10 ms·
Apple's Failure to Check Kill Syscall Privilege “Not a Security Issue”
- fjarlq 9y agoThe quoted statement, "not a security issue", doesn't appear in the linked page, but via the Thread Prev link[1] I found Daniel Peebles explaining: > Yes, we did try with them first and they told us they didn’t consider it a security issue, so we posted to oss-security after making sure Apple understood we’d do that unless they asked us not to. [1]: https://lists.apple.com/archives/darwin-dev/2017/Oct/msg00005.html https://lists.apple.com/archives/darwin-dev/2017/Oct/msg0000...
- saurik 9y agoMaybe-interesting contextual note: Daniel Peebles was one of the people involved at the beginning of iPhone jailbreaking.
- Terretta 9y agoHe was just trying to get it to run Nix.
- giancarlostoro 9y agoReminds me of when GreySyntax was trying to get Nginx to run on Linux as well. The reverse engineering / hacking community usually has all sorts of fun little goals to stretch tech past initial design.
- dezgeg 9y agoTo be clear, this bug was found running Nix on macOS, not iOS (just in case someone else besides me interpreted the two comments here as such). Additional fun fact - the issue in question was not found during new development, but by just running the same code that had worked on previous macOS versions just fine. So besides a vulnerability, it's an user-visible regression to behaviour described by POSIX APIs.
- saurik 9y agoI remember him beginning his work on Nix after his involvement in iPhone jailbreaking, but I might have not paid enough attention to the beginning of the Nix project.
- Terretta 9y agoHa, I was kidding but it wouldn’t have been implausible. Another if you know him: “He was just trying to make iOS more functional.”
- copumpkin 9y agocough
- neom 9y agohttp://www.openwall.com/lists/oss-security/2017/10/12/2 http://www.openwall.com/lists/oss-security/2017/10/12/2 "-> We have not reserved a CVE for this issue as Apple is a CNA and does not > see it as a security issue. > And here's my main teachable moment. If a CVE Numbering Authority (CNA) does not grant a CVE to an issue (whether it be due to "not a bug" or non responsiveness or whatever) there is a simple process to deal with this. You go to the CNA's parent, a list of CNA's is currently at: https://cve.mitre.org/cve/cna.html https://cve.mitre.org/cve/cna.html in general most current CNA's have MITRE as their parent (we're working on a federated hierarchy but we're in the early stages), so using the form: https://cveform.mitre.org/ https://cveform.mitre.org/ to request a CVE would be your next step. For the Open Source Distributed Weakness Filing (DWF) hierarchy each CNA and sub CNA is registered at: https://github.com/distributedweaknessfiling/DWF-CNA-Registry/tree/master/CNA-Registry https://github.com/distributedweaknessfiling/DWF-CNA-Registr... so essentially you go to the parent and keep working your way up until either you are satisfied, or you hit MITRE and they tell you to take a hike, or give you a CVE. Speaking of which if you are an Open Source project and want to be a CNA, polease contact me and chances are I can set you up in a pretty quick timeframe (faster than I assign CVEs because creating a CNA is a much better ROI of my time than issuing a CVE). ." - via>" Kurt Seifried -- Red Hat -- Product Security -- Cloud"
- jwilk 9y agoI bet MITRE will redirect you back to Apple.
- blattimwind 9y agoYour comment makes it seem doubtful you ever interacted with the MITRE CVE team.
- cryptonector 9y agoThis is against the rules. You're supposed to file CVEs with the most-specific CNA only.
- dgellow 9y ago
- eridius 9y agoIs Apple wrong here? I mean, this is obviously a bad thing that should be fixed, but ultimately it amounts to a DoS against the machine and does not grant any privileges or expose any data to the attacker. I can see why Apple might say it's not a "security" issue.
- a012 9y ago> " it amounts to a DoS against" but > "it's not a "security" issue" So contradict yourself. It's a feature, I guess.
- clhodapp 9y agoNot everyone agrees on this but an improper ability to cause a DOS is pretty widely considered to be a type of security issue.
- AstralStorm 9y agoThis is not a simple DoS as in a service hangs. This is a reliable kill and potentially restart, making it possible to use fault injection attacks (not 100% reliable exploits) and exploit start-up race conditions.
- viraptor 9y agoOr force-cleaning caches. Imagine you're trying to poison a DNS cache in some specific app. You can try+restart until you succeed.
- jlgaddis 9y agoA denial-of-service typically falls under the "availability" part of the "CIA triad" [0], although the seriousness can vary tremendously from one DoS to the next. [0]: https://en.wikipedia.org/wiki/Information_security#Key_concepts https://en.wikipedia.org/wiki/Information_security#Key_conce...
- williamscales 9y agoIt seems to me that it's in the same category as a fork bomb - a neat trick requiring local access that will crash a machine. Deeming it a non-security bug seems entirely reasonable. As you say it does not grant any privileges or expose any data to the attacker. So the bug cannot really be exploited to compromise security except in a case where someone has gone to extraordinary lengths to keep even a local user from crashing the machine.
- rnhmjoj 9y agoPrevius discussion here: https://news.ycombinator.com/item?id=15846713 https://news.ycombinator.com/item?id=15846713 Looks like it has been fixed in macOS 10.13.2 anyway.
- sabujp 9y agoTIL that apple uses a mac CI infrastructure where they clean up processes and don't do a full teardown / rebooot or VM revert to snapshot, hah
- mitchty 9y agoNix is not apples tool. It is a package manager. https://nixos.org/nix/ https://nixos.org/nix/
- bgduke10 9y agoclassic example of leaders in tech failing to check their privilege