6 ms·

... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempt

by dguido 15y ago

... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it. The next best thing they'll have to do is, when they install it, disable the web plugin in Safari by default or add an interstitial that prompts the user for it to run. One 500k node botnet really is not that large in the grand scheme of things.

justinschuh 15y ago
I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call. And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.
- dguido 15y ago
  Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.
  - justinschuh 15y ago
    I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).
    - dguido 15y ago
      Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. http://www.trailofbits.com/research/#eip http://www.trailofbits.com/research/#eip Again, show me an actual attack that has exploited Safari. Ever. Targeted, mass malware, I don't care. Apple has better shit to worry about and their investment in Seatbelt was worth 1000x more than individually fixing the limitless supply of bugs in Webkit. Problem solved, move to next actual issue.
      - justinschuh 15y ago
        You can scope the discussion to mass malware on desktop Safari, but that's just reductio ad absurdum. Any fortune 500 or government has to be concerned with real attacks, not just tamping down the noise floor. And as for Apple, they've historically been more interested in protecting their manufacturer subsidy by stopping iPhone jailbreaks--in which WebKit exploits against Safari have played a key role.
- taligent 15y ago
  Wow. So you're not exactly unbiased are you ? At what point were you forced to take on the responsibility for fixing those bugs. It is an open source project and Apple may feel that their best contributions are in adding new features or fixing rendering bugs.
  - justinschuh 15y ago
    That's pretty much my point. Apple does actively contribute to WebKit, but they're not very active on the security front. I've gotten a similar feeling when dealing with security reports we've made on proprietary Apple components (core libraries, etc.). Based on those experiences I assume they feel their resources are better invested elsewhere, which is absolutely their prerogative. Of course, that perspective also strikes me as something any potential Apple customer should consider.
Dylan16807 15y ago
I don't understand what the difference is between having java default-installed and installing java on demand. Both methods run a jar when it shows up, right?
- pooriaazimi 15y ago
  Not for 85% of Mac users. They'll use Mac App Store and Facebook, which are both Java-free.
  - chc 15y ago
    In that case, it still doesn't make a difference whether Java is installed or not. Dylan's point is that the only difference between having Java installed by default and having Java installed on first use is launch time the first time you run a Java program.
- projct 15y ago
  Default installed means there's a java web plugin floating around to exploit, for starters.
blub 15y ago
They have? This is like making a house burglar-proof by bricking the doors. You just cut a small hole when you want to get out... and why would you want to get out, it's so nice inside!
reirob 15y ago
Well according to the article the did not. Here the quote: "The bug was patched by Oracle in February, but Apple didn’t fix the flaw until earlier this month. “Their response should have been much earlier when they should have updated their Java,” says Sharov"

by dguido 15y ago

justinschuh 15y ago

I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call. And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.

dguido 15y ago
Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.
- justinschuh 15y ago
  I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).
  - dguido 15y ago
    Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. http://www.trailofbits.com/research/#eip http://www.trailofbits.com/research/#eip Again, show me an actual attack that has exploited Safari. Ever. Targeted, mass malware, I don't care. Apple has better shit to worry about and their investment in Seatbelt was worth 1000x more than individually fixing the limitless supply of bugs in Webkit. Problem solved, move to next actual issue.
    - justinschuh 15y ago
      You can scope the discussion to mass malware on desktop Safari, but that's just reductio ad absurdum. Any fortune 500 or government has to be concerned with real attacks, not just tamping down the noise floor. And as for Apple, they've historically been more interested in protecting their manufacturer subsidy by stopping iPhone jailbreaks--in which WebKit exploits against Safari have played a key role.
taligent 15y ago
Wow. So you're not exactly unbiased are you ? At what point were you forced to take on the responsibility for fixing those bugs. It is an open source project and Apple may feel that their best contributions are in adding new features or fixing rendering bugs.
- justinschuh 15y ago
  That's pretty much my point. Apple does actively contribute to WebKit, but they're not very active on the security front. I've gotten a similar feeling when dealing with security reports we've made on proprietary Apple components (core libraries, etc.). Based on those experiences I assume they feel their resources are better invested elsewhere, which is absolutely their prerogative. Of course, that perspective also strikes me as something any potential Apple customer should consider.

Dylan16807 15y ago

I don't understand what the difference is between having java default-installed and installing java on demand. Both methods run a jar when it shows up, right?

pooriaazimi 15y ago
Not for 85% of Mac users. They'll use Mac App Store and Facebook, which are both Java-free.
- chc 15y ago
  In that case, it still doesn't make a difference whether Java is installed or not. Dylan's point is that the only difference between having Java installed by default and having Java installed on first use is launch time the first time you run a Java program.
projct 15y ago
Default installed means there's a java web plugin floating around to exploit, for starters.

blub 15y ago

They have? This is like making a house burglar-proof by bricking the doors. You just cut a small hole when you want to get out... and why would you want to get out, it's so nice inside!

reirob 15y ago

Well according to the article the did not. Here the quote: "The bug was patched by Oracle in February, but Apple didn’t fix the flaw until earlier this month. “Their response should have been much earlier when they should have updated their Java,” says Sharov"