Slashdot Mirror
A Little .Mac Security Flaw
deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."
Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.
Free means no restrictions, ironic the FSF's GPL forces restrictions, isn't it? What's your definition of free?
I love how this is a "little", "minor" security flaw, and even though Apple actively deleted the post exposing this information nobody's really up in arms as it's just due to "bad interface design". If this were a Microsoft property, people would be screaming bloody murder.
I am an new Apple user. And reasonably happy.
However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.
Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.
You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.
Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.
Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.
It's not a question of if, but when. Will Apple be prepared? So far, all signs point to "NO".
PS... the CAPTCHA word for this post was "condom".. how appropriate considering the whole point is to have a good profolactic. A good metaphore for Apple's current approach to security.
Yet another incident where Apple blatantly ignores the customers they claim to value so much...and they will likely continue to do so until there's such a shitstorm about this that they have no choice but to respond. Apple used to be a good company...ten years ago. Now they're just as bad (if not worse, in many regards) as every other IT giant out there. Sad.
I'm a geek girl. Seriously.
It sounds neat but mom isn't going to use it. My way to do the same thing is just to ssh to my desktop at work and do whatever. So, I wouldn't use something like iDisk. It is also neat that you can share large files with your buddies. otoh, people can share movies online without iDisk.
So, my question is, how many people actually use iDisk? How much of a problem is this actually.
Seems to me that if you're concerned about security, you should think very carefully about using a public terminal.
Why yes, I AM a rocket scientist!
Of course its a toss up if an average user would use a log off button
That's why all bank sites I know log you out if you are inactive for a while. Seems like a good idea.
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
Huh? You seem to have conflated their corporate policy, which is sometimes very stupid, with their security policy, which is generally good. The two have nothing to do with each other. Apple's overzealous moderation of their own forums is well known, and unfortunate. But it has nothing to do with how well they manage their OS security and how well they respond to exploits.
You are very mistaken, this incident does prove that Apple's security policies and responses are indeed lacking. Don't get fixated on the deletion of a post, consider that they did not respond by adding a logout option to a *web* interface.
Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Nor is it a user interface problem; by using session cookies closing the browser would logout the user, with or without a logout button.
The site listed (but not linked) in the summary doesn't describe the issue as minor, or a UI problem, so one can only assume that description comes from the summary author.
Slashdot has a "public" option. If you click that when you log in, your login state is only stored for the session and freed when you close the browser.
Many other sites also implement a "public" mode like Slashdot has. Just as two other examples, Microsoft's Outlook Web Access (OWA) lets you choose "public" or "private" when you login, and Microsoft's Passport/Windows Live ID gives you the option to save email + password, just email, or nothing (the latter two are effectively session-only logins, as you still need the user's password in order to login subsequently). As well, every other site also has the ability to logout, which .Mac is missing.
A "decent timeout" is trivially simple -- mark your cookie only valid for the current session (aka, use a "session cookie"). This is at odds with persistent login designs, so you have to give users the option -- login with a session cookie ("public terminal") that will expire when you close the browser, or login with a persistent cookie ("private terminal") that will remain valid for some period of time. If you only choose the latter, like .Mac, you must also provide a "logout" option. Anything less is a security violation.
The whole problem is that they're not concerned about security. Most security measures are because users aren't concerned about security. They get really concerned when they find out someone's taken all their stuff, but that's a different subject.
Anyway, as computer nerds, we're supposed to be concerned about computer security. Most people aren't. They have their own concerns. I'm glad that they're around to look after other things, so I don't have to be concerned about my bank running out of money, or my medication not being poisoned, or my car falling apart while I drive it, or all those nice other things that could be a really big problem if there weren't people making sure we were safe.
Anyway, a good computer security example is antivirus software. I stay the hell away from the stuff, it's slow and buggy and bogs down my system more than most viruses do. On linux, it's not an issue since security issues there are better handled by better configuration and monitoring, and on my windows box I just use manual system/network diagnostic tools to keep an eye on it and fix whatever's needed.
Does that mean I recommend the same to my friends? Hell no! I make sure they always run both a good antivirus and a firewall at all times. Otherwise they get viruses constantly. They just don't have the background to understand what they should and shouldn't do to avoid the things, not to mention the lack of skill necessary to deal with viruses as they come.
My friends aren't stupid (most of them anyway), it's just not what they do. They use computers as tools to get things done, and if they're not making it safe and easy to do the work they want, then the computers aren't working right. That's just how it is, and that's why services that allow people to use public terminals need to be built from the ground up to make it secure to use a public terminal.
You'd think Apple of all people (er, companies) would understand the need to make the right interface for different kinds of applications. Well, maybe I'm thinking back to the Eighties, way before their brushed metal/colorful candy era. If I had my way, they'd have canonized Raskin by now.
[insert witty quote here]
All of that is true. But Apple has this whole "I'm a Mac" ad campaign that touts the ease of use of Macs for the average joe out there, but then does something like this where you need to know fairly deeply what's going on internally to keep yourself safe. To the typical user, if it's not on-screen, it's gone. They understand "log out," but won't understand that there are still scrids of their session left on a public computer even if the browser is closed.
Moreover, look at even the phrasing of the examples you give. Firefox is "clear private data" -- pretty straightforward, and you know what you're doing. "Reset Safari" is pretty cryptic by comparison -- it's fewer words (something Apple strives for, often rightly so), but it's far less descriptive of what's going on. Kind of a semantic version of the one-button mouse -- interestingly simple in theory, but it falls apart in practice.
But all of that phrasing business is almost beside the point -- what average MyMom user at a library computer is going to know to clear the browser's history and cache to log out of iDisk? One doesn't seem to have to do with the other. In this case, there simply needs to be a button to log out. I'm sure the Apple interface designers shudder at the thought of the added clutter, but so be it.
It is pitch black. You are likely to be eaten by a grue.
...chuckling not only at the security issues that are popping up, but at Apple's reaction to all of them.I've been working in the security industry for years. I've submitted bugs to Apple, MS, and various Linux and BSD projects. Apple's reaction to such submissions has been better than average. For the most part, they seem to acknowledge security related bugs and fix them before they are exploited, including providing credit to the bug reporter. I guess what I'm saying is, if you're judging "Apple's" response to security related bugs, maybe looking at how they handle problems reported to them through their publicly accessible bug reporting system is a better measuring stick, than looking at how they handle posts in forums. Not that I approve of censoring their forums, it just doesn't seem to be an important aspect of how they respond with regard to security. Not to sound like an Apple fan or anything, but I've frankly been impressed by Apple's quick turnaround on serious bugs.
That's precisely what you're saying, otherwise Apple should just pay it's security team to be the forum administrators so that nothing is missed. You can't tell someone to forward some things and not others without asking them to evaluate the messages to determine which need forwarding. In order to evaluate which need forwarding, you need technical knowledge about what is being discussed.
So because it's a web interface it isn't software? It doesn't require any technical knowledge to evaluate? That doesn't even make any sense. There's no difference between a web interface and a standalone application interface in terms of telling a security issue from someone just bitching or being an idiot.
Nor will misrepresenting mine. Triage is one of the most important and time-consuming parts of dealing with bugs and security issues, and if you think Apple's finest programmers are running the first-line triage on the bug database, you're crazy. They have a whole staff with actual technical training and resources available whose sole job it is to do that triage, and basically what you're suggesting is that every single Apple employee should be trained in those skills and have those resources, or that the triage team should take over every form of communication "just in case".
Because unless every Apple employee from the janitor to the shipping clerk knows as much as the triage team, they DON'T have the skills necessary to know what does and doesn't need to be reported to the triage team (hi, I'm a catch-22, nice to meet you!).
Recursive: Adj. See Recursive.