the bug. Complaining on HN has a slight possibility someone from Apple might actually see the bug, and fix it.
    - p49k 9y ago
      I'd disagree, I've filed probably 15 in the past 7 years for obscure bugs and all of them were fixed. They don't respond and the fixes take a long time, but I'm pretty sure they are listening.
      - deleted 9y ago
        [deleted]
      - lttlrck 9y ago
        I’ve used the built in Feedback app several times and received replies asking for follow up so it’s fair to say they are listening
    - codezero 9y ago
      Not that this will instil a huge amount of confidence, but I filed a bug about a XNU kernel syscal that returned the wrong error code. They shipped a fix two years later and closer the ticket. I provided a diff fixing the bug but ¯\_(ツ)_/¯
CodeWriter23 9y ago
Anyone know if the WiFi exploit opened the door to arbitrary code execution on the main CPU?
- inertial 9y ago
  If you are referring to broadpwn aka CVE-2017-9417 [1], it has been fixed (last item in [2]). [1] https://news.ycombinator.com/item?id=14727400 https://news.ycombinator.com/item?id=14727400 [2] https://support.apple.com/en-us/HT207923 https://support.apple.com/en-us/HT207923 Summary : Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip Description: A memory corruption issue was addressed with improved memory handling.
  - CodeWriter23 9y ago
    This is what I'm interested in, and I saw that Apple fixed the exploit enabling attackers to own the WiFi chip. What I want to know, does owning the WiFi chip on machines not having the patch provide a beachhead to exploiting the iOS kernel. And if so, are there known active exploits at that level?
  - stock_toaster 9y ago
    Wasn't there another remote buffer overrun vuln in broadcom's wi-fi chips reported back in april too? yikes... EDIT: found it[1] [1]: https://www.theregister.co.uk/2017/04/05/broadcom_wifi_chip_bugs/ https://www.theregister.co.uk/2017/04/05/broadcom_wifi_chip_...
deleted 9y ago
[deleted]
tarikozket 9y ago
So pretty much anyone was able to execute anything on our phone remotely. Lol.
- Tanegashima 9y ago
  No, it’s not like android or windows.
- Piccollo 9y ago
  Haven't heard of anything public though

170 points by codezero 9y ago

0x0 9y ago

Interestingly, the changelogs are silent about a fairly major change to the filesystem when going from 10.3.x to 10.3.3. It seems like APFS was originally intended to use a different unicode normalization setup than HFS, but it turned out to be very problematic. After iOS 10.3.0 silently converted all iOS devices from HFS to APFS (!) (and not only was this not specified in the user-visible changelogs, earlier iOS 10.x.x releases did the same dry-run conversion without notice - only stopping short of committing the final type flip - which may explain why iOS OTA upgrades have been somewhat slow to execute - https://www.macobserver.com/analysis/apple-dry-run-apfs-prior-ios-10-3/ https://www.macobserver.com/analysis/apple-dry-run-apfs-prio... ), iOS 10.3.3 adds runtime normalization to the file system. It's unclear what kind of performance hit this has (but I seem to remember reading something about how samba on UNIX taking a hit on file opens in order to support clients specifying incorrect casing, which sounds similar). Apparently an unspecified later version of iOS will perform yet another conversion, from APFS-normalization-preserving to APFS-native-normalization. More details: https://mjtsai.com/blog/2017/06/27/apfs-native-normalization/ https://mjtsai.com/blog/2017/06/27/apfs-native-normalization... By the way, if you ever rsync between macOS and Linux you may have noticed (or not) how this unicode normalization messes up filenames and cause duplicates and stale copies when roundtripping, see https://serverfault.com/questions/397420/converting-utf-8-nfd-filenames-to-utf-8-nfc-in-either-rsync-or-afpd https://serverfault.com/questions/397420/converting-utf-8-nf... .. Also, unrelated, it seems this version of iOS fixes the Broadpwn wifi chip vulnerability (which perhaps could also continue on to compromise the main OS kernel via a DMA attack after compromising the wifi chip) ( http://boosterok.com/blog/broadpwn2/ http://boosterok.com/blog/broadpwn2/ , https://nvd.nist.gov/vuln/detail/CVE-2017-9417 https://nvd.nist.gov/vuln/detail/CVE-2017-9417 )

timcederman 9y ago
> After iOS 10.3.0 silently converted all iOS devices from HFS to APFS (!) (and not only was this not specified in the user-visible changelogs Are you suggesting Apple didn't disclose APFS was coming to 10.3? There was plenty of media coverage ahead of time (e.g. https://9to5mac.com/2017/03/21/what-is-apples-upcoming-apfs-apple-file-system-and-what-it-means-to-you/ https://9to5mac.com/2017/03/21/what-is-apples-upcoming-apfs-...), and it's specifically mentioned in the 10.3 release notes.
- urda 9y ago
  It was absolutely disclosed all over, so I'm not sure if this is simply the commentor being wrong (most likely) or a weak jab at Apple. https://developer.apple.com/library/content/releasenotes/General/RN-iOSSDK-10.3/index.html https://developer.apple.com/library/content/releasenotes/Gen...
  - sixstringtheory 9y ago
    Those release notes are intended for their developer audience, not the general end user base. Parent was pointing out that the actual release notes Apple shows you on the device you're about to upgrade did not mention APFS.
    - reaperducer 9y ago
      The general audience doesn't even know that its phone has a file system, let alone care whether it's HFS, HPFS, APFS, or CP/M. You're complaining that Apple didn't disclose something that only developers care about to the masses.
      - 0x0 9y ago
        Then at least we can agree that a fairly major operation such as converting the entire disk between file systems in a "minor" update wasn't disclosed to the masses, and I think that fact (and that it worked out quite well, apparently, besides the normalization shenanigans) is interesting it its own right.
        otterley 9y ago
        I think it's important to distinguish a major change from an impactful one. The APFS change is major, but not necessarily impactful in any meaningful sense to users. Apple's not the kind of company that's going to emphasize non-impactful changes to its customer base.
        9y ago
noja 9y ago
> By the way, if you ever rsync between macOS and Linux... Syncthing handles this with automatic normalization: https://docs.syncthing.net/advanced/folder-autonormalize.html https://docs.syncthing.net/advanced/folder-autonormalize.htm...
vvhn 9y ago
>from APFS-normalization-preserving to APFS-native-normalization. The developer documentation at [1] seems to suggest that "native" normalization is normalization preserving as well and that native normalization is based on storing the hash of the normalized name instead of storing the normalized name itself. " and preserves both case and normalization of the filename on disk in all variants. " and " APFS preserves the normalization of the filename and uses hashes of the normalized form of the filename to provide normalization insensitivity, whereas HFS+ stores the normalized form of the filename on disk to provide normalization insensitivity. " edit - Even the linked blog post says the same thing " macOS 10.13 will also support case-sensitive APFS, which will use native normalization. This is new in the developer beta. The filenames are still stored in the same way as prior APFS (not normalized like with HFS+), but APFS now uses normalization-insensitive hashes ... " >how this unicode normalization messes up filenames and cause duplicates and stale copies when roundtripping Being normalization preserving should fix that, right ? 1 https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html https://developer.apple.com/library/content/documentation/Fi...
acranox 9y ago
I wonder if the change to the filesystem is why my phones performance feels so sucky the last few months. I have an iPhone 6. it starting hanging for several seconds at various times. It didn't used to suck this much.
- Eric_WVGG 9y ago
  Most reports say it's faster, the experience on my iPhone SE has certainly been just fine. I would consider backing up, wiping, and restoring from backup perhaps.

pjmlp 9y ago

2 x "A buffer overflow issue was addressed through improved memory handling." 7 x "A memory corruption issue was addressed with improved bounds checking." Oh well....

pqdbr 9y ago
With 13x arbitrary code execution, being 5x with either kernel or system privileges.
- hellbanner 9y ago
  Yes, and previous decimal versions had similarly powerful exploits.
PhantomGremlin 9y ago
This is depressing. I normally shrug off security vulnerabilities in iOS. But so many in such a minor release? I know it's not a valid extrapolation ... but if there are so many being fixed just today, that means there are hundreds if not thousands of still undiscovered ones remaining. And Android is probably even worse. To repeat myself: this is depressing.
- ccrush 9y ago
  https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... This is Microsoft's patch covering ShadowBrokers-leaked ETERNALBLUE SMB remote code execution 0day. The iOS 10.3.3 is likely the response to either the CIA Vault7 Wikileaks stash or the ShadowBrokers NSA EquationGroup stash. These exploits are probably out there in the hands of many people, and Apple had to respond.
  - WalterGR 9y ago
    That Microsoft link lists 6 CVEs. Apple's security content page lists 48. That's probably an unfair comparison. How many vulnerabilities have been patched for all of those leaks / stashes by Apple and Microsoft? It seems like we'd need to know those numbers in order to fairly judge whether PhantomGremlin should feel depressed or not.

p0ppe 9y ago

I'm still perplexed that Apple doesn't offer over the air updates, especially for security updates. 137 MB shouldn't be that big a deal on a normal 4G connection.

0x0 9y ago
Agreed, this is super annoying. You can install dozens of 99MB apps over 4G every day but nooo you can't have your broadpwn fix on the move. Except if you happen to have two devices with 4G, then you can wifi-hotspot-tether one to the other and vice versa for the update just fine.
spike021 9y ago
Not everybody has unlimited data plans. 4G can certainly handle 137 MB in speed, but that doesn't mean users want to use their data plan for updates.
- 0x0 9y ago
  Then at least allow it for manual update requests. Just like 99MB app installs or updates don't have a problem with 4G :)
- p0ppe 9y ago
  But that should be up to the users to decide. I'll be much happier to use up 137 MB for a critical security update than 354 MB for the latest Facebook app update (version 132.0).
  - justinv 9y ago
    FYI even though it says 324mb, App Store updates are delta updates as of iOS 6 https://developer.apple.com/library/content/qa/qa1779/_index.html https://developer.apple.com/library/content/qa/qa1779/_index...
    - tedmiston 9y ago
      Coming from 10.3.2, the 10.3.3 update was 84.4 MB for me.

ProfessorLayton 9y ago

They still haven't addressed the permanent website data bug in Safari. Go to Settings> Safari> Advanced> Website Data and try and clear it. Some websites won't delete arbitrarily, and if they do, others will stick. This happens even in private browsing.

GeneticGenesis 9y ago
Have you filed a radar bug?
- nikanj 9y ago
  In my experience, those are about as useful as telling your dog about the bug. Complaining on HN has a slight possibility someone from Apple might actually see the bug, and fix it.
  - p49k 9y ago
    I'd disagree, I've filed probably 15 in the past 7 years for obscure bugs and all of them were fixed. They don't respond and the fixes take a long time, but I'm pretty sure they are listening.
    - deleted 9y ago
      [deleted]
    - lttlrck 9y ago
      I’ve used the built in Feedback app several times and received replies asking for follow up so it’s fair to say they are listening
  - codezero 9y ago
    Not that this will instil a huge amount of confidence, but I filed a bug about a XNU kernel syscal that returned the wrong error code. They shipped a fix two years later and closer the ticket. I provided a diff fixing the bug but ¯\_(ツ)_/¯

CodeWriter23 9y ago

Anyone know if the WiFi exploit opened the door to arbitrary code execution on the main CPU?

inertial 9y ago
If you are referring to broadpwn aka CVE-2017-9417 [1], it has been fixed (last item in [2]). [1] https://news.ycombinator.com/item?id=14727400 https://news.ycombinator.com/item?id=14727400 [2] https://support.apple.com/en-us/HT207923 https://support.apple.com/en-us/HT207923 Summary : Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip Description: A memory corruption issue was addressed with improved memory handling.
- CodeWriter23 9y ago
  This is what I'm interested in, and I saw that Apple fixed the exploit enabling attackers to own the WiFi chip. What I want to know, does owning the WiFi chip on machines not having the patch provide a beachhead to exploiting the iOS kernel. And if so, are there known active exploits at that level?
- stock_toaster 9y ago
  Wasn't there another remote buffer overrun vuln in broadcom's wi-fi chips reported back in april too? yikes... EDIT: found it[1] [1]: https://www.theregister.co.uk/2017/04/05/broadcom_wifi_chip_bugs/ https://www.theregister.co.uk/2017/04/05/broadcom_wifi_chip_...

deleted 9y ago

[deleted]

tarikozket 9y ago

So pretty much anyone was able to execute anything on our phone remotely. Lol.

Tanegashima 9y ago
No, it’s not like android or windows.
Piccollo 9y ago
Haven't heard of anything public though