9 ms·

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's hope Apple gets sued for the damage they'll cause by including this bug in High Sierra so they make sure that next release of macOS won't be another bug filled mess. [1] https://arstechnica.com/information-technology/2017/09/password-theft-0day-imperils-users-of-high-sierra-and-earlier-macos-versions/ https://arstechnica.com/information-technology/2017/09/passw... [2] https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/ https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...

sounds 9y ago
I agree. https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... Blame the DMCA. This guy is in Turkey - does GP really think he can expect fair treatment and equal compensation as a "western world" security researcher?
- vatueil 9y ago
  There's no reason why the person who discovered the bug would be safer publishing the vulnerability on Twitter than disclosing it to Apple directly. If nothing else, they could always post it on Twitter later. The link to the DMCA is a digression.
- gnulinux 9y ago
  How does him being from Turkey matter in this case?
openasocket 9y ago
You could let them know about the vulnerability and wait until it's been patched before commenting, with some timeout where if they don't patch in a reasonable amount of time you announce it anyway.
CGamesPlay 9y ago
Don't forget the Disk Utility password disclosure! https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/ https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...
- kristofferR 9y ago
  Thanks, added!
bradrydzewski 9y ago
Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the process.
- camus2 9y ago
  And Full disclosure is about protecting users of a software, not letting the vendor off the hook. Here, the hack and the fix are so trivial the responsible thing to do is to publicly call out Apple for its lack of QA and warn users directly. It affects everybody who runs High Sierra. > it puts millions of Apple customers at risk in the process. Nah, it's Apple which put millions of customers at risk, not the person who disclosed the vulnerability. let's not shift away the blame from the guilty here. Apple one of the richest company in the world is obviously just cutting corners in QA here. This is unacceptable. it's seems some people here are more concerned about negative publicity than user security. This is a pattern that have been seen countless times in big tech corporations(such as Yahoo), not disclosing hacks that put their users and their data at risk. This is unacceptable for a company that claims to be all about their users.
  - joshuaturner 9y ago
    I would argue that releasing this vulnerability as irresponsibly as he did is showing he cares more about negative publicity than user security. Yes, it's Apple's fault for poor QA that this was released, but this guy also put users at risk by telling the entire world about it without giving Apple a chance to fix it. You're right, it's about user security before publicity. So make sure users are safe first.
    - jlgaddis 9y ago
      "as irresponsibly as he did" is how all vulnerabilities were announced, at one time. I miss those days, personally. Nowadays, you're "irresponsible" if you don't follow some vendor's own made up procedures.
jackhack 9y ago
I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.
- michaelbuckbee 9y ago
  My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).
  - justadudeama 9y ago
    Does this user have admin privileges? root != admin on macOS if I recall correctly.
    - giancarlostoro 9y ago
      root IS an admin in macOS. You just cannot use root the same way you expect root to work in other Unix OS' without changing stuff in the BIOS (or whatever it's called for Apple) but you can still do most admin things with root. However root does get admin privileges, but when it comes to some system directories he is banned till you "fix" root privileges. Edit: See: https://stackoverflow.com/a/33272796 https://stackoverflow.com/a/33272796 for a bit more information of what I mean.
      - justadudeama 9y ago
        Thank you, I was wrong.
        giancarlostoro 9y ago
        It's fine, by my own definition, that isn't a true root user... It ruins everything I've come to expect from using root.
hw 9y ago
Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly. How would you feel if someone discovered a 0day at a company that exposes credit card and identity info, published the 0day, then hackers steal all that info (including yours)? I'm sure 'creating a thunderstorm of negative publicity' would be the last thing you would want.
- soneil 9y ago
  I don’t see it as either/or. You can disclose responsibly, and go for publicity once the fix is in circulation. Responsible disclosure is nothing to do with protecting Apple, it’s about protecting the users.
- flywheel 9y ago
  Far too many people think of Apple as infallible. I often think even Apple thinks of themselves as infallible. The more people that are aware of the inherent risk involved with using computers - any computer - the better.
- 5ilv3r 9y ago
  The problem is that this is not a zero day in new technology. They made a jr sysadmin mistake. As a company who wants a reputation for good security, that is not acceptable.
- bambax 9y ago
  > Is there something you don't like about them? You mean, in addition to bad QA and complete disregard for their users' security? And being the richest and most profitable company ever, cutting corners and evading taxes? Their response on Twitter was amazing: "PM us so we can discuss this privately", not "thank you, we're looking into it NOW".
  - macintux 9y ago
    I suspect the response on Twitter was a typical reply from a tier 0 support person. No reason to extrapolate from that to the company's internal response. Apple is a Rorschach test writ large. What people see in it reflects more on the observer than the company in many cases.
aquova 9y ago
I think there's a middle ground to this. Submit your report to Apple security, allow them time to develop a patch, and then in a week go ahead and tweet at the big media outlets about it. I'm a die-hard Apple user myself, but I agree that the long list of severe bugs in High Sierra is absurd, and a big public backlash might be enough to kick them into gear. On the other hand, I, a university student with next to no understanding of computer security, can simply walk onto campus, sit down at a Mac, and within seconds have complete access to the computer. It's ridiculous, it's horrendous that it shipped like this, but it's not something that needed to get out, especially something so easy to utilize.
- kristofferR 9y ago
  The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care. Us geeks have been complaining about the horrible QA in macOS for years, yet nothing has been done. The fact that this is so simple to do will probably/hopefully get ordinary people to start talking about it too ("Hey, have you heard that you can hack Macs without a password? Very insecure"), which would force Apple to improve.
  - openasocket 9y ago
    It sounds to me like you're arguing that full disclosure in this situation could lead to a worse outcome for users in the short term, but the negative publicity will force Apple to improve their security posture, leading to a better outcome for users in the long term. (Please let me know if I'm miss-characterizing your argument) I think you have to be very careful about that line of argument. It's a single vulnerability researcher making a unilateral decision about the short term and long term security of an entire user base, based entirely on personal judgement. I personally think the researcher should make the decision that best protects users from that specific vulnerability. Making long-term changes to a company's QA should come second.
    - AlexandrB 9y ago
      > I personally think the researcher should make the decision that best protects users from that specific vulnerability. I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party. Apple has a multi-hundred-billion dollar war chest and, if they wanted to, could afford to make macOS the most secure operating system on the market. The fact that they don't is their own choice and a reflection of their priorities, not some act of God or a natural disaster. Putting the onus for cleaning up the mess in the most "responsible" way possible on third parties with a fraction of Apple's resources is being too kind to Apple.
mozumder 9y ago
Zero-day disclosures aren't about negative publicity in order to prevent problems further down the road some time in the distant future. It's about protecting systems RIGHT NOW from immediately causing harm to people's lives.
bubblethink 9y ago
>Let's hope Apple gets sued for the damage How can that happen in any case ? Isn't pretty much the first line in every license waiving of liability ? Unless you have some special contract with Apple that overrides other standard boxes that you ticked, how would anyone sue ?
madeofpalk 9y ago
Do "responsbile disclosure" rules apply differently to Apple? If so, why? How do you identify companies like Apple that get one set of rules to other companies?
BinaryIdiot 9y ago
This is extremely naive. Yes Apple shouldn't be having this issue but disclosing a 0-day issue can possibly hurt users far worse than hurting Apple. Apple may lose a tiny bit of money but users could lose far, far more especially if someone develops a good way to remotely deploy / take advantage of this defect. Ignoring responsible disclosure also limits the ability to sue them for any damage resulting from it (or so I'm told by one of my lawyer friends who thinks this disclosure may make it almost impossible to successfully sue them over it unless it simply takes them too long to fix).

sounds 9y ago

I agree. https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... Blame the DMCA. This guy is in Turkey - does GP really think he can expect fair treatment and equal compensation as a "western world" security researcher?

vatueil 9y ago
There's no reason why the person who discovered the bug would be safer publishing the vulnerability on Twitter than disclosing it to Apple directly. If nothing else, they could always post it on Twitter later. The link to the DMCA is a digression.
gnulinux 9y ago
How does him being from Turkey matter in this case?

openasocket 9y ago

You could let them know about the vulnerability and wait until it's been patched before commenting, with some timeout where if they don't patch in a reasonable amount of time you announce it anyway.

CGamesPlay 9y ago

Don't forget the Disk Utility password disclosure! https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/ https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...

kristofferR 9y ago
Thanks, added!

bradrydzewski 9y ago

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the process.

camus2 9y ago
And Full disclosure is about protecting users of a software, not letting the vendor off the hook. Here, the hack and the fix are so trivial the responsible thing to do is to publicly call out Apple for its lack of QA and warn users directly. It affects everybody who runs High Sierra. > it puts millions of Apple customers at risk in the process. Nah, it's Apple which put millions of customers at risk, not the person who disclosed the vulnerability. let's not shift away the blame from the guilty here. Apple one of the richest company in the world is obviously just cutting corners in QA here. This is unacceptable. it's seems some people here are more concerned about negative publicity than user security. This is a pattern that have been seen countless times in big tech corporations(such as Yahoo), not disclosing hacks that put their users and their data at risk. This is unacceptable for a company that claims to be all about their users.
- joshuaturner 9y ago
  I would argue that releasing this vulnerability as irresponsibly as he did is showing he cares more about negative publicity than user security. Yes, it's Apple's fault for poor QA that this was released, but this guy also put users at risk by telling the entire world about it without giving Apple a chance to fix it. You're right, it's about user security before publicity. So make sure users are safe first.
  - jlgaddis 9y ago
    "as irresponsibly as he did" is how all vulnerabilities were announced, at one time. I miss those days, personally. Nowadays, you're "irresponsible" if you don't follow some vendor's own made up procedures.

jackhack 9y ago

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

michaelbuckbee 9y ago
My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).
- justadudeama 9y ago
  Does this user have admin privileges? root != admin on macOS if I recall correctly.
  - giancarlostoro 9y ago
    root IS an admin in macOS. You just cannot use root the same way you expect root to work in other Unix OS' without changing stuff in the BIOS (or whatever it's called for Apple) but you can still do most admin things with root. However root does get admin privileges, but when it comes to some system directories he is banned till you "fix" root privileges. Edit: See: https://stackoverflow.com/a/33272796 https://stackoverflow.com/a/33272796 for a bit more information of what I mean.
    - justadudeama 9y ago
      Thank you, I was wrong.
      - giancarlostoro 9y ago
        It's fine, by my own definition, that isn't a true root user... It ruins everything I've come to expect from using root.

hw 9y ago

Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly. How would you feel if someone discovered a 0day at a company that exposes credit card and identity info, published the 0day, then hackers steal all that info (including yours)? I'm sure 'creating a thunderstorm of negative publicity' would be the last thing you would want.

soneil 9y ago
I don’t see it as either/or. You can disclose responsibly, and go for publicity once the fix is in circulation. Responsible disclosure is nothing to do with protecting Apple, it’s about protecting the users.
flywheel 9y ago
Far too many people think of Apple as infallible. I often think even Apple thinks of themselves as infallible. The more people that are aware of the inherent risk involved with using computers - any computer - the better.
5ilv3r 9y ago
The problem is that this is not a zero day in new technology. They made a jr sysadmin mistake. As a company who wants a reputation for good security, that is not acceptable.
bambax 9y ago
> Is there something you don't like about them? You mean, in addition to bad QA and complete disregard for their users' security? And being the richest and most profitable company ever, cutting corners and evading taxes? Their response on Twitter was amazing: "PM us so we can discuss this privately", not "thank you, we're looking into it NOW".
- macintux 9y ago
  I suspect the response on Twitter was a typical reply from a tier 0 support person. No reason to extrapolate from that to the company's internal response. Apple is a Rorschach test writ large. What people see in it reflects more on the observer than the company in many cases.

aquova 9y ago

I think there's a middle ground to this. Submit your report to Apple security, allow them time to develop a patch, and then in a week go ahead and tweet at the big media outlets about it. I'm a die-hard Apple user myself, but I agree that the long list of severe bugs in High Sierra is absurd, and a big public backlash might be enough to kick them into gear. On the other hand, I, a university student with next to no understanding of computer security, can simply walk onto campus, sit down at a Mac, and within seconds have complete access to the computer. It's ridiculous, it's horrendous that it shipped like this, but it's not something that needed to get out, especially something so easy to utilize.

kristofferR 9y ago
The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care. Us geeks have been complaining about the horrible QA in macOS for years, yet nothing has been done. The fact that this is so simple to do will probably/hopefully get ordinary people to start talking about it too ("Hey, have you heard that you can hack Macs without a password? Very insecure"), which would force Apple to improve.
- openasocket 9y ago
  It sounds to me like you're arguing that full disclosure in this situation could lead to a worse outcome for users in the short term, but the negative publicity will force Apple to improve their security posture, leading to a better outcome for users in the long term. (Please let me know if I'm miss-characterizing your argument) I think you have to be very careful about that line of argument. It's a single vulnerability researcher making a unilateral decision about the short term and long term security of an entire user base, based entirely on personal judgement. I personally think the researcher should make the decision that best protects users from that specific vulnerability. Making long-term changes to a company's QA should come second.
  - AlexandrB 9y ago
    > I personally think the researcher should make the decision that best protects users from that specific vulnerability. I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party. Apple has a multi-hundred-billion dollar war chest and, if they wanted to, could afford to make macOS the most secure operating system on the market. The fact that they don't is their own choice and a reflection of their priorities, not some act of God or a natural disaster. Putting the onus for cleaning up the mess in the most "responsible" way possible on third parties with a fraction of Apple's resources is being too kind to Apple.

mozumder 9y ago

Zero-day disclosures aren't about negative publicity in order to prevent problems further down the road some time in the distant future. It's about protecting systems RIGHT NOW from immediately causing harm to people's lives.

bubblethink 9y ago

>Let's hope Apple gets sued for the damage How can that happen in any case ? Isn't pretty much the first line in every license waiving of liability ? Unless you have some special contract with Apple that overrides other standard boxes that you ticked, how would anyone sue ?

madeofpalk 9y ago

Do "responsbile disclosure" rules apply differently to Apple? If so, why? How do you identify companies like Apple that get one set of rules to other companies?

BinaryIdiot 9y ago

This is extremely naive. Yes Apple shouldn't be having this issue but disclosing a 0-day issue can possibly hurt users far worse than hurting Apple. Apple may lose a tiny bit of money but users could lose far, far more especially if someone develops a good way to remotely deploy / take advantage of this defect. Ignoring responsible disclosure also limits the ability to sue them for any damage resulting from it (or so I'm told by one of my lawyer friends who thinks this disclosure may make it almost impossible to successfully sue them over it unless it simply takes them too long to fix).