5 ms·
Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Fire
by rdl 13y ago
Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre-release Apple stuff, of course.)
Windows or ubuntu bootcamp until they fix this, I think.
- modeless 13y agoMITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.
- atmosx 13y agoIndeed the only secure OS nowadays is Linux. Everything else should be considered compromised by default a priori.
- lotsofmangos 13y agoLinux is only secure if you secure it.
- atmosx 13y agoSure, but at least you have a say there.
- abalone 13y agoIf you need to say something to make it secure then wouldn't it also be compromised by default? Security is not a Boolean. A better question is, which OS is more secure OOTB for a given user.
- lotsofmangos 13y agoFor some users, none of them. Some users, no matter what, demand password as their password.
- matznerd 13y agoDo you know of any good guides?
- eliasmacpherson 13y agoThis seems to be a reasonable starting point: https://www.gov.uk/government/publications/end-user-devices-security-guidance-ubuntu-1204/end-user-devices-security-guidance-ubuntu-1204#satisfy https://www.gov.uk/government/publications/end-user-devices-...
- acdha 13y ago> Indeed the only secure OS nowadays is Linux Tell that to the people who generated keys on Debian. Programmers are simply not good enough at writing secure code. Full stop. If you say anything else, you're just flaunting your own unreliability as a source of security advice.
- hueving 13y agoAt least that was public and fixed. I think the point is that keys could be completely deterministic on closed source systems and there is no way to know. It's very easy to have deterministic "random" sources that pass statistical tests for randomness.
- jey 13y agoNot true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys. (For example, Github lets you push/pull via SSH as git@github.com, and they determine your identity by the SSH key used.)
- hueving 13y agoHow is what I said not true? If the same thing as the Deb prng bug happened in a closed source system, it could sit for a couple of years exposing thousands/millions of systems and then be patched quietly to avoid embarrassment, leaving everyone vulnerable.
- rst 13y agoDon't get too comfortable with linux --- Debian had its own openssl patch fiasco with consequences that were similarly nasty. http://research.swtch.com/openssl http://research.swtch.com/openssl
- ams6110 13y agoEvery OS is compromised a priori. It's just a matter of when the compromises will be discovered. Linux has certainly had its share of flaws.
- Sanddancer 13y agoI think the various BSD folks, especially those from the OpenBSD team, would like to have a word with you. There are many other unixes out there that put a strong, probably even stronger than linux, emphasis on security.
- rdl 13y agoChromeOS is by far the safest thing out of the box, IMO.
- lstamour 13y agoUm, sure, after it updates. Assuming a similar bug isn't found there and exploited when it connects to the Internet. Since, you know, it can't do anything without a network connection. Just playing devils advocate here, I like ChromeOS too.
- Turing_Machine 13y ago"Indeed the only secure OS nowadays is Linux." You're kidding, right? http://www.debian.org/security/ http://www.debian.org/security/ Edit: There were multiple security issues in OpenSSL as recently as January. http://www.debian.org/security/2014/dsa-2833 http://www.debian.org/security/2014/dsa-2833
- sitkack 13y agoWe need to stop using OpenSSL. A new crypto stack coded in a provably secure language is sorely needed.
- kps 13y ago> I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this. 10.7.3 logging FileFault (that was a typo, but I think I'll keep it) passwords in plain text might have been a subtle hint in that direction.
- rdl 13y agoThey've honestly done a pretty great job on iOS security (at least since iPad 2/iPhone 3GS). OSX, not as much.
- brymaster 13y agoDisagree. They can't even keep the lock screen secure. Any major or point release there's been a bypass exploit.
- dippyskoodlez 13y agoAndroid has a flawless record, though. http://www.androidcentral.com/samsung-lock-screen-bypassed-entirely-clever-meticulous-trickery http://www.androidcentral.com/samsung-lock-screen-bypassed-e...
- brymaster 13y agoWho said anything about Android? You might find this article a good read: http://www.theverge.com/2014/1/21/5307992/inside-the-mind-of-a-fanboy http://www.theverge.com/2014/1/21/5307992/inside-the-mind-of...
- nfoz 13y agoHow can you know?
- chmars 13y agoIs there a radar number for that?
- catfoods 13y agoSeriously, what were they thinking? They've announced you can attack ≈40% of OS X machines and then didn't provide a fix. Great.
- d0 13y agoThis. Canned my MacBook Pro over this. It's been a bumpy relationship anyway. Just on Thursday Apple Mail stopped sending mail to my SMTP server. Final straw for me. It's mainly an SSH and RDP terminal anyway. OSX quality and QA is extremely bad.
- coldtea 13y ago>I'm violating NDA by commenting on pre-release Apple stuff, of course. Not that we really care. And you could have gotten the beta off of some torrent or whatever, without ever agreeing to the NDA anyway...
- lisper 13y agoSince the source code is available, might it be possible to produce a hot patch to the binary so that those of us running Mavericks won't have to go through the next few days or weeks with our pants down? It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops. How hard could it be,at least for someone who actually knows their way around OS X binary file formats?
- gsnedders 13y agoLikely the compiler will have optimized away the rest of the function as dead-code, so it's not as simple as just getting rid of the unconditional jump.
- lisper 13y agoAh, right. Good point.
- lunixbochs 13y agoIf the code to Security.framework is complete and builds, we might not need to patch the binary directly.
- lstamour 13y agoIt appears to be in a cursory glance. Loaded for me in Xcode. That said, signing the security framework would be another issue ;-) I can't imagine apple would let malware replace security binaries that easily.
- lunixbochs 13y agoIt's almost buildable for me: https://news.ycombinator.com/item?id=7283601 https://news.ycombinator.com/item?id=7283601 I think it'd break one of the binaries, but I could replace that with the real one.
- 13y ago