12 ms·

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this w

by e1ven 13y ago

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. It seems like this primarily affects people connecting to untrustworthy access-points, such as Coffee Shops, or Airport Wifi - While that's certainly something that needs to be fixed, it seems far less crucial than remote-code-execution [1], or many other bugs we see regularly. I'm sure I'm missing something here, can someone help me understand? Is it just the "Ick" factor of having something you thought was encrypted actually being fairly open? I don't understand why this is getting more attention that other (seemingly) more dangerous exploits. [1] - http://msisac.cisecurity.org/advisories/2013/2013-088.cfm http://msisac.cisecurity.org/advisories/2013/2013-088.cfm

HowardJ 13y ago
Your response is typical of security advisories concerning Apple. Don't downplay the situation just because it's Apple.
joshdulac 13y ago
Think "outside the box" of the US. Not all Mac users have "trustworthy" ISPs or are on trusted networks.
ambrop7 13y ago
It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses the private key it claims to posses. > it seems far less crucial than remote-code-execution > I don't understand why this is getting more attention that other (seemingly) more dangerous exploits. Because it's the foundation for a heap of applications and services that were believed to be secure due to use of SSL. If you consider those, this is worse than any bug in any application. It's not just one application with a critical vulnerability - effectively, it's half (or whatmany) of all OSX and iOS apps with a critical vulnerability. All you need to do is go browse the net in a coffee shop, and some stranger can easily do things like: - Pwn your box (MITM the auto update). Actually with this he can do all of the latter too. - Steal your money (MITM your bank connection). - Steam your online accounts, including email. It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. > That's certainly a problem, but most people are using trustworthy ISPs Your argument seems to be that it's not a big issue if the security is totally broke since we don't need security in the first place.
- ctolsen 13y ago
  It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.
  - joeblau 13y ago
    Facetime Audio on Mac! Heck yes, finally.
  - mrmondo 13y ago
    While this is too long IMO, Similarly critical bugs in windows have been left unfixed for years.
    - ctolsen 13y ago
      While that may have been true, I dare say that the burnt child that is today's Microsoft would not have mishandled this so horribly.
  - silencio 13y ago
    Have you seen the content of the security update? It doesn't really excuse the 4 days between iOS and OS X updates, but it's a hell of a lot more than FaceTime updates. http://support.apple.com/kb/HT6150 http://support.apple.com/kb/HT6150
  - renaudg 13y ago
    10.9.2 has been in beta for weeks and was evidently just about to be released. It made a lot of sense from a QA perspective to do it just the way they did.
    - magicalist 13y ago
      I'm fully on board with the "bugs happen" point of view, but if they really have had this particular fix in the pipeline for weeks, then no, they really really should have done an out of band update of a much smaller scope.
kryptiskt 13y ago
> That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. But if you are tricked to go to bankofamericaa.com instead of bankofamerica.com, a crook can be the proxy between you and your bank and you are none the wiser.
- saurik 13y ago
  This is true with or without this bug.
  - lawnchair_larry 13y ago
    The difference is this bug will grant you the lock icon, and your browser will "guarantee" you're speaking to the real bankofamerica. Practically speaking, that probably doesn't matter, because someone who understands that won't click on an email and log in to bankofamericaa.com. But there is a difference.
    - saurik 13y ago
      It is very easy to get a lock icon on bankofamericaa.com and to get your browser to insist you are speaking to the real bankofamericaa. What makes this bug interesting is you can get a lock icon for a fake website on bankofamerica.com using a MITM attack: making convincing "secure" websites on alternative URLs has always been possible.
  - ctolsen 13y ago
    Without this bug, they wouldn't be able to use BofA's own certificate to do it.
    - saurik 13y ago
      Why does this matter? The browser isn't even at bankofamerica.com, it is at bankofamericaa.com: it "adds insult to injury", but it doesn't affect the attack. No browser would notice, even with the fanciest watchdog services and certificate pinning, that the certificate of an unrelated website is "authentic" or not. The only way you are going to notice the name being wrong is if the user opens the certificate details dialog and reads the content; do you seriously think someone is going to do this and not look at the URL ;P? What this bug makes possible are not the age-old "wrong URL" attack, but an active MITM on the real URL.
pera 13y ago
Coffe Shops, Airports, your insecure home wlan, your office, GSM networks... actually, do you use tls at all or you just go plain text because you're using a "trustworthy ISP"?
- untog 13y ago
  This seems like the key to me. Seems naive to think that your trusted ISP is the only person you'll ever get internet access through.
  - danudey 13y ago
    Seems naive to think that your ISP can be trusted, since they can be compelled by law and sworn to secrecy.
pktgen 13y ago
> Comcast seems unlikely to try to steal your bank password I don't know about that. Comcast doesn't seem to have any problem robbing its customers right now.
gopalv 13y ago
It's about the false sense of security. And that betrayed sense, which invokes a hint of paranoia - that bug looks too obvious to have been skipped in QA.
lawnchair_larry 13y ago
You're not necessarily totally off-base, but potential attackers include far more than who you think operates your first hop.
corresation 13y ago
If you trust every network hop, are sure that you are never impacted by aberrant if not even malicious routes, never touched by DNS spoofing....SSL becomes irrelevant, doesn't it?
lfuller 13y ago
I believe that the recent NSA revelations are the primary reason this bug is so concerning. We already know that the US government has access to the majority of packets being routed across the US, and this bug makes it trivial to decrypt those originating from Apple devices.
zorked 13y ago
This got famous because: - It really is a severe bug in a major platform (and by that I mean iOS not MacOS) - It is easy to understand once spotted, so everybody who can read code in the entire planet can write about how stupid Apple is because they refuse to see the light and switch over to their favorite pet language/coding standard/methodology - The NSA has massive MITM capabilities and is known to sabotage American products and this looks like a very, very convenient bug to have for them, leading to speculation that this could not be a mistake - Apple haters.
ne0codex 13y ago
Apple hating seems to be the new trend and I see it as the main reason for thus much attention. That, and also for the fact that if Steve Jobs were still around, he'd be able to sweep this up or else be able to assuage the public about the 1 extra line of goto fail; I think that in the post-Jobs future, we'll see more and more "revelations" about bugs/issues within Apple/iOS/OS X with people aggressively posting as much info as possible to "stick it to Apple"
zaroth 13y ago
Easy to understand definitely drives the reporting. Compare the reporting of this to the Chrome vulnerability in TLS patched yesterday... https://news.ycombinator.com/item?id=7295785 https://news.ycombinator.com/item?id=7295785
- cbsmith 13y ago
  That's actually a quite easy to understand problem as well. The difference is pretty major. It's believable that someone forgot to consider the case where a new certificate was negotiated. It's downright inconceivable that no one tested whether a bad certificate failed validation. That's like selling a pregnancy test without testing what happens if the person isn't pregnant.
brudgers 13y ago
"Forgive me, but I'm not really sure why this is getting so much attention." Because because the level of professional incompetence it exhibits in a world where people think using iPods as part of an airline's essential safety process is a fucking whizzing of an idea. It makes the first order problem of using iPods to transmit confidential medical records feel rather trivial. Yet there is nothing for which you need ask forgiveness. A model of the world where everyone lives in circumstances where either Comcast or Verizon is always available for one's internet connection [and it goes without saying that neither could possibly be compromised] is so absurd that you can only be speaking tongue in cheek Well played.
Shish2k 13y ago
> most people are using trustworthy ISPs Have you not seen the news, at all, for the past several months? There have been a few revalations that perhaps some ISPs are not entirely trustworthy, to say the least...
cbsmith 13y ago
> That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. You got it! Really when you think about it, why do we even bother with crypto on the Internet in the first place? It's not like your data is traveling over a series of networks and nodes with different owners/operators that you don't even know and certainly haven't vetted for trustworthiness. That'd be crazy.

by e1ven 13y ago

HowardJ 13y ago

Your response is typical of security advisories concerning Apple. Don't downplay the situation just because it's Apple.

joshdulac 13y ago

Think "outside the box" of the US. Not all Mac users have "trustworthy" ISPs or are on trusted networks.

ambrop7 13y ago

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses the private key it claims to posses. > it seems far less crucial than remote-code-execution > I don't understand why this is getting more attention that other (seemingly) more dangerous exploits. Because it's the foundation for a heap of applications and services that were believed to be secure due to use of SSL. If you consider those, this is worse than any bug in any application. It's not just one application with a critical vulnerability - effectively, it's half (or whatmany) of all OSX and iOS apps with a critical vulnerability. All you need to do is go browse the net in a coffee shop, and some stranger can easily do things like: - Pwn your box (MITM the auto update). Actually with this he can do all of the latter too. - Steal your money (MITM your bank connection). - Steam your online accounts, including email. It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. > That's certainly a problem, but most people are using trustworthy ISPs Your argument seems to be that it's not a big issue if the security is totally broke since we don't need security in the first place.

ctolsen 13y ago
It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.
- joeblau 13y ago
  Facetime Audio on Mac! Heck yes, finally.
- mrmondo 13y ago
  While this is too long IMO, Similarly critical bugs in windows have been left unfixed for years.
  - ctolsen 13y ago
    While that may have been true, I dare say that the burnt child that is today's Microsoft would not have mishandled this so horribly.
- silencio 13y ago
  Have you seen the content of the security update? It doesn't really excuse the 4 days between iOS and OS X updates, but it's a hell of a lot more than FaceTime updates. http://support.apple.com/kb/HT6150 http://support.apple.com/kb/HT6150
- renaudg 13y ago
  10.9.2 has been in beta for weeks and was evidently just about to be released. It made a lot of sense from a QA perspective to do it just the way they did.
  - magicalist 13y ago
    I'm fully on board with the "bugs happen" point of view, but if they really have had this particular fix in the pipeline for weeks, then no, they really really should have done an out of band update of a much smaller scope.

kryptiskt 13y ago

> That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. But if you are tricked to go to bankofamericaa.com instead of bankofamerica.com, a crook can be the proxy between you and your bank and you are none the wiser.

saurik 13y ago
This is true with or without this bug.
- lawnchair_larry 13y ago
  The difference is this bug will grant you the lock icon, and your browser will "guarantee" you're speaking to the real bankofamerica. Practically speaking, that probably doesn't matter, because someone who understands that won't click on an email and log in to bankofamericaa.com. But there is a difference.
  - saurik 13y ago
    It is very easy to get a lock icon on bankofamericaa.com and to get your browser to insist you are speaking to the real bankofamericaa. What makes this bug interesting is you can get a lock icon for a fake website on bankofamerica.com using a MITM attack: making convincing "secure" websites on alternative URLs has always been possible.
- ctolsen 13y ago
  Without this bug, they wouldn't be able to use BofA's own certificate to do it.
  - saurik 13y ago
    Why does this matter? The browser isn't even at bankofamerica.com, it is at bankofamericaa.com: it "adds insult to injury", but it doesn't affect the attack. No browser would notice, even with the fanciest watchdog services and certificate pinning, that the certificate of an unrelated website is "authentic" or not. The only way you are going to notice the name being wrong is if the user opens the certificate details dialog and reads the content; do you seriously think someone is going to do this and not look at the URL ;P? What this bug makes possible are not the age-old "wrong URL" attack, but an active MITM on the real URL.

pera 13y ago

Coffe Shops, Airports, your insecure home wlan, your office, GSM networks... actually, do you use tls at all or you just go plain text because you're using a "trustworthy ISP"?

untog 13y ago
This seems like the key to me. Seems naive to think that your trusted ISP is the only person you'll ever get internet access through.
- danudey 13y ago
  Seems naive to think that your ISP can be trusted, since they can be compelled by law and sworn to secrecy.

pktgen 13y ago

> Comcast seems unlikely to try to steal your bank password I don't know about that. Comcast doesn't seem to have any problem robbing its customers right now.

gopalv 13y ago

It's about the false sense of security. And that betrayed sense, which invokes a hint of paranoia - that bug looks too obvious to have been skipped in QA.

lawnchair_larry 13y ago

You're not necessarily totally off-base, but potential attackers include far more than who you think operates your first hop.

corresation 13y ago

If you trust every network hop, are sure that you are never impacted by aberrant if not even malicious routes, never touched by DNS spoofing....SSL becomes irrelevant, doesn't it?

lfuller 13y ago

I believe that the recent NSA revelations are the primary reason this bug is so concerning. We already know that the US government has access to the majority of packets being routed across the US, and this bug makes it trivial to decrypt those originating from Apple devices.

zorked 13y ago

This got famous because: - It really is a severe bug in a major platform (and by that I mean iOS not MacOS) - It is easy to understand once spotted, so everybody who can read code in the entire planet can write about how stupid Apple is because they refuse to see the light and switch over to their favorite pet language/coding standard/methodology - The NSA has massive MITM capabilities and is known to sabotage American products and this looks like a very, very convenient bug to have for them, leading to speculation that this could not be a mistake - Apple haters.

ne0codex 13y ago

Apple hating seems to be the new trend and I see it as the main reason for thus much attention. That, and also for the fact that if Steve Jobs were still around, he'd be able to sweep this up or else be able to assuage the public about the 1 extra line of goto fail; I think that in the post-Jobs future, we'll see more and more "revelations" about bugs/issues within Apple/iOS/OS X with people aggressively posting as much info as possible to "stick it to Apple"

zaroth 13y ago

Easy to understand definitely drives the reporting. Compare the reporting of this to the Chrome vulnerability in TLS patched yesterday... https://news.ycombinator.com/item?id=7295785 https://news.ycombinator.com/item?id=7295785

cbsmith 13y ago
That's actually a quite easy to understand problem as well. The difference is pretty major. It's believable that someone forgot to consider the case where a new certificate was negotiated. It's downright inconceivable that no one tested whether a bad certificate failed validation. That's like selling a pregnancy test without testing what happens if the person isn't pregnant.

brudgers 13y ago

"Forgive me, but I'm not really sure why this is getting so much attention." Because because the level of professional incompetence it exhibits in a world where people think using iPods as part of an airline's essential safety process is a fucking whizzing of an idea. It makes the first order problem of using iPods to transmit confidential medical records feel rather trivial. Yet there is nothing for which you need ask forgiveness. A model of the world where everyone lives in circumstances where either Comcast or Verizon is always available for one's internet connection [and it goes without saying that neither could possibly be compromised] is so absurd that you can only be speaking tongue in cheek Well played.

Shish2k 13y ago

> most people are using trustworthy ISPs Have you not seen the news, at all, for the past several months? There have been a few revalations that perhaps some ISPs are not entirely trustworthy, to say the least...

cbsmith 13y ago

> That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. You got it! Really when you think about it, why do we even bother with crypto on the Internet in the first place? It's not like your data is traveling over a series of networks and nodes with different owners/operators that you don't even know and certainly haven't vetted for trustworthiness. That'd be crazy.