6 ms·

Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago. Never got any recognition for it, but It was fixed some time af

Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago. Never got any recognition for it, but It was fixed some time after that. It's quite sad to see old bugs getting new lives like that. For those interested, the sample exploitation that I've discovered was connecting any iPod/iPhone device to a OSX laptop while screen was locked was taking the focus away from login prompt 'into' the system, where iTunes was gaining it and from there it was just few OS level keyboard shortcuts from gaining network access to the system, while still locked: launch finder, go to tools folder, launch terminal, launch `nc` in the terminal to get the access via network. Lots of blind typing but it worked more times than not.

zelos 9y ago
I remember seeing something like this with an some version of 10.12 as well. Stupidly it didn't occur to me that it was a security issue.
brazzledazzle 9y ago
I've seen enough regressions with enterprise stuff that I've wondered what their testing looks like. Of course they've always neglected the enterprise so I gave them the benefit of the doubt about the OS as a whole but now I'm starting to wonder.
yeukhon 9y ago
> Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago Any proofs? Perhaps you can demand a bounty payout or sue them ignoring!
- eridius 9y ago
  You can't demand a bug bounty payout, especially because Apple didn't have a bug bounty back then (and their bug bounty today is invite-only). Also, if you read the rest of the comment, Apple didn't ignore it. They fixed it.
  - yeukhon 9y ago
    I did read the rest of the comment. So I am asking if someone is either making this up or if not it's important to shame Apple for its secrecy. That's my view on responsible disclosure; either ack someone's hard work or let every bug free in the wild. What's the point when your work isn't being acked?
    - eridius 9y ago
      > What's the point when your work isn't being acked? To get the bugs fixed? Also, we don't know why they didn't get recognition. The simplest answer is someone else may have reported it first. But it doesn't really matter. And I really don't see how "secrecy" comes into play here.
- tachion 9y ago
  Proofs of what? My story? Don't feel like I need to provide any. Proofs again Apple in lawsuit you're suggesting? I'm not an American, so suing everyone for everything is not really in my custom ;) Rather than them paying me anything after being dragged to court (and I doubt I'd have any chance given disparity between their legal resources and mine) I'd like to get an acknowledgement tied to my name, but I was told not only they don't do that, but also they can't and won't tell me wether I was right and I've found a real security bug. Steve Jobs era secrecy in all its glory.
gurkendoktor 9y ago
Hah. I've reported a similar issue with attaching an iDevice to a locked Mac in 2014. In my case, iTunes was opening a new space to restore its window in fullscreen mode, and the desktop contents were revealed while the animation was running (the lockscreen reappeared afterwards). Now I'm disappointed that I didn't try to get keyboard input into the system and fully pwn myself :)

zelos 9y ago

I remember seeing something like this with an some version of 10.12 as well. Stupidly it didn't occur to me that it was a security issue.

brazzledazzle 9y ago

I've seen enough regressions with enterprise stuff that I've wondered what their testing looks like. Of course they've always neglected the enterprise so I gave them the benefit of the doubt about the OS as a whole but now I'm starting to wonder.

yeukhon 9y ago

> Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago Any proofs? Perhaps you can demand a bounty payout or sue them ignoring!

eridius 9y ago
You can't demand a bug bounty payout, especially because Apple didn't have a bug bounty back then (and their bug bounty today is invite-only). Also, if you read the rest of the comment, Apple didn't ignore it. They fixed it.
- yeukhon 9y ago
  I did read the rest of the comment. So I am asking if someone is either making this up or if not it's important to shame Apple for its secrecy. That's my view on responsible disclosure; either ack someone's hard work or let every bug free in the wild. What's the point when your work isn't being acked?
  - eridius 9y ago
    > What's the point when your work isn't being acked? To get the bugs fixed? Also, we don't know why they didn't get recognition. The simplest answer is someone else may have reported it first. But it doesn't really matter. And I really don't see how "secrecy" comes into play here.
tachion 9y ago
Proofs of what? My story? Don't feel like I need to provide any. Proofs again Apple in lawsuit you're suggesting? I'm not an American, so suing everyone for everything is not really in my custom ;) Rather than them paying me anything after being dragged to court (and I doubt I'd have any chance given disparity between their legal resources and mine) I'd like to get an acknowledgement tied to my name, but I was told not only they don't do that, but also they can't and won't tell me wether I was right and I've found a real security bug. Steve Jobs era secrecy in all its glory.

gurkendoktor 9y ago

Hah. I've reported a similar issue with attaching an iDevice to a locked Mac in 2014. In my case, iTunes was opening a new space to restore its window in fullscreen mode, and the desktop contents were revealed while the animation was running (the lockscreen reappeared afterwards). Now I'm disappointed that I didn't try to get keyboard input into the system and fully pwn myself :)