21 ms·

The problem is that cybersecurity is ridiculous hard problem. The junior to senior developers are just using existing frameworks with poor documentation. Any

• hungryforcodes 5y ago
  You know, I'd love to think that the problem is cyber security is hard -- which it IS -- but I'm starting to get the feeling that the actual problem is that Apple doesn't care about this kind of stuff. So many incredible vulnerabilities going back generations of iPhones and iOS...the zero click iMessages one floored me.
  • tyrfing 5y ago
    > the zero click iMessages one floored me. In case there is any confusion, there has been at least one of those a year for the past 3 years.
    • easton 5y ago
      What is dumb about it to me is that the solution in my mind is simple: don’t give Messages.app private API access. They get access other messaging apps from the App Store can’t have and that’s what’s causing these vulnerabilities, but all they need is APNS and access to the SMS service (which is private but shouldn’t be dangerous… right?).
      • kenferry 5y ago
        This last one was an issue in an image decoding.. it was public API. It’s extremely common for an attacker to find a way to exploit a maliciously crafted image. Take a look at libpng, https://www.cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html https://www.cvedetails.com/vulnerability-list/vendor_id-7294...
• emsy 5y ago
  The problem is not that cyber-security is hard, but that a trillion dollar company is incapable to handle security disclosures.
  • Mtinie 5y ago
    In which case—if it’s a legitimate deficiency—that doesn’t bode well at all for any other commercial enterprise. This arms race is always tilted in favor of the attacker.
    • derac 5y ago
      There are much smaller companies which handle security disclosures much better.
      • fragmede 5y ago
        but there are many many many more that don't, which impeaches the few that don't. The fact that I can reach the CEO of my local small business on the phone is a great when they're sympathetic to my plight. it's actually to the company's detriment when it turns out they're a raging asshole.
  • numpad0 5y ago
    I remember some of early Android phones that ran manufacturer maintained Kernel turning out immune to then-undisclosed RCEs years before disclosure. I think it’s less about disclosure handling but more about being motivated to pay for or build a black magic code analysis tools.
    • fragmede 5y ago
      got any links? that sounds like a fascinating story to read!
• wyattpeak 5y ago
  Cybersecurity is a genuinely hard problem, but stuff like this is dropping the ball entirely. It's not hard to solve exploits like faulty permission-checking after they've been reported to you. Sure, there are always going to be problems you miss. I can forgive them shipping with zero-days, it happens. Failing to respond to reports is just that: failing.
  • eloisius 5y ago
    It really helps add some color to the motivations behind notorization. It seems ridiculous to me that I have to jump through so many hoops to run an executable that I trust. Especially when Apple can’t be bothered to follow up on real vulnerabilities that have already been reported.
    • chii 5y ago
      Exactly - any PR propaganda about notorization or signing making it safer for users is just BS. It's a gate-keeping mechanism that adds a layer of power to apple and prevent any control of the app market from slipping away.
      • noptd 5y ago
        Along with a solid bit of resume building for SecEng, I'd say yeah exactly that.
    • concinds 5y ago
      Worse is the fact that the bulk of Apple’s security on Mac is codesigning/notarisation, and a primitive signature-based built-in antivirus. Windows seems to be doing so much better that it’s not even close, and in ways that aren’t user-hostile.
  • Bhilai 5y ago
    Not to mention that there are still no mandatory security courses in CS curriculum at most major universities.
• howinteresting 5y ago
  Or better, we could stop making excuses for trillion-dollar companies with terrible security practices.
  • toofy 5y ago
    i agree that we need to hold massive corporations to a higher standard, but security is incredibly difficult. this comment is more directed at all of the comments who are dismissive of how difficult good security is. even some of the sharpest security/privacy minds on the planet, who work for organizations who exist purely to make secure software or hardware stumble often. now add in that we actually expect our devices to also be usable, and yes, security is very very _very_ difficult. if someone hasn’t learned by now that every device will eventually be cracked, we should question their ability to reason. now again, we should absolutely expect more from apple/google/$company than we do, but we also can’t hand-wave away that security is very hard.
    • howinteresting 5y ago
      I mean, Google does a far better job than Apple responding to reported vulnerabilities, pays a team to find vulnerabilies, has extensive fuzzing infrastructure, etc. Even among its peers Apple stands out as particularly bad.
• esalman 5y ago
  Apple makes ridiculous amount of money, and many Apple fanboys I know believe their devices are hack-proof.
  • blowski 5y ago
    I don’t think of my devices as being hack-proof, but as being the best set of trade-offs for me personally between security, privacy, usability, etc.
    • esalman 5y ago
      Agreed. I use Windows/Android for the same reason- I know what I'm giving up but the upsides are important enough to me. I am talking about people who don't have much clues about either.
  • toofy 5y ago
    i’m not sure anyone who is at least semi-informed believes their devices to be hackproof. it’s more likely they’ve considered which security issues they’re personally concerned about and decided the other choices are as bad or worse. once we actually dig into the specifics of an issue–especially one as complicated as personal threat models combined with actual usability–it’s rarely a “my device is now unhackable” cartoon caricature.
• godelski 5y ago
  > The problem is that cybersecurity is ridiculous hard problem. This is why I wonder why "minimize your data exposure" is such a controversial opinion.
  • jeltz 5y ago
    Because it makes developing new features slightly slower and that is for mostly stupid reasons deemed unacceptable.
• concinds 5y ago
  This seems like much more of an organisational dysfunction problem than a computer science problem. I haven’t heard anything like this about Microsoft or Google: both seem responsive and eager to fix within 90 days (mostly), have responsible browser update models (where fixes for 0 days can be pushed to the whole world within hours) instead of Apple’s irresponsible “you need a 3GB OS update even if the only fix is 3 lines of code in Safari, but we don’t push updates when ready since we don’t want to cause update fatigue, so you’ll need to wait 4 weeks for the fix to come in the next programmed OS update”, and so much more. Even Android seems decent security-wise, since many of the processes that would cause security concerns get updated through Play Store, even in really old phones. Another example: my grandma doesn’t have WiFi, and I bought her an iPhone, but iOS updates can’t be done on 4G, which can only be bypassed by internet-tethering a computer (which she doesn’t have), downloading the full IPSW, and installing it. She was on iOS 14.0 until 2 weeks ago when I fixed it. And with Safari being, according to security researchers, much less secure than Chrome, that makes me shudder. This isn’t an “anecdote” or an edge case, not everyone lives in a developed country and millions are just like my grandma, and Apple’s poor security design leaves her vulnerable for zero good technical reason, where Android wouldn’t. (They just dropped Google Play Services support for Jelly Bean a few months ago, so even an old Android phone would be reasonably secure). Caring about security requires thinking of details like this.
  • PostThisTooFast 5y ago
    Not to mention Apple's amateur-hour, dogshit-stupid policy of forcing everyone to use an E-mail address as his user ID. How many people probably think they need to use their E-mail account password for every one of these idiotic organizations that forces them to log in with their E-mail address? I'm guessing a SHITLOAD. Your grandma definitely is not going to understand the difference. And that makes every one of those organizations the gatekeeper to every user's E-mail account. One disgruntled employee, one poorly secured system, or one nefarious forum operator can now access untold numbers of E-mail accounts and steal identities galore. You don't see banks or brokerages forcing people to use a goddamned E-mail address as a user ID, but Apple has doubled down on this bullshit policy even after being called out on it. No excuse.
  • 5y ago
• Bellamy 5y ago
  Existing frameworks? Does anyone knows the technology stack Apple uses?
• tester34 5y ago
  Have they considered asking security questions on interviews instead of algos? like you know, shitty performing algo can be always rewritten, leak or 0day cannot be reverted
• Silhouette 5y ago
  The problem is that cybersecurity is ridiculous hard problem. Security is challenging, but there are lots of things we know how to do better that many software developers still aren't doing. For example, if you're still writing application-level software in an inherently dangerous programming language in 2021 and that application handles important data in a connected device, you're part of the problem. If you ship a networked hardware product with a standard password for all devices or forget to disable the backdoor access used during development, if you use encryption or hashing methods that are known to be weak, etc. These things obviously won't solve all security problems, but they are low-hanging fruit that is still being left on the tree far too often.
• TaylorAlexander 5y ago
  > The problem is that cybersecurity is ridiculous hard problem. This is hard for me to believe for a company the size of Apple. They were recently the wealthiest company on the planet and are worth over a trillion dollars IIRC. They could slow down their software development process, focus less on adding new features, and prioritize fewer security holes. It seems like such a huge risk to them that their devices are basically always vulnerable. But the general public never really hear about these 0-days so they may have some ability to ignore the problem. The cynic in me imagines that someone at Apple knows about these bugs and they are shared with spooks for exploitation. One could imagine that even for a responsible disclosure program, they could share details of every new vulnerability with some three letter agency who could have months of use out of them before a patch is finally released.
  • dspillett 5y ago
    > recently the wealthiest company on the planet … They could slow down their software development process, focus less on adding new features, and prioritize fewer security holes. My inner cynic¹ has a slightly different take on that: You don't get to be the wealthiest company on the planet by doing the right thing at the expense of the profitable things. ¹ He says, pretending it isn't also his outer and all-consuming cynic!
    • skylanh 5y ago
      Ah, then the cynical part of you will recognize that selling a widget is more lucrative then avoiding the loss of someone else's private data. Or at least that's what I just realized.
      • someguydave 5y ago
        people are unwilling to wait or pay more for high quality products when a low quality substitute that is just barely adequate is available
• charlchi 5y ago
  If companies respected and paid platform/architecture engineers, or SecOps/SysAdmin types fair amounts of money and treated them with respect, instead of just throwing more and more money at hordes of mindless devs who are "pushing product", as virtually every single company does, maybe this problem wouldn't exist. I've had this conversation too many times. Security isn't hard, it's just that nobody has respect for it. The guy who understands software security isn't getting the respect he deserves. The situation is so bad, some companies are literally hiring people who know the equivalent of script kiddie "penetration-testing". Pay security engineers enough and listen very carefully to what they have to say. Literally the only companies who seem to understand this basic concept seem to be the intelligence agencies, and a few other high profile companies.
• foxfluff 5y ago
  > The problem is that cybersecurity is ridiculous hard problem. I don't believe that. Making perfectly secure software at large scale is indeed very hard, but a lot of security issues we see every day have little to do with lack of perfection. There's a ton of low hanging fruit out there. > The junior to senior developers are just using existing frameworks with poor documentation. Yes, I do believe that the modern way of quickly ducktaping junk together while paying little attention to security does make for lots of security issues, which might give someone the impression that cybersecurity is ridiculously hard. Security requires proactive effort. It's not ridiculously hard, but it needs to be done, it requires time (just as anything). Leaving it for "hope you don't write buggy code" and "does colleague notice the gaping hole in code review" is not doing security, it's just winging it. And I've never really been asked to do security, even when literally working on a security product. Everyone just seems to assume security is an automatic byproduct of skilled programming, but it's not when the pressing concern is "how many hours/days/.. does it take to ship this new feature oh and we have three dozen other features that need to be implemented soon" and "can we get it sooner?" and "why is it taking so long, it's not that hard!" It needs to be discussed, planned, designed, reviewed, tested, verified, questioned, audited. Just like anything else, if you want quality. None of this is ridiculously hard, but it needs to be done for it to be done. If it's not being done, it's that the organization doesn't care about it. In a lot of ways it's similar to technical debt. Are you taking the time to avoid it, reduce it, get rid of it? No? Then you're accumulating it. Security issues accumulate just like technical debt when ignored. And even the most skilled programmers do generate technical debt (because they don't jump into a problem with perfect knowledge of what needs to be done). Depending on the organization, they may or may not get to fix it. Many organizations just don't care and would rather have the devs work on something "more productive."
• jonathanstrange 5y ago
  You talk as if the Apple engineers couldn't have fixed those 3 vulnerabilities in half a year because it's too difficult for them...
• wyager 5y ago
  > It's the same never-ending war as anti-cheat vs cheat. Building secure software and building anti-cheat are nothing alike. Anti-cheat is fundamentally impossible (on a true general purpose computer) because you’re building software that has to run in an environment where it can be dissected and modified. Building a secure device (something which has to satisfy certain security properties for all inputs through a constrained API) is fundamentally possible. We’re just too lazy and cheap to do it. I don’t even think it’s “ridiculously hard” - we would just have to spend more money on correct by construction designs, formal methods, etc instead of spending money on flashy UIs and random features no one cares about. The number of employees at Apple working on security is vanishingly small compared to the number of employees, say, working on random siri features. And the way they approach security in many apps is also wrong. Instead of having people with formal correctness backgrounds designing the APIs against which apps are built, they just have developers with no security background putting everything together and then have a few security people trying to pick up the pieces.
• api 5y ago
  It would really help a lot if: (1) We used safe languages like Go, Rust, C#, Java, and Swift instead of 1970s YOLO languages like C and C++. (2) Our operating systems were designed from the ground up to be secure in a modern environment. Unix (all flavors) and Windows were both built long before security was anywhere near as much of a concern as it is today. Their security posture is very lax by modern standards. Applications have a ton of permissions by default including seeing the whole network and filesystem. Everything runs with only basic memory isolation. Everything has access to an enormous system call surface area. It is extremely hard to apply security in retrospect to an insecure system, especially a complex one with lots of legacy support requirements. You are going to be playing a whole lot of "whack a mole." A modern secure OS would begin with the principle of least privilege and be built from the ground up to isolate applications as much as possible from anything they are not entitled to access. Oddly enough the web browser might be the best attempt. When you browse the web you are basically swimming in malware, and you are relatively safe.
  • ziml77 5y ago
    Entitlements are great, right up until someone has to start manually deciding what access to give. After being blocked or questioned by the OS a handful of times, people are going to either disable the security or effectively disable it with wildcard matches.
• dangerface 5y ago
  Don't apple make the frameworks they use? Im pretty sure they could just patch them when they are notified of a vulnerability.
• stjohnswarts 5y ago
  On anything other than trivial examples it is an impossible problem. Given the gigabyte of code on iphones (and android) it's even more impossible. Best you can do is put an emphasis on quickly fixing any issues found and to practice security hardening. It seems iphone is failing on this pretty hard currently since they didn't fix these errors that were handed to them on a silver platter.