6 ms·

Apple provides credit to people who have reported security issues

77 points by k-mcgrady 13y ago

k-mcgrady 13y ago
>> "An information disclosure issue was addressed. We would like to acknowledge Ibrahim BALIC (Balich IT - www.balicbilisim.com) for reporting this issue. This was the guy who posted the YouTube video claiming he found the flaw that forced Apple to take the developer center down for one week.
burgeralarm 13y ago
The acknowledgement appears to be gone now, unless I'm missing something.
- martin_ 13y ago
  No, it's still there. 2013-07-22 iadworkbench.apple.com An information disclosure issue was addressed. We would like to acknowledge Ibrahim BALIC (Balich IT - www.balicbilisim.com) for reporting this issue.
  - burgeralarm 13y ago
    Odd, must have been some caching thing. Changing the language caused it to show up.
    - curveship 13y ago
      The message apparently is and isn't there. If I go to http://support.apple.com/kb/HT1318 http://support.apple.com/kb/HT1318 , it's not shown. But if I go to http://support.apple.com/kb/HT1318?viewlocale=en_US http://support.apple.com/kb/HT1318?viewlocale=en_US , then it (and several other recent updates) are shown. Cache/translation/backlog issue?
martin_ 13y ago
I think what's more relevant here is that there were two remote code execution vulnerabilities found which were responsible for the dev center being taken down. So it wasn't a result of Ibrahim Balic's "information disclosure issue"
smackfu 13y ago
It still amazes me that Apple responded to a responsible disclosure of an exploit by taking their system down for weeks. Can you imagine someone like Facebook or Amazon having to do that?
- numbsafari 13y ago
  If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data, why would you do anything other than take it down until you have fully restored your confidence in the system? What difference does it make if the disclosure was responsible or not? If Facebook's billing platform for advertisers was compromised in some fashion, do you think they'd wait even a minute to take it off-line until they situation was under control?
  - smackfu 13y ago
    >What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.
    - numbsafari 13y ago
      So if someone gives you steps to reproduce you leave the system on-line?
      - smackfu 13y ago
        Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
        13y ago
Apocryphon 13y ago
It's interesting how the names of all of the security specialists and other discoverers of flaws in this list appear to be non-Anglo-American in origin. Very international.
- michael_h 13y ago
  ? Of course, you can tell nothing at all from a name.
- bdcravens 13y ago
  There's 6 Billion people. About 300 Million or so in the US. Ignoring the fact that there's not all countries are fully developed, if only 1 out of 20 were "Anglo-American", it'd be about right. Looking through the list, there's plenty of Anglo-American sounding names, and the percentages seem about right: David Bloom, Will Drewry, Christian Matthies, Jeremy Richards, Joshua Long Also, while it may be less true in some "Anglo" nations, there's millions upon millions of "international" sounding names in the US. In Houston, there's tons of hispanic sounding names (and despite what some might say, plenty of them aren't illegal, but from families where they've been here for generations). Go up north, plenty of Germanic names. (My ex's maiden name was Krausert, and she was very American). Tons of other examples.
- asveikau 13y ago
  It might also be "interesting" to you the number of monolingual people born and raised in the US who have "non-Anglo-American" origins. It always puzzles me to see statements like this... Maybe I'm biased by the fact that I am American but don't have a western european surname and a good number of Americans I interact with do not either. In what part of the country does it seem remarkable for someone to have a "non-Anglo-American" name?
  - jlgreco 13y ago
    I would say that nowhere in America would a "non-Anglo-American" surname be remarkable. In some areas the distribution of "non-Anglo-American" names and "Anglo-American" names may be considered remarkable though. Basically, I think he is seeing a trend that he finds interesting, which is a different than finding a particular instance interesting. Put it this way, if I ran into somebody named "Lutz", I wouldn't think anything of it. If I ran across many people with Germanic names though, I might wonder if I were in somewhere like south-central PA (an area notable for a large number of German descendants: http://en.wikipedia.org/wiki/Pennsylvania_Dutch http://en.wikipedia.org/wiki/Pennsylvania_Dutch). The distribution would catch my eye, not the particular name itself. (Personally, I'm not really seeing any interesting trends with those names.)
davea37 13y ago
> Apple acknowledges Ibrahim Balic for discovering security flaw in dev center This title is inaccurate - the linked pages credits 7dscan.com and SCANV for reporting the developer centre issue. Ibrahim BALIC is credited with reporting an apparently unrelated issue in iAd Workbench.
- k-mcgrady 13y ago
  You're right I thought it was the time stamp below that applied not the one above.
- theboywho 13y ago
  Yup, the title is flawed and is obviously a failed attempt at making it seem somehow related to the recent FB security team issue.
mason240 13y ago
Is this the same issue that was discussed on the This Week in Tech podcast about a month ago?
gnu8 13y ago
The only credits I need are the ones on Full-Disclosure.
ryderm 13y ago
> We would like to acknowledge Narendra Bhati (R00t Sh3ll The Untraceable) of Cyber Octet Pvt.Ltd for reporting this issue. hah, some of these are entertaining.

77 points by k-mcgrady 13y ago

>> "An information disclosure issue was addressed. We would like to acknowledge Ibrahim BALIC (Balich IT - www.balicbilisim.com) for reporting this issue. This was the guy who posted the YouTube video claiming he found the flaw that forced Apple to take the developer center down for one week.

burgeralarm 13y ago

The acknowledgement appears to be gone now, unless I'm missing something.

martin_ 13y ago
No, it's still there. 2013-07-22 iadworkbench.apple.com An information disclosure issue was addressed. We would like to acknowledge Ibrahim BALIC (Balich IT - www.balicbilisim.com) for reporting this issue.
- burgeralarm 13y ago
  Odd, must have been some caching thing. Changing the language caused it to show up.
  - curveship 13y ago
    The message apparently is and isn't there. If I go to http://support.apple.com/kb/HT1318 http://support.apple.com/kb/HT1318 , it's not shown. But if I go to http://support.apple.com/kb/HT1318?viewlocale=en_US http://support.apple.com/kb/HT1318?viewlocale=en_US , then it (and several other recent updates) are shown. Cache/translation/backlog issue?

martin_ 13y ago

I think what's more relevant here is that there were two remote code execution vulnerabilities found which were responsible for the dev center being taken down. So it wasn't a result of Ibrahim Balic's "information disclosure issue"

smackfu 13y ago

It still amazes me that Apple responded to a responsible disclosure of an exploit by taking their system down for weeks. Can you imagine someone like Facebook or Amazon having to do that?

numbsafari 13y ago
If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data, why would you do anything other than take it down until you have fully restored your confidence in the system? What difference does it make if the disclosure was responsible or not? If Facebook's billing platform for advertisers was compromised in some fashion, do you think they'd wait even a minute to take it off-line until they situation was under control?
- smackfu 13y ago
  >What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.
  - numbsafari 13y ago
    So if someone gives you steps to reproduce you leave the system on-line?
    - smackfu 13y ago
      Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
      - 13y ago

Apocryphon 13y ago

It's interesting how the names of all of the security specialists and other discoverers of flaws in this list appear to be non-Anglo-American in origin. Very international.

michael_h 13y ago
? Of course, you can tell nothing at all from a name.
bdcravens 13y ago
There's 6 Billion people. About 300 Million or so in the US. Ignoring the fact that there's not all countries are fully developed, if only 1 out of 20 were "Anglo-American", it'd be about right. Looking through the list, there's plenty of Anglo-American sounding names, and the percentages seem about right: David Bloom, Will Drewry, Christian Matthies, Jeremy Richards, Joshua Long Also, while it may be less true in some "Anglo" nations, there's millions upon millions of "international" sounding names in the US. In Houston, there's tons of hispanic sounding names (and despite what some might say, plenty of them aren't illegal, but from families where they've been here for generations). Go up north, plenty of Germanic names. (My ex's maiden name was Krausert, and she was very American). Tons of other examples.
asveikau 13y ago
It might also be "interesting" to you the number of monolingual people born and raised in the US who have "non-Anglo-American" origins. It always puzzles me to see statements like this... Maybe I'm biased by the fact that I am American but don't have a western european surname and a good number of Americans I interact with do not either. In what part of the country does it seem remarkable for someone to have a "non-Anglo-American" name?
- jlgreco 13y ago
  I would say that nowhere in America would a "non-Anglo-American" surname be remarkable. In some areas the distribution of "non-Anglo-American" names and "Anglo-American" names may be considered remarkable though. Basically, I think he is seeing a trend that he finds interesting, which is a different than finding a particular instance interesting. Put it this way, if I ran into somebody named "Lutz", I wouldn't think anything of it. If I ran across many people with Germanic names though, I might wonder if I were in somewhere like south-central PA (an area notable for a large number of German descendants: http://en.wikipedia.org/wiki/Pennsylvania_Dutch http://en.wikipedia.org/wiki/Pennsylvania_Dutch). The distribution would catch my eye, not the particular name itself. (Personally, I'm not really seeing any interesting trends with those names.)

davea37 13y ago

> Apple acknowledges Ibrahim Balic for discovering security flaw in dev center This title is inaccurate - the linked pages credits 7dscan.com and SCANV for reporting the developer centre issue. Ibrahim BALIC is credited with reporting an apparently unrelated issue in iAd Workbench.

k-mcgrady 13y ago
You're right I thought it was the time stamp below that applied not the one above.
theboywho 13y ago
Yup, the title is flawed and is obviously a failed attempt at making it seem somehow related to the recent FB security team issue.

mason240 13y ago

Is this the same issue that was discussed on the This Week in Tech podcast about a month ago?

gnu8 13y ago

The only credits I need are the ones on Full-Disclosure.

ryderm 13y ago

> We would like to acknowledge Narendra Bhati (R00t Sh3ll The Untraceable) of Cyber Octet Pvt.Ltd for reporting this issue. hah, some of these are entertaining.