5 ms·

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 month

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

dotpot 11y ago
exactly....
coldtea 11y ago
>"and are doing NOTHING" Citation needed. An article (and on the Register at that) is not any indication that "they're doing nothing"...
- mcintyre1994 11y ago
  They do make the claim in the paper: > We reported this vulnerability to Apple on Oct. 15, 2014, and communicated with them again in November, 2014 and early 2015. They informed us that given the nature of the problem, they need 6 months to fix it. However, doing nothing seems to be unfair: > We checked the most recent OS X 10.10.3 and beta version 10.10.4 and found that they attempted to address the iCloud issue using a 9-digit random number as accountName. However, the accountName attribute for other services, e.g. Gmail, are still the user’s email address. Most importantly, such protection, based upon a secret attribute name, does not work when the attacker reads the attribute names of an existing item and then deletes it to create a clone under its control, a new problem we discovered after the first keychain vulnerability report and are helping Apple fix it. So not nothing, but their iCloud 'fix' doesn't work and there's no fix for the real issues. But the researchers say they're helping Apple fix it, so nothing does seem unfair.
webdevsimon 11y ago
How do you know they was aware if they didn't "not even communicating"?
- Oletros 11y ago
  According to the article, they were aware
  - huxley 11y ago
    This doesn't seem like something a quick patch can fix. The section of the paper on mitigation suggests that it is non-trivial to correct without significantly re-architecting the app-OS relationship, if the paper is accurate, Apple is in a very difficult situation.
    - Oletros 11y ago
      Yap, but the OP was saying that perhaps Apple was not aeare of the vulnerability but the article stated that they the authors had communications wiht Apple about it. It seems that stating just a fact from the article is not liked by some
lgrebe 11y ago
FTA: "Apple security officers responded in emails seen by El Reg expressing understanding for the gravity of the attacks and asking for a six month extension and in February requesting an advanced copy of the research paper before it was made public."
skrowl 11y ago
I'm surprised that you're surprised! After The Fappening and the SMS of doom (amongst many others), you can't still believe that Apple gives a sh*t about security, can you? I mean, I understand that there are still a lot of Apple fans here at HN, but Apple's security has been a laughing stock of the industry for a while now.
- frankzinger 11y ago
  Don't forget 'goto fail'.
- soylentcola 11y ago
  I'm far from an Apple apologist (I probably complain about them more than I praise them) but "failing to be flawless" about security is not the same thing as "not giving a shit" about security. I've yet to see any massive platform that is both flexible and open to millions of users that has zero security flaws or exploits developed for them. Not saying it's a good thing, but it's certainly a common thing, even among companies that give several shits about security.
  - layman 11y ago
    There is a difference between "has zero security flaws" and "not fixing a security flaw for 6 months after being made aware"
userbinator 11y ago
It's not remotely exploitable --- it requires installing a malicious app; that makes it far less severe than something that could be done through e.g. just visiting a webpage.
- DennisP 11y ago
  Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.
  - mmcconnell1618 11y ago
    Good thing there are 1,500,000 apps in the store and getting visibility is the biggest challenge for developers/publishers :-)
    - DennisP 11y ago
      There are lots of web pages too, but an exploit that works when you visit a web page is still a pretty big deal.
    - nadams 11y ago
      "MoneyMakingApp5000 - make money from home" Post some screenshots of the app with screenshots of some random Paypal transfers and I don't think that you will have a problem getting people to find/download your app.
      - webjprgm 11y ago
        Downloading and running it once would set up the exploit but not complete it, IIRC. You need to go back to the target app and re-enter credentials then run the exploit app a second time. So a broken app that a user would run once and then delete is no good. A standard Trojan game/utility would work fine even if only a small number of people run it.
    - untog 11y ago
      Ah yes, security by obscurity, everyone's favourite.
yAnonymous 11y ago
Apple's stance on security is "fix it when there's an exploit" rather than "fix it when it's broken".
madaxe_again 11y ago
According to the paper they haven't done nothing, they cranked out a half-assed fix for the keychain issue specifically for iCloud. So as good as nothing, but not nothing.

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

dotpot 11y ago

exactly....

coldtea 11y ago

>"and are doing NOTHING" Citation needed. An article (and on the Register at that) is not any indication that "they're doing nothing"...

mcintyre1994 11y ago
They do make the claim in the paper: > We reported this vulnerability to Apple on Oct. 15, 2014, and communicated with them again in November, 2014 and early 2015. They informed us that given the nature of the problem, they need 6 months to fix it. However, doing nothing seems to be unfair: > We checked the most recent OS X 10.10.3 and beta version 10.10.4 and found that they attempted to address the iCloud issue using a 9-digit random number as accountName. However, the accountName attribute for other services, e.g. Gmail, are still the user’s email address. Most importantly, such protection, based upon a secret attribute name, does not work when the attacker reads the attribute names of an existing item and then deletes it to create a clone under its control, a new problem we discovered after the first keychain vulnerability report and are helping Apple fix it. So not nothing, but their iCloud 'fix' doesn't work and there's no fix for the real issues. But the researchers say they're helping Apple fix it, so nothing does seem unfair.

webdevsimon 11y ago

How do you know they was aware if they didn't "not even communicating"?

Oletros 11y ago
According to the article, they were aware
- huxley 11y ago
  This doesn't seem like something a quick patch can fix. The section of the paper on mitigation suggests that it is non-trivial to correct without significantly re-architecting the app-OS relationship, if the paper is accurate, Apple is in a very difficult situation.
  - Oletros 11y ago
    Yap, but the OP was saying that perhaps Apple was not aeare of the vulnerability but the article stated that they the authors had communications wiht Apple about it. It seems that stating just a fact from the article is not liked by some

lgrebe 11y ago

FTA: "Apple security officers responded in emails seen by El Reg expressing understanding for the gravity of the attacks and asking for a six month extension and in February requesting an advanced copy of the research paper before it was made public."

skrowl 11y ago

I'm surprised that you're surprised! After The Fappening and the SMS of doom (amongst many others), you can't still believe that Apple gives a sh*t about security, can you? I mean, I understand that there are still a lot of Apple fans here at HN, but Apple's security has been a laughing stock of the industry for a while now.

frankzinger 11y ago
Don't forget 'goto fail'.
soylentcola 11y ago
I'm far from an Apple apologist (I probably complain about them more than I praise them) but "failing to be flawless" about security is not the same thing as "not giving a shit" about security. I've yet to see any massive platform that is both flexible and open to millions of users that has zero security flaws or exploits developed for them. Not saying it's a good thing, but it's certainly a common thing, even among companies that give several shits about security.
- layman 11y ago
  There is a difference between "has zero security flaws" and "not fixing a security flaw for 6 months after being made aware"

userbinator 11y ago

It's not remotely exploitable --- it requires installing a malicious app; that makes it far less severe than something that could be done through e.g. just visiting a webpage.

DennisP 11y ago
Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.
- mmcconnell1618 11y ago
  Good thing there are 1,500,000 apps in the store and getting visibility is the biggest challenge for developers/publishers :-)
  - DennisP 11y ago
    There are lots of web pages too, but an exploit that works when you visit a web page is still a pretty big deal.
  - nadams 11y ago
    "MoneyMakingApp5000 - make money from home" Post some screenshots of the app with screenshots of some random Paypal transfers and I don't think that you will have a problem getting people to find/download your app.
    - webjprgm 11y ago
      Downloading and running it once would set up the exploit but not complete it, IIRC. You need to go back to the target app and re-enter credentials then run the exploit app a second time. So a broken app that a user would run once and then delete is no good. A standard Trojan game/utility would work fine even if only a small number of people run it.
  - untog 11y ago
    Ah yes, security by obscurity, everyone's favourite.

yAnonymous 11y ago

Apple's stance on security is "fix it when there's an exploit" rather than "fix it when it's broken".

madaxe_again 11y ago

According to the paper they haven't done nothing, they cranked out a half-assed fix for the keychain issue specifically for iCloud. So as good as nothing, but not nothing.