29 ms·

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security ad

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.

bangonkeyboard 9y ago
If you urgently want Apple to fix something, you do not file quiet bug reports. Apple only responds reliably to PR storms. This vulnerability is ridiculous, unacceptable, and braindead to execute.
- Scoundreller 9y ago
  We need to come up with a witty name to get it fixed faster.
  - bhhaskin 9y ago
    AppleGate
  - neverartful 9y ago
    i0wned
  - maephisto 9y ago
    iRoot. uRoot. Everybody Root.
  - deleted 9y ago
    [deleted]
  - plttn 9y ago
    My current favorite is I am Root.
    - Rexxar 9y ago
      iAmroot to respect the brand policy.
- saagarjha 9y ago
  You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.
  - patcheudor 9y ago
    This happens quite often. Report a bug to Apple through CERT as an example and they run with a well known 45 day disclosure timeline. For researchers who don't want to get into vendor conflicts this is a good path because CERT ultimately holds the decision.
- patcheudor 9y ago
  > Apple only responds reliably to PR storms They've been quick (within 45 days) to patch every major bug I've reported to them and where the bugs were cross platform, impacting Windows, Android, etc., they've consistently been amongst the quickest to issue a patch so I'm not sure how you qualify that statement.
  - bangonkeyboard 9y ago
    I qualified it with "reliably". Major bugs reported by you, a security researcher, may be bucketed differently than those deemed less serious or filed by others. As a recent example, a minor bug like the iOS 11 calculator ignoring keypresses had reports filed since Beta 1, but only after it made headlines and caused Apple public embarrassment will it be addressed in the upcoming 11.2, six months later.
    - briandear 9y ago
      A calculator bug is hardly in the same ballpark.
      - MikusR 9y ago
        It's worse. It shows nobody at Apple even tried to use app they are shipping.
  - tytso 9y ago
    Sorry. 45 days is not quick.
teamhappy 9y ago
You can't expect everybody who uses a computer to be aware of that.
dsp1234 9y ago
think of the impact to shared iMacs on university campuses. I'm sure Apple will in the future.
khana 9y ago
the only thing not-cool is this egregious short-coming from Apl
sillysaurus3 9y ago
It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.
- e40 9y ago
  The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
  - teamhappy 9y ago
    Your analogy makes no sense. He's just as vulnerable as you are.
  - interfixus 9y ago
    If you leave keys in other people's doors all over the neighbourhood, I damn well have a rigtht, and possibly an obligation, to make it publicly known that such a thing is taking place. So that everyone may take their own precautions.
    - godelski 9y ago
      Let's say keys were hidden around the neighborhood. Would you rather everyone in the whole town know about it or quietly and quickly go pick up all the keys before someone notices and breaks into one of the houses? Personally I think if you report through the proper channels and nothing is changed THEN broadcast, but not as an opener.
      - trumpownsyou420 9y ago
        holy shit, you people are fucking lame.
      - grigjd3 9y ago
fixermark 9y ago
Is it likely it's just an error due to the discoverer not being immersed in the Infosec space? "Don't disclose a 0-day publicly" is good 'common' sense, but only among the 'common' of people who are steeped in security issues and the ramifications of publicizing them.
- mikeash 9y ago
  Indeed, discovering this bug wouldn't take any security skill (I imagine it could be harmful since you might skip really dumb stuff like this) and could easily happen by accident. Responsible disclosure is standard for security researchers but I don't think this person was one, and it's not very fair to blame him for not doing it right.
- lawnchair_larry 9y ago
  That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.
  - Veen 9y ago
    Project Zero does full disclosure 90 days after informing the relevant organization. Full disclosure comes after there has been a chance to fix the problem. Otherwise everyone is put at risk until a fix is available.
  - mwfunk 9y ago
    Google Project Zero does not support full public disclosure immediately- quite the opposite. They support full public disclosure after giving the vendor an opportunity to ship a fix to their customers in a reasonable period of time. Nobody's debating whether or not security flaws should be publicly disclosed- of course they should. The only debate is, what is the most responsible way to handle such a security issue such that it harms the fewest users. Project Zero (and infosec professionals, at least all of the ones I've ever worked with) would tell you that this was the most irresponsible way to handle the issue, short of not saying anything and selling knowledge of the exploit to someone other than the vendor who could fix it. Publicizing something like this in this way is something people do because they want publicity for themselves. It is not something someone does if their biggest concern is for the users who might be affected by it. It is something someone would do if they didn't care about the users, and just wanted public credit for pointing it out.
mirekrusin 9y ago
There must be some kind of scale 1-10 of how serious the issue is. This one goes up to 11 as hilarious, not sure if proper reporting ethics apply here anymore.
LeoPanthera 9y ago
It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.
- notanai 9y ago
  "It only works after getting physical access once" - quote form somewhere else in the thread
  - thomastjeffery 9y ago
    ...or if you enabled root for some reason, but didn't set a password.
- macNchz 9y ago
  The 'sign in as root with no password' method cannot be used to trigger the vulnerability initially via remote desktop. I tested it via SSH, File Sharing, Screen Sharing and Remote Management. None of these will enable the root user if it has not already been done locally. Once the root user has been enabled locally, the only sharing settings I found to permit anyone remote access with the root/null combo is Remote Management.
  - hunter2_ 9y ago
    I don't think they meant using this vulnerability to enable a root remote connection, but using an existing non-root remote connection (think TeamViewer, VNC, whatever) and escalating.
kristofferR 9y ago
I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's hope Apple gets sued for the damage they'll cause by including this bug in High Sierra so they make sure that next release of macOS won't be another bug filled mess. [1] https://arstechnica.com/information-technology/2017/09/password-theft-0day-imperils-users-of-high-sierra-and-earlier-macos-versions/ https://arstechnica.com/information-technology/2017/09/passw... [2] https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/ https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...
- sounds 9y ago
  I agree. https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... Blame the DMCA. This guy is in Turkey - does GP really think he can expect fair treatment and equal compensation as a "western world" security researcher?
  - vatueil 9y ago
    There's no reason why the person who discovered the bug would be safer publishing the vulnerability on Twitter than disclosing it to Apple directly. If nothing else, they could always post it on Twitter later. The link to the DMCA is a digression.
  - gnulinux 9y ago
    How does him being from Turkey matter in this case?
- openasocket 9y ago
  You could let them know about the vulnerability and wait until it's been patched before commenting, with some timeout where if they don't patch in a reasonable amount of time you announce it anyway.
alexwebb2 9y ago
Does anybody have any info on how much Apple would've been likely to pay for a responsible disclosure in this case, given the scope and severity of the issue? I'm just curious how much of a payday this guy missed out on by not disclosing responsibly.
- pault 9y ago
  That was my first thought. Based on some bounty reports I've seen recently I would assume at least high five figures.
  - alexwebb2 9y ago
    Ouch. This guy's going to kick himself pretty hard. The 15 minutes of infamy seems like a pretty bad tradeoff.
    - sounds 9y ago
      Do you honestly believe Apple will pay out the same to someone located in Turkey?
      - alexwebb2 9y ago
        I wouldn't think they'd care about the geography of it - a good tip is a good tip, and they want to encourage responsible disclosure.
        thanatropism 9y ago
        Do they release statistics on bug bounty payouts?
        FireBeyond 9y ago
        They barely acknowledge bugs being submitted to Radar...
  - 9y ago
zerostar07 9y ago
People are already fixing their machines because he tweeted. this is too much of a huge blunder to wait for the official channels.
- jrochkind1 9y ago
  they are? Where's the fix?
  - Veen 9y ago
    Create a root password.
    - saagarjha 9y ago
      This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.
      - will4274 9y ago
        Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :) But seriously, a fix is whatever fixes the problem.
        saagarjha 9y ago
        It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.
        reitanqild 9y ago
        Shouldn't matter as long as the password is strong?
zeveb 9y ago
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses. It gets the word out quickly. Releasing proprietary software with such a hilariously insecure authentication system isn't cool. This isn't free software, produced by people & corporations out of the goodness of their hearts; rather, it's something for which people pay a good deal of money and which they have a right to expect is at least somewhat secure. Getting the word out, fast that a) there's a huge insecurity and b) it's in Apple software provides benefits to those running macOS (so they can fix their systems) and to those considering running macOS (so they can evaluate whether an alternative is more appropriate).
dhimes 9y ago
Is this address easily discoverable without needing too much insight into tech company workings? Like, do they have a help menu that tells people where to report stuff? I'm not an apple user.
- hunter2_ 9y ago
  https://www.google.com/search?q=apple+report+security+bug https://www.google.com/search?q=apple+report+security+bug does bring https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220 right up, but that page documents "how security researchers, developers, law enforcement personnel, and journalists can contact Apple to report or ask about a security issue" -- notably absent from that set is "your average Joe who stumbled upon something entirely by accident" for some reason.
oneeyedpigeon 9y ago
Let's wait until Apple release their patch so we know just how long they left everyone's machines vulnerable for. That will be a factor in determining whether this disclosure was irresponsible or not. It's been two and a half hours so far.
- heartbreak 9y ago
  If Apple released a patch in less than 24 hours I’d be seriously concerned about the QA that had gone into the patch.
  - oneeyedpigeon 9y ago
    I guess you’re seriously concerned now ;)
    - heartbreak 9y ago
      I guess so. I hope they QA’ed it better than they did the previous version...
      - heartbreak 9y ago
        Apparently they broke an aspect of network file sharing with this quick-turnaround patch. Whoops.
0care 9y ago
I disagree. Being unaware of the flaw doesn't make you more secure.
- azernik 9y ago
  Attackers being unaware of the flaw does.
williamscales 9y ago
This situation is much more akin to a fire rapidly spreading through a village at night. I would go outside and start hollering in the hopes of saving anyone.
- saagarjha 9y ago
  A better analogy is that there's a fire somewhere in your village, but it's mostly contained (it's not spreading, because other people don't know about it yet). By hollering about it, you've made it possible for anyone to go to the fire, light a torch with it, and burn down the village. Instead, you could call up the fire department and they could put it out–and then you could tell everyone about it.
  - 5ilv3r 9y ago
    You are comparing an arsonist to a fire department.
    - saagarjha 9y ago
      Uhh, no. How are you getting that impression? I'm simply saying that arsonists exist, and it's probably a good idea to make it harder for them to burn things down than to publicly advertise a way for them to do it.
      - 5ilv3r 9y ago
        Do you live in some horrible place where your neighbors will throw gas on your burning house unless you can quickly and quietly get the fire department there first, to put out the fire that the FIRE DEPARTMENT started? Dude. That was your example.
        saagarjha 9y ago
        It's an analogy (and it's not mine, mind you; I simply tried to make it more accurate)–don't take it too literally. Hacking is a thing that exists. By reporting this publicly it's become a lot easier to hack people.
ig1 9y ago
Responsible disclosure is pretty much a security industry concept, it's not something that most developers know about, complaining on Twitter is probably what an average person would do. Although for what it's worth last time I reported a security vuln to Apple using their official process they took around 2 years to fix it (admittedly low priority security vuln, passwords being sent over http).
- ben_w 9y ago
  > admittedly low priority security vuln, passwords being sent over http Wait, what?
  - ig1 9y ago
    Unfortunately it's still more common than you think. The other day I actually ran across some AWS docs which suggest you send your AWS root key id in the url of http requests: http://docs.aws.amazon.com/AlexaWebInfoService/latest/index.html?QUERY_QueryRequests.html http://docs.aws.amazon.com/AlexaWebInfoService/latest/index....
    - dsmithatx 9y ago
      Wow I didn't believe this at first, so I dug more. AWIS requires the root key of an AWS account. I found a forum that does suggest creating a new account solely for AWIS. https://forums.aws.amazon.com/thread.jspa?threadID=126537 https://forums.aws.amazon.com/thread.jspa?threadID=126537 Still I'm surprised they would suggest sending the root key to your account over http. Even if it is just the id and not secret it still seems like something you want to keep secure. I don't use my root key for services. I create new accounts and IAM roles.
- COMMENT___ 9y ago
  > complaining on Twitter is probably what an average person would do. His twitter account tells that he is an agile software craftsman, turkey founder and a community guy. And he tweets about devops, open source and other stuff. An average person disguised as a software developer?
pwdisswordfish2 9y ago
"Disclosing a 0Day... isn't cool,..." But it is not nearly as uncool as releasing software to millions of paying customers containing a 0Day. Who knows how many people already knew about this and other 0Days and have said nothing? The carelessness in releasing software with 0Days is especially unforgivable when the company has more cash on hand to pay employees than any company in history. What is their excuse? Apple can afford the very best. Their customers pay the most. But the software they release, no matter what their user may want to imagine, is most certainly not the very best. It is not even as good as open source BSD from which OSX is derived, maintained by unpaid volunteers, which does not allow remote logins as root without a password.
yumraj 9y ago
I agree in general, but calling it uncool and laying any blame on the person reporting is not fair. You may know the protocol, security researchers and people in the tech industry may know that, but why is an ordinary Joe expected to know, or research, that email address and/or the protocol regarding 0-day vulnerabilities.
- joemi 9y ago
  I'd argue that even to the ordinary Joe it should be quite logical that disclosing something publicly before the company has had a chance to fix it means that nefarious people could learn about the exploit and use it against victims. It's the same logical line of thought that leads people into turning wallets into the lost and found (or an authority) instead of just pointing at it on the ground shouting "hey look, a wallet!" then walking away.
na85 9y ago
This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only way Apple gets motivated to fix either of those two things is massive Pr damage.
- azernik 9y ago
  How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time. Human fallibility, yo.
  - ridgeguy 9y ago
    Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important. But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?
    - azernik 9y ago
      This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.
      - ridgeguy 9y ago
        Thanks, appreciate your reply. Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.
albertTJames 9y ago
Yeah, the guy is an attention whore, he just wants to buzz. There is no justification for releasing a 0day publicly.
- thomastjeffery 9y ago
  There is a simple workaround. Publicity means security here. It's trivial to find. He can't presume he is the only one who found it. Telling any individual that doesn't have malicious intent is a good thing, therefore telling everyone is a good thing.
deleted 9y ago
[deleted]
bugbountyhunter 9y ago
> there are any number of legit bug bounty programs The thing about bug bounty programs are that they are not a negotiation. They decide how much your information is worth--take it or leave it. If you thought this bug was worth $25,000 and you feared that Apple might offer a $100 discount coupon plus a lovely "I Love My Mac" coffee mug, is there any way to start a negotiation without being accused of extortion (if you imply that you might disclose it publicly)? This is a serious question: Is there any way to negotiate for security bugs, before or after disclosing all the details, without running a legal risk?
- azernik 9y ago
  Not really; the issue is that you don't have a way to disclose how much the bug is worth without giving away the bug itself. You can kind of ask how much an exploit that gets a local user root access is worth, but that can give away enough to let them focus their own search. In general, you have to rely on this being a repeated game - you and the pentester community at large submit lots of bugs to this company, and you rely on them to make it worth your time and talent. If they don't, you go test someone else's software. Reputation is everything.
saas_co_de 9y ago
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool no one is under any obligation to sweep company's security problems under the rug for them. If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs. Don't ship broken software if you don't want pie in your face.
- azernik 9y ago
  Forget the company. This harms users, who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
  - flukus 9y ago
    If it harms the company then they will take it more seriously and it will protect users more in future. If it doesn't harm the company then they have no incentive to change.
- rched 9y ago
  This isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.
  - saas_co_de 9y ago
    In almost all cases immediate disclosure is better for end users who actually care about their security because they can take appropriate mitigation measures. Just because the vulnerability is not disclosed does not mean it is not being actively exploited. It probably is. Users who don't care about their security do not deserve to be "protected" at the expense of compromising the security of those who do care who benefit from immediate disclosure.
romwell 9y ago
Because clearly, the random Apple user that stumbled upon it should both be aware of and follow the protocols of security researchers.
dustinmoris 9y ago
There is no "responsible disclosure". You will never get 7 billion humans to do things exactly the way you want it, so if there is a possibility of at least 1 person disclosing a zero day publicly, then you have to be prepared for it just as much as if it was everyone. Instead of trying to control behaviour of every single human being in this world and demanding of them to do things in a certain way - which is, was and will always be impossible it is much more favourable to establish the expectation that a zero day vulnerability might be dropped every week and have businesses (vendors and clients) be prepared for it so it can be handled adequately.
djsumdog 9y ago
Security experts and hobbiests know this, but not your average user. This doesn't look like an in-depth bug hunt. Maybe more average users should be educated about responsible disclosures when finding security problems. This tweeter might not realize they gave up some money.
chj 9y ago
In this particular case, I am grateful for the early disclosure that I can fix it right now instead of waiting. For a huge bomb like this, I think you really can't blame the messenger.
qiqitori 9y ago
Since it isn't exactly easy to send emails securely, I think this piece of advice may need some more work. The PGP key is available here: https://support.apple.com/en-us/HT201214 https://support.apple.com/en-us/HT201214 I wonder what percentage of emails to security@... (apple.com or otherwise) are sent encrypted...
jodrellblank 9y ago
Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses. How dare you publicly shame him and risk his future employability like this? It's only responsible of you to contact him quietly and directly so he can correct his mistake and cover it up so nobody needs to know. It's like there's one rule for the negligent global corporation which happens to work in the corporation's favor and shames the public for speaking to each other about their salary, I mean flaws in their software, and another rule for ordinary people giving a heads up to people who are fair game to pile on.
deleted 9y ago
[deleted]
thedarkproject 9y ago
Security by Obscurity never works. Source: Information Security 101

bangonkeyboard 9y ago

If you urgently want Apple to fix something, you do not file quiet bug reports. Apple only responds reliably to PR storms. This vulnerability is ridiculous, unacceptable, and braindead to execute.

Scoundreller 9y ago
We need to come up with a witty name to get it fixed faster.
- bhhaskin 9y ago
  AppleGate
- neverartful 9y ago
  i0wned
- maephisto 9y ago
  iRoot. uRoot. Everybody Root.
- deleted 9y ago
  [deleted]
- plttn 9y ago
  My current favorite is I am Root.
  - Rexxar 9y ago
    iAmroot to respect the brand policy.
saagarjha 9y ago
You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.
- patcheudor 9y ago
  This happens quite often. Report a bug to Apple through CERT as an example and they run with a well known 45 day disclosure timeline. For researchers who don't want to get into vendor conflicts this is a good path because CERT ultimately holds the decision.
patcheudor 9y ago
> Apple only responds reliably to PR storms They've been quick (within 45 days) to patch every major bug I've reported to them and where the bugs were cross platform, impacting Windows, Android, etc., they've consistently been amongst the quickest to issue a patch so I'm not sure how you qualify that statement.
- bangonkeyboard 9y ago
  I qualified it with "reliably". Major bugs reported by you, a security researcher, may be bucketed differently than those deemed less serious or filed by others. As a recent example, a minor bug like the iOS 11 calculator ignoring keypresses had reports filed since Beta 1, but only after it made headlines and caused Apple public embarrassment will it be addressed in the upcoming 11.2, six months later.
  - briandear 9y ago
    A calculator bug is hardly in the same ballpark.
    - MikusR 9y ago
      It's worse. It shows nobody at Apple even tried to use app they are shipping.
- tytso 9y ago
  Sorry. 45 days is not quick.

teamhappy 9y ago

You can't expect everybody who uses a computer to be aware of that.

dsp1234 9y ago

think of the impact to shared iMacs on university campuses. I'm sure Apple will in the future.

khana 9y ago

the only thing not-cool is this egregious short-coming from Apl

sillysaurus3 9y ago

It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.

e40 9y ago
The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
- teamhappy 9y ago
  Your analogy makes no sense. He's just as vulnerable as you are.
- interfixus 9y ago
  If you leave keys in other people's doors all over the neighbourhood, I damn well have a rigtht, and possibly an obligation, to make it publicly known that such a thing is taking place. So that everyone may take their own precautions.
  - godelski 9y ago
    Let's say keys were hidden around the neighborhood. Would you rather everyone in the whole town know about it or quietly and quickly go pick up all the keys before someone notices and breaks into one of the houses? Personally I think if you report through the proper channels and nothing is changed THEN broadcast, but not as an opener.
    - trumpownsyou420 9y ago
      holy shit, you people are fucking lame.
    - grigjd3 9y ago

fixermark 9y ago

Is it likely it's just an error due to the discoverer not being immersed in the Infosec space? "Don't disclose a 0-day publicly" is good 'common' sense, but only among the 'common' of people who are steeped in security issues and the ramifications of publicizing them.

mikeash 9y ago
Indeed, discovering this bug wouldn't take any security skill (I imagine it could be harmful since you might skip really dumb stuff like this) and could easily happen by accident. Responsible disclosure is standard for security researchers but I don't think this person was one, and it's not very fair to blame him for not doing it right.
lawnchair_larry 9y ago
That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.
- Veen 9y ago
  Project Zero does full disclosure 90 days after informing the relevant organization. Full disclosure comes after there has been a chance to fix the problem. Otherwise everyone is put at risk until a fix is available.
- mwfunk 9y ago
  Google Project Zero does not support full public disclosure immediately- quite the opposite. They support full public disclosure after giving the vendor an opportunity to ship a fix to their customers in a reasonable period of time. Nobody's debating whether or not security flaws should be publicly disclosed- of course they should. The only debate is, what is the most responsible way to handle such a security issue such that it harms the fewest users. Project Zero (and infosec professionals, at least all of the ones I've ever worked with) would tell you that this was the most irresponsible way to handle the issue, short of not saying anything and selling knowledge of the exploit to someone other than the vendor who could fix it. Publicizing something like this in this way is something people do because they want publicity for themselves. It is not something someone does if their biggest concern is for the users who might be affected by it. It is something someone would do if they didn't care about the users, and just wanted public credit for pointing it out.

mirekrusin 9y ago

There must be some kind of scale 1-10 of how serious the issue is. This one goes up to 11 as hilarious, not sure if proper reporting ethics apply here anymore.

LeoPanthera 9y ago

It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.

notanai 9y ago
"It only works after getting physical access once" - quote form somewhere else in the thread
- thomastjeffery 9y ago
  ...or if you enabled root for some reason, but didn't set a password.
macNchz 9y ago
The 'sign in as root with no password' method cannot be used to trigger the vulnerability initially via remote desktop. I tested it via SSH, File Sharing, Screen Sharing and Remote Management. None of these will enable the root user if it has not already been done locally. Once the root user has been enabled locally, the only sharing settings I found to permit anyone remote access with the root/null combo is Remote Management.
- hunter2_ 9y ago
  I don't think they meant using this vulnerability to enable a root remote connection, but using an existing non-root remote connection (think TeamViewer, VNC, whatever) and escalating.

kristofferR 9y ago

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's hope Apple gets sued for the damage they'll cause by including this bug in High Sierra so they make sure that next release of macOS won't be another bug filled mess. [1] https://arstechnica.com/information-technology/2017/09/password-theft-0day-imperils-users-of-high-sierra-and-earlier-macos-versions/ https://arstechnica.com/information-technology/2017/09/passw... [2] https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/ https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...

sounds 9y ago
I agree. https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... Blame the DMCA. This guy is in Turkey - does GP really think he can expect fair treatment and equal compensation as a "western world" security researcher?
- vatueil 9y ago
  There's no reason why the person who discovered the bug would be safer publishing the vulnerability on Twitter than disclosing it to Apple directly. If nothing else, they could always post it on Twitter later. The link to the DMCA is a digression.
- gnulinux 9y ago
  How does him being from Turkey matter in this case?
openasocket 9y ago
You could let them know about the vulnerability and wait until it's been patched before commenting, with some timeout where if they don't patch in a reasonable amount of time you announce it anyway.

alexwebb2 9y ago

Does anybody have any info on how much Apple would've been likely to pay for a responsible disclosure in this case, given the scope and severity of the issue? I'm just curious how much of a payday this guy missed out on by not disclosing responsibly.

pault 9y ago
That was my first thought. Based on some bounty reports I've seen recently I would assume at least high five figures.
- alexwebb2 9y ago
  Ouch. This guy's going to kick himself pretty hard. The 15 minutes of infamy seems like a pretty bad tradeoff.
  - sounds 9y ago
    Do you honestly believe Apple will pay out the same to someone located in Turkey?
    - alexwebb2 9y ago
      I wouldn't think they'd care about the geography of it - a good tip is a good tip, and they want to encourage responsible disclosure.
      - thanatropism 9y ago
        Do they release statistics on bug bounty payouts?
        FireBeyond 9y ago
        They barely acknowledge bugs being submitted to Radar...
- 9y ago

zerostar07 9y ago

People are already fixing their machines because he tweeted. this is too much of a huge blunder to wait for the official channels.

jrochkind1 9y ago
they are? Where's the fix?
- Veen 9y ago
  Create a root password.
  - saagarjha 9y ago
    This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.
    - will4274 9y ago
      Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :) But seriously, a fix is whatever fixes the problem.
      - saagarjha 9y ago
        It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.
        reitanqild 9y ago
        Shouldn't matter as long as the password is strong?

zeveb 9y ago

> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses. It gets the word out quickly. Releasing proprietary software with such a hilariously insecure authentication system isn't cool. This isn't free software, produced by people & corporations out of the goodness of their hearts; rather, it's something for which people pay a good deal of money and which they have a right to expect is at least somewhat secure. Getting the word out, fast that a) there's a huge insecurity and b) it's in Apple software provides benefits to those running macOS (so they can fix their systems) and to those considering running macOS (so they can evaluate whether an alternative is more appropriate).

dhimes 9y ago

Is this address easily discoverable without needing too much insight into tech company workings? Like, do they have a help menu that tells people where to report stuff? I'm not an apple user.

hunter2_ 9y ago
https://www.google.com/search?q=apple+report+security+bug https://www.google.com/search?q=apple+report+security+bug does bring https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220 right up, but that page documents "how security researchers, developers, law enforcement personnel, and journalists can contact Apple to report or ask about a security issue" -- notably absent from that set is "your average Joe who stumbled upon something entirely by accident" for some reason.

oneeyedpigeon 9y ago

Let's wait until Apple release their patch so we know just how long they left everyone's machines vulnerable for. That will be a factor in determining whether this disclosure was irresponsible or not. It's been two and a half hours so far.

heartbreak 9y ago
If Apple released a patch in less than 24 hours I’d be seriously concerned about the QA that had gone into the patch.
- oneeyedpigeon 9y ago
  I guess you’re seriously concerned now ;)
  - heartbreak 9y ago
    I guess so. I hope they QA’ed it better than they did the previous version...
    - heartbreak 9y ago
      Apparently they broke an aspect of network file sharing with this quick-turnaround patch. Whoops.

0care 9y ago

I disagree. Being unaware of the flaw doesn't make you more secure.

azernik 9y ago
Attackers being unaware of the flaw does.

williamscales 9y ago

This situation is much more akin to a fire rapidly spreading through a village at night. I would go outside and start hollering in the hopes of saving anyone.

saagarjha 9y ago
A better analogy is that there's a fire somewhere in your village, but it's mostly contained (it's not spreading, because other people don't know about it yet). By hollering about it, you've made it possible for anyone to go to the fire, light a torch with it, and burn down the village. Instead, you could call up the fire department and they could put it out–and then you could tell everyone about it.
- 5ilv3r 9y ago
  You are comparing an arsonist to a fire department.
  - saagarjha 9y ago
    Uhh, no. How are you getting that impression? I'm simply saying that arsonists exist, and it's probably a good idea to make it harder for them to burn things down than to publicly advertise a way for them to do it.
    - 5ilv3r 9y ago
      Do you live in some horrible place where your neighbors will throw gas on your burning house unless you can quickly and quietly get the fire department there first, to put out the fire that the FIRE DEPARTMENT started? Dude. That was your example.
      - saagarjha 9y ago
        It's an analogy (and it's not mine, mind you; I simply tried to make it more accurate)–don't take it too literally. Hacking is a thing that exists. By reporting this publicly it's become a lot easier to hack people.

ig1 9y ago

Responsible disclosure is pretty much a security industry concept, it's not something that most developers know about, complaining on Twitter is probably what an average person would do. Although for what it's worth last time I reported a security vuln to Apple using their official process they took around 2 years to fix it (admittedly low priority security vuln, passwords being sent over http).

ben_w 9y ago
> admittedly low priority security vuln, passwords being sent over http Wait, what?
- ig1 9y ago
  Unfortunately it's still more common than you think. The other day I actually ran across some AWS docs which suggest you send your AWS root key id in the url of http requests: http://docs.aws.amazon.com/AlexaWebInfoService/latest/index.html?QUERY_QueryRequests.html http://docs.aws.amazon.com/AlexaWebInfoService/latest/index....
  - dsmithatx 9y ago
    Wow I didn't believe this at first, so I dug more. AWIS requires the root key of an AWS account. I found a forum that does suggest creating a new account solely for AWIS. https://forums.aws.amazon.com/thread.jspa?threadID=126537 https://forums.aws.amazon.com/thread.jspa?threadID=126537 Still I'm surprised they would suggest sending the root key to your account over http. Even if it is just the id and not secret it still seems like something you want to keep secure. I don't use my root key for services. I create new accounts and IAM roles.
COMMENT___ 9y ago
> complaining on Twitter is probably what an average person would do. His twitter account tells that he is an agile software craftsman, turkey founder and a community guy. And he tweets about devops, open source and other stuff. An average person disguised as a software developer?

pwdisswordfish2 9y ago

"Disclosing a 0Day... isn't cool,..." But it is not nearly as uncool as releasing software to millions of paying customers containing a 0Day. Who knows how many people already knew about this and other 0Days and have said nothing? The carelessness in releasing software with 0Days is especially unforgivable when the company has more cash on hand to pay employees than any company in history. What is their excuse? Apple can afford the very best. Their customers pay the most. But the software they release, no matter what their user may want to imagine, is most certainly not the very best. It is not even as good as open source BSD from which OSX is derived, maintained by unpaid volunteers, which does not allow remote logins as root without a password.

yumraj 9y ago

I agree in general, but calling it uncool and laying any blame on the person reporting is not fair. You may know the protocol, security researchers and people in the tech industry may know that, but why is an ordinary Joe expected to know, or research, that email address and/or the protocol regarding 0-day vulnerabilities.

joemi 9y ago
I'd argue that even to the ordinary Joe it should be quite logical that disclosing something publicly before the company has had a chance to fix it means that nefarious people could learn about the exploit and use it against victims. It's the same logical line of thought that leads people into turning wallets into the lost and found (or an authority) instead of just pointing at it on the ground shouting "hey look, a wallet!" then walking away.

na85 9y ago

This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only way Apple gets motivated to fix either of those two things is massive Pr damage.

azernik 9y ago
How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time. Human fallibility, yo.
- ridgeguy 9y ago
  Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important. But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?
  - azernik 9y ago
    This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.
    - ridgeguy 9y ago
      Thanks, appreciate your reply. Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.

albertTJames 9y ago

Yeah, the guy is an attention whore, he just wants to buzz. There is no justification for releasing a 0day publicly.

thomastjeffery 9y ago
There is a simple workaround. Publicity means security here. It's trivial to find. He can't presume he is the only one who found it. Telling any individual that doesn't have malicious intent is a good thing, therefore telling everyone is a good thing.

deleted 9y ago

[deleted]

bugbountyhunter 9y ago

> there are any number of legit bug bounty programs The thing about bug bounty programs are that they are not a negotiation. They decide how much your information is worth--take it or leave it. If you thought this bug was worth $25,000 and you feared that Apple might offer a $100 discount coupon plus a lovely "I Love My Mac" coffee mug, is there any way to start a negotiation without being accused of extortion (if you imply that you might disclose it publicly)? This is a serious question: Is there any way to negotiate for security bugs, before or after disclosing all the details, without running a legal risk?

azernik 9y ago
Not really; the issue is that you don't have a way to disclose how much the bug is worth without giving away the bug itself. You can kind of ask how much an exploit that gets a local user root access is worth, but that can give away enough to let them focus their own search. In general, you have to rely on this being a repeated game - you and the pentester community at large submit lots of bugs to this company, and you rely on them to make it worth your time and talent. If they don't, you go test someone else's software. Reputation is everything.

saas_co_de 9y ago

> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool no one is under any obligation to sweep company's security problems under the rug for them. If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs. Don't ship broken software if you don't want pie in your face.

azernik 9y ago
Forget the company. This harms users, who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
- flukus 9y ago
  If it harms the company then they will take it more seriously and it will protect users more in future. If it doesn't harm the company then they have no incentive to change.
rched 9y ago
This isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.
- saas_co_de 9y ago
  In almost all cases immediate disclosure is better for end users who actually care about their security because they can take appropriate mitigation measures. Just because the vulnerability is not disclosed does not mean it is not being actively exploited. It probably is. Users who don't care about their security do not deserve to be "protected" at the expense of compromising the security of those who do care who benefit from immediate disclosure.

romwell 9y ago

Because clearly, the random Apple user that stumbled upon it should both be aware of and follow the protocols of security researchers.

dustinmoris 9y ago

There is no "responsible disclosure". You will never get 7 billion humans to do things exactly the way you want it, so if there is a possibility of at least 1 person disclosing a zero day publicly, then you have to be prepared for it just as much as if it was everyone. Instead of trying to control behaviour of every single human being in this world and demanding of them to do things in a certain way - which is, was and will always be impossible it is much more favourable to establish the expectation that a zero day vulnerability might be dropped every week and have businesses (vendors and clients) be prepared for it so it can be handled adequately.

djsumdog 9y ago

Security experts and hobbiests know this, but not your average user. This doesn't look like an in-depth bug hunt. Maybe more average users should be educated about responsible disclosures when finding security problems. This tweeter might not realize they gave up some money.

chj 9y ago

In this particular case, I am grateful for the early disclosure that I can fix it right now instead of waiting. For a huge bomb like this, I think you really can't blame the messenger.

qiqitori 9y ago

Since it isn't exactly easy to send emails securely, I think this piece of advice may need some more work. The PGP key is available here: https://support.apple.com/en-us/HT201214 https://support.apple.com/en-us/HT201214 I wonder what percentage of emails to security@... (apple.com or otherwise) are sent encrypted...

jodrellblank 9y ago

Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses. How dare you publicly shame him and risk his future employability like this? It's only responsible of you to contact him quietly and directly so he can correct his mistake and cover it up so nobody needs to know. It's like there's one rule for the negligent global corporation which happens to work in the corporation's favor and shames the public for speaking to each other about their salary, I mean flaws in their software, and another rule for ordinary people giving a heads up to people who are fair game to pile on.

deleted 9y ago

[deleted]

thedarkproject 9y ago

Security by Obscurity never works. Source: Information Security 101