12 ms·
MacOS Update Accidentally Undoes Apple's “root” Bug Patch
- incadenza 9y agoQueue obligatory 'this wouldn't have happened under Jobs' posts.
- CamperBob2 9y agoWell, it would only have happened once, that's for damned sure.
- JadeNB 9y agoWow, so now they have this massive security bug, screwed up file sharing when they fixed it, and now are apparently inadvertently rolling back the fix to the initial massive security bug.
- pmarreck 9y agoClassic "rushing to fix problem causing more problems" programmer error
- twinkletwinkle 9y agoNow is better than never. Although never is often better than right now.
- contingencies 9y agoPrescription: additional sleep for security team, and non-negotiable vulnerability regression tests for all releases.
- pmarreck 9y agoSeems to be a horrible week for Apple devs... I just got bit by this bug, which was infuriating as hell: https://twitter.com/jeremybank/status/936775452097626113 https://twitter.com/jeremybank/status/936775452097626113
- aphextron 9y agoLooks like someone screwed up their cherry-pick
- allenz 9y agoSummary: the root bug reappears when you upgrade your Mac. You need to manually reinstall Apple's security patch and reboot. There's no warning that a reboot is necessary.
- wasyl 9y agoHuh, and how do I reinstall the patch? Can't find a downloading link and app store doesn't let me do anything with the update Funny thing is that on the update site section steps in `To confirm that your Mac has Security Update 2017-001` confirm that I have the update, but am still vulnerable to the issue. Do I understand correctly that setting root password is also valid workaround for the issue?
- jacquesm 9y agoNot a good week for Apple. They were doing pretty good reputation wise when it concerned security so far but this whole saga has been less than stellar. Amazing that regression testing didn't catch this.
- em3rgent0rdr 9y agomaybe there wasn't any regression testing...
- segmondy 9y agoThere was no regression testing.
- tabs_masterrace 9y agoLooks like Apple is having trouble hitting deadlines this year. iOS 11, Xcode9, OS X all came out rushed. Maybe because they're moving to the new building. Or maybe they're trying to do to much stuff on a yearly release cycle now.
- dfischer 9y agoAs serious as this is, it kind of makes me feel humbled in a way knowing I’ve been through these exact situations and it happens to Apple too.
- ryanlol 9y ago>As serious as this is ... So, not at all? It’s a LPE for gods sake. EDIT: Apparently it affects remote desktop too, so not just a LPE. Can this even be exploited from within the sandbox?
- Groxx 9y agoI'd imagine it makes device theft rather more serious.
- fra 9y agoNot just local. VNC and other remote protocols are vulnerable.
- ryanlol 9y agoAh, that's far more interesting. Do you know if SSH is affected?
- LeoPanthera 9y agoSSH is not affected.
- benwilber0 9y agoLPE's are very serious for the countless college campuses, public libraries, and design print shops like Kinkos that offer public access to Mac computers.
- ryanlol 9y agoVery serious or minor annoyance? "college campuses" don't strike me as the kind of places where any security issues are considered "very serious".
- kzahel 9y agoI am still confused. I was prompted again today to install the security update I installed yesterday. Did they silently release another improved security update?
- glhaynes 9y agoYeah, the day after they put out the initial update (17B1002), they put out a second update (17B1003) that fixed the file sharing issue caused by the first one.
- halayli 9y agoThey’re playing Whac-a-mole
- trhway 9y agoMac-a-mole
- deleted 9y ago[deleted]
- pfarnsworth 9y agoThis is turning into a comedy of errors. They don't add regression tests to their test suite? I'm a bit shocked that they're having so much trouble releasing a patch properly.
- mephitix 9y agoFor something as serious as the initial bug (especially given it was all over the press) there should have been regression tests for this. Either deployment was broken, the tests were broken, there weren't tests, or multiple of the above :\ anyway I'm hypothesizing but would love to see a post-mortem on this. How does a generally reliable company like Apple screw this up twice?
- platinumrad 9y agoI've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important best practice from a security perspective. I'm afraid that the recent muck ups in High Sierra and iOS 11 are going to make sure that some of them never listen to me ever again.
- IBM 9y agoI have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.
- tedivm 9y agoYou don't need to be following "Apple news" to hear about this. It has been all over the news.
- digi_owl 9y agoIndeed. You never need to follow Apple news to get Apple news, Apple is perhaps the one company that all MSM loves to talk about. And i attribute that to themselves being largely Apple users by force of habit.
- platinumrad 9y agoMaybe they won't be aware of this particular vulnerability but issues like the the iOS autocorrect bugs[1][2] get memed to death on all sorts of mainstream social media platforms. Even the original "root" tweet got 10k+ retweets. [1] https://www.theverge.com/2017/11/6/16611756/ios-11-bug-letter-i-a-unicode-symbol https://www.theverge.com/2017/11/6/16611756/ios-11-bug-lette... [2] http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorrect-it/ http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorre...
- IBM 9y ago
- ertemplin 9y agoDoes Apple not require engineers to write regression tests? I really hope there is a blog post or press release explaining what happened.
- nixpulvis 9y agolol, don't hold your breath.
- trhway 9y agosounds like a typical extra-super-hyper-important-emergency effort under the constant gaze from the very top through the thick E/S/VP/etc. layers of CYA mediocrity eager to report up the successful completion of a glorious effort to the glorious leader in a typical BigCo where engineering culture is faltering while nobody who matters cares (or even able to care) Well, at least it was that way back at Sun :) ... Or may be it was just a one bad day at Apple. Though many people like to argue that engineering culture is exactly to prevent the "bad" days from happening...
- christophilus 9y agoYup. That paired with what appears to be the lack of a decent test process. Maybe 2018 is the year of the Linux desktop? ... one can dream...
- trhway 9y agoafter i first time last year (our BigCo like any other BigCo likes SUSE and that one isn't fast on bringing in new changes) faced GNOME 3, i was wonderstruck at the engineering feat what it is ( no joking, great engineering achievement, just for different world, and it took some effort to downgrade back to GNOME 2). Seeing GNOME 3 made me completely sure that Linux desktop of our dreams just isn't coming.
- _arvin 9y agoLinux desktop user here, I'm pretty happy so far to end 2017. https://i.imgur.com/yG3ep3M.jpg https://i.imgur.com/yG3ep3M.jpg
- exikyut 9y agoHuh, they made GNOME look good, I'm mildly surprised to admit. Not bad. I have to admit that for a second there I thought you were running Bash on Windows and the terminal was going through an X server. Ha
- vladimir-y 9y ago
- draw_down 9y agoMan, what is going on over there lately.
- exabrial 9y agoWith all the pressure to produce novelty gimmicks, it's a little unsurprising :/ and unfortunate, I'm a huge fan of osx. It's nice to have a commercially supported unix system that also has a decent UI.
- bsaul 9y agoI feel weird reading comments here ranging from excusing the developer to blaming him, for its lack of unit testing or anything. Let’s make this clear : management fcked up badly. Human process. Not code, not unit testing, not a single line of code is responsible. And you know why ? Because when you’ve had the greatest security failure in a decade publicly shaming your company and your team, you personaly make sure it doesn’t happen again in the next release. And it’s not just one manager. The whole management is screwed, it’s a disaster. I think now is really time to say : would you imagine this happening under steve jobs ?
- revelation 9y agoIt probably was this great idea of merging the iOS and MacOS teams. That just screams management.
- dsacco 9y ago> Because when you’ve had the greatest security failure in a decade It's nowhere close to the greatest security failure in a decade. It's not even a contender in the far off distance. It's a well publicized vulnerability, and it's quite silly, but in the scheme of things it's just a Tuesday for CVE writers. We even had a vulnerability functionally identical to this, and similar in both severity and silliness, hit Linux within the past year. If you're talking about Apple specifically, it's still not that bad. The vulnerability couldn't be arbitrarily executed remotely with default OS settings, and it didn't grant kernel access. The Trident flaws were significantly worse than this, and that's just the first that comes to mind. Yes, yes, I know this wasn't the thrust of your point...but still. People get kind of hyperbolic when it comes to rating security vulnerabilities. It's more silly than it is severe. I expect at least one vulnerability of comparable impact on every major point release of every major operating system and web browser (not that this is a good thing, but it's logistically realistic). I don't think this is particularly bad for Apple's public image or reputation. Headlines about "the sky is falling!" vulnerabilities make the rounds every so often; for better or worse, it never really seems to stick in public consciousness.
- bsaul 9y ago
- pwdisswordfish2 9y agoWould a problem with something as fundamental as this happen with an open source UNIX-like distribution and fail to be discovered or adequately fixed? Would anyone feel compelled to apologize for mentioning a mistake by an open source project on Twitter? The gentleman who tweeted about Apple's mistake actually apologized for it on Medium. Crazy. https://medium.com/@lemiorhan/the-story-behind-anyone-can-login-as-root-tweet-33731b5ded71?source=user_profile---------1---------------- https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo... Apple can claim it is "certified" as UNIX(TM). And publish the source for userland code it copied from open source projects. Microsoft is trying again to subsume "UNIX" into Windows allowing users to run Linux binaries without running a Linux kernel. But neither is a substitute for the original open source UNIX-like projects. This blunder by Apple proves that even the wealthiest company on Earth does not necessarily produce better "UNIX" than a group of unpaid volunteers. At least if the user cares about the basics.
- bartvk 9y ago> The gentleman who tweeted about Apple's mistake actually apologized for it on Medium I read his statement but I don't see an apology there. It's a reply to people who are saying he should've practiced responsible disclosure.
- ryanpcmcquen 9y agoApple's security team is nailing this.
- zerostar07 9y agoThe saga continues
- smsm42 9y agoEverybody can have a bug. Even a bad one. In fact, virtually every system does have a doozy now and then. But recently with Apple it looks like they are serving them constantly lately. Shame for this to happen to the company that once could be pointed at as an example of somebody who gets how to make a professional Unix-based desktop.
- based2 9y agohttp://www.iphonehacks.com/2017/12/macos-10-13-2-beta-6-root-security-patch.html http://www.iphonehacks.com/2017/12/macos-10-13-2-beta-6-root...
- alphabettsy 9y agoIt appears the problem is that the fixes included in the security updated were not backported to 10.13.1 which caused a problem for users coming from 10.13.0 that had done the security update. Certainly a huge issue, but many commenters seem to misunderstand the article.
- jarym 9y agoGenerally I’ve noticed more bugs on High Sierra than on previous OSX releases. Things ranging from UI glitches to freezing safari to random slowdowns - all across multiple different machines. Coupled with the security issues it’s clear that whoever is responsible for Q&A these days is asleep at the wheel. It’s the reliability of the hardware and software that brought me to Apple back in the days of the G4. Ironic that I may have to switch back to Windows since my work machine seems less buggier than my Mac!
- dingo_bat 9y agoWin 10 has its fair share of bugs, tbf. In fact win 10 feels like a Google product that never leaves beta. There will always be glitches and weird stuff. Some things have become very good over several iterations. But there are a ton of new stuff they keep adding and all of those are half baked until the next big release.
- TazeTSchnitzel 9y agoThe worst thing about Windows 10 is there’s a mandatory, automatic OS upgrade every few months, which Microsoft pretend is simply an update. This can and will break things every single time.
- dingo_bat 9y agoThat's actually something I like. It makes most users' PCs much more secure. Also if absolutely required, OS upgrades can be deferred by up to a year.
- deleted 9y ago[deleted]
- bfred_it 9y agoIncredibly my El Capitan -> High Sierra update went smoothly and fixed the abhorrent wifi problems I had had forever—however that was the only reason I wanted to upgrade. macOS has not been evolving for a while. I miss the Leopard days. iOS 11 on the other hand was more of a downgrade to beta on my 7 Plus.
- vladimir-y 9y agoApple pushes those who have not yet moved to Linux to do so?
- feelin_googley 9y agoOne hesitates to comment on this sequence of events because it speaks for itself. But here is a stupid user opinion (mine): I believe users place too much trust in corporations such as Apple, Google or Microsoft to protect them. There is too much debate over which company to choose ("I like ___________'s approach to security") instead of questioning whether delegating security to any of them is truly the wisest course of action. I hope that this incident causes at least one user to question whether users might benefit from adopting a less trusting and more vigilant approach to protecting their data. And by "vigilant" I do not mean "choosing the right tech companies to trust", diligently installing updates from these corporations and feeling self-satisfied. I mean questioning the status quo and thinking seriously about the benefits of free, open source operating systems that are potentially reviewable by millions of developers and users. Systems that can be modified, compiled and installed easily by anyone, not only by small groups of people in corporations with special knowledge. Systems that can, e.g., permit and maybe encourage "safer", more conservative usage patterns. Under the prevailing laws, I believe this pool of open source developers and users will always contain a larger number of people who care more about protecting user data than any groups within the above companies. It is a matter of self-interest. Apple is a company with seemingly infinite resources at its disposal. But clearly in this case there were more people seriously interested in fixing this vulnerability outside of the company than within it. And as a dumb, naive user, I question anyone who would suggest that no one except a small group of people at Apple would be competent to do this work. IMO, this mistake had nothing to do with what makes Apple valuable, namely their hardware. A UNIX-like OS running on Apple hardware does not need to be proprietary and, IMO, users have a compelling interest for software, that can expose their data and pose other security issues, to be open.
- chrisweekly 9y ago“vigilant” spelling error, not too late to edit a great comment
- deleted 9y ago[deleted]
- bsimpson 9y ago
- nixpulvis 9y agoSo my previous comment about how if Apple was smart they'd have a unit test for this seems to be confirmed. Apple is not smart. RIP.
- jordache 9y agoOh! Well that solves the mystery of how Apple allowed their new USB-C MBPs to be so buggy in trivial use cases.
- foobar1962 9y agoWho remembers the System 7 Update 1.1.1?
- mwcremer 9y agoI do. Heck, I was responsible for the first crashing bug found in System 7.0. It was found about six hours after GM images were released to manufacturing. It was a crashing bug. It was remotely exploitable. It was one freakin' register, for cryin' in your cornflakes.
- yuhong 9y agoHow it was remotely exploitable?
- GirlsCanCode 9y agoWhy do Apple people apologize for this? What's wrong with them?
- Karupan 9y agoNot regretting my decision to always be one major release behind. At this point, I simply don’t trust Apple enough to install updates without breaking my system and interrupting my work.
- deleted 9y ago[deleted]
- andy_ppp 9y agoI’ve not seen this mentioned anywhere but Apple installed the security update without my permission which made me feel both sad and unsurprised that they have effectively back doors that can run code on my machine with impunity. Will try for a Linux dev machine next time I think.
- k3a 9y agoIt happens. Most people don't care anyway. They will continue buying and stock price will continue rising. ;)