3 ms·

product-security@apple.com is the real one these days. Of course, this gets me thinking, what kind of super powers do these addresses have that allows people t

product-security@apple.com is the real one these days. Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.

acdha 8y ago
Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.
- philipodonnell 8y ago
  > they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.
  - acdha 8y ago
    This was awhile back in the unverified TLS certificate era so I'm assuming they got more serious about it.
  - reaperducer 8y ago
    That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences. I'm not saying it isn't dysfunctional, but it sounds like every single large company I've ever worked with or for. Especially when "security" is provided by a third-party security company.
- Rodd45 8y ago
  Great to hear they are paying good attention to the concerns sent lately.
hobs 8y ago
Often badly, I remember Tavis O crashing Symantec's email server when sending an exploit using standard username/password combos, it unzipped it and crashed itself. https://twitter.com/RyPeck/status/732405198644228096 https://twitter.com/RyPeck/status/732405198644228096
nitwit005 8y ago
Our IT people were apparently incapable of creating a way to receive emails which didn't flag zip or tar files as security threats and block it. We've had to sometimes ask people stick things in dropbox and share it with us that way. We've had similar issues with people submitting code for remote interviews.
- acdha 8y ago
  That seems like a better approach to me. With email, you're at best exposing a disk-filling service to the internet and most likely looking at exploits running on servers with a fair amount of interesting data. There's also a fun race condition between the time a file is scanned and when someone opens it, which isn't as solved a problem as it should be. With requesting that people send you a URL, you're in control of when and where it's accessed and things like Safe Browsing are visible to the recipient.

acdha 8y ago

Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.

philipodonnell 8y ago
> they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.
- acdha 8y ago
  This was awhile back in the unverified TLS certificate era so I'm assuming they got more serious about it.
- reaperducer 8y ago
  That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences. I'm not saying it isn't dysfunctional, but it sounds like every single large company I've ever worked with or for. Especially when "security" is provided by a third-party security company.
Rodd45 8y ago
Great to hear they are paying good attention to the concerns sent lately.

hobs 8y ago

Often badly, I remember Tavis O crashing Symantec's email server when sending an exploit using standard username/password combos, it unzipped it and crashed itself. https://twitter.com/RyPeck/status/732405198644228096 https://twitter.com/RyPeck/status/732405198644228096

nitwit005 8y ago

Our IT people were apparently incapable of creating a way to receive emails which didn't flag zip or tar files as security threats and block it. We've had to sometimes ask people stick things in dropbox and share it with us that way. We've had similar issues with people submitting code for remote interviews.

acdha 8y ago
That seems like a better approach to me. With email, you're at best exposing a disk-filling service to the internet and most likely looking at exploits running on servers with a fair amount of interesting data. There's also a fun race condition between the time a file is scanned and when someone opens it, which isn't as solved a problem as it should be. With requesting that people send you a URL, you're in control of when and where it's accessed and things like Safe Browsing are visible to the recipient.