5 ms·

I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatb

I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call. And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.

dguido 15y ago
Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.
- justinschuh 15y ago
  I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).
  - dguido 15y ago
    Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. http://www.trailofbits.com/research/#eip http://www.trailofbits.com/research/#eip Again, show me an actual attack that has exploited Safari. Ever. Targeted, mass malware, I don't care. Apple has better shit to worry about and their investment in Seatbelt was worth 1000x more than individually fixing the limitless supply of bugs in Webkit. Problem solved, move to next actual issue.
    - justinschuh 15y ago
      You can scope the discussion to mass malware on desktop Safari, but that's just reductio ad absurdum. Any fortune 500 or government has to be concerned with real attacks, not just tamping down the noise floor. And as for Apple, they've historically been more interested in protecting their manufacturer subsidy by stopping iPhone jailbreaks--in which WebKit exploits against Safari have played a key role.
taligent 15y ago
Wow. So you're not exactly unbiased are you ? At what point were you forced to take on the responsibility for fixing those bugs. It is an open source project and Apple may feel that their best contributions are in adding new features or fixing rendering bugs.
- justinschuh 15y ago
  That's pretty much my point. Apple does actively contribute to WebKit, but they're not very active on the security front. I've gotten a similar feeling when dealing with security reports we've made on proprietary Apple components (core libraries, etc.). Based on those experiences I assume they feel their resources are better invested elsewhere, which is absolutely their prerogative. Of course, that perspective also strikes me as something any potential Apple customer should consider.

dguido 15y ago

Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.

justinschuh 15y ago
I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).
- dguido 15y ago
  Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. http://www.trailofbits.com/research/#eip http://www.trailofbits.com/research/#eip Again, show me an actual attack that has exploited Safari. Ever. Targeted, mass malware, I don't care. Apple has better shit to worry about and their investment in Seatbelt was worth 1000x more than individually fixing the limitless supply of bugs in Webkit. Problem solved, move to next actual issue.
  - justinschuh 15y ago
    You can scope the discussion to mass malware on desktop Safari, but that's just reductio ad absurdum. Any fortune 500 or government has to be concerned with real attacks, not just tamping down the noise floor. And as for Apple, they've historically been more interested in protecting their manufacturer subsidy by stopping iPhone jailbreaks--in which WebKit exploits against Safari have played a key role.

taligent 15y ago

Wow. So you're not exactly unbiased are you ? At what point were you forced to take on the responsibility for fixing those bugs. It is an open source project and Apple may feel that their best contributions are in adding new features or fixing rendering bugs.

justinschuh 15y ago
That's pretty much my point. Apple does actively contribute to WebKit, but they're not very active on the security front. I've gotten a similar feeling when dealing with security reports we've made on proprietary Apple components (core libraries, etc.). Based on those experiences I assume they feel their resources are better invested elsewhere, which is absolutely their prerogative. Of course, that perspective also strikes me as something any potential Apple customer should consider.