A Little .Mac Security Flaw

deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."

Comments

Apple's response?

[PFAK]

Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.

Re:Apple's response?

[mboverload]

> Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.

0H N0ES U DIDNT APPLE IS TEH PERFECT

Re:Apple's response?

[kaos07]

I don't think it's the best way to deal with the problem, but I can see logic in taking down the post. The less people who know about this the better. The only thing a thread would achieve is a) People all going "WTF LULZ APPLE FIX DIS IMMEDIATELY" which would have no effect on Apple's speed in providing a solution, or b) "Wow that's a cool trick, I'm going to try it at my local net cafe" - not something we want.

However Apple, like most corporations, clearly hasn't heard of the "Streisand effect" http://en.wikipedia.org/wiki/Streisand_effect

Slant much?

[Osty]

I love how this is a "little", "minor" security flaw, and even though Apple actively deleted the post exposing this information nobody's really up in arms as it's just due to "bad interface design". If this were a Microsoft property, people would be screaming bloody murder.

Clear private data

[linuxci]

Tools > Clear Private Data in Firefox is the option you need.

Not having a log out button is bad design but many people forget to click them, you need a decent timeout to reduce the risk for those that don't log out.

Does this system keep you logged in (via cookies) if you close the browser and restart it? If so that's a very bad design.

Re:Clear private data

[Osty]

2. Slashdot keeps you logged in if you close the browser and restart it.. is that a bad design?

Slashdot has a "public" option. If you click that when you log in, your login state is only stored for the session and freed when you close the browser.

3. Many other sites do too.. it's called convenience.

Many other sites also implement a "public" mode like Slashdot has. Just as two other examples, Microsoft's Outlook Web Access (OWA) lets you choose "public" or "private" when you login, and Microsoft's Passport/Windows Live ID gives you the option to save email + password, just email, or nothing (the latter two are effectively session-only logins, as you still need the user's password in order to login subsequently). As well, every other site also has the ability to logout, which .Mac is missing.

Otherwise, yes, you're right a decent timeout is a good idea.. but what is "decent"? Sounds pretty subjective.

A "decent timeout" is trivially simple -- mark your cookie only valid for the current session (aka, use a "session cookie"). This is at odds with persistent login designs, so you have to give users the option -- login with a session cookie ("public terminal") that will expire when you close the browser, or login with a persistent cookie ("private terminal") that will remain valid for some period of time. If you only choose the latter, like .Mac, you must also provide a "logout" option. Anything less is a security violation.

Security Through Obscurity

[ookabooka]

podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple.

Ah, well, see, so long as Apple makes sure no knows about this, it won't be a problem. Surly everyone on Slashdot sees the validity of this strategy. (God I love my sig)

Huh?

[Yaztromo]

After accessing your iDisk in Firefox:

• Tools -> Clear Private Data"

In Safari:

• Safari -> Reset Safari

Or if you remember to do so before visiting .Mac's iDisk page:

• Safari -> Private Browsing

Problem solved.

So yes, there are ways for the average user to log-out of their iDisk from a public terminal. They just simply have to use the existing facilities at their disposal.

Yaz.

Re:Huh?

[Shifuimam]

That's great and all, but it doesn't change the fact that (a) any web interface with confidential or private information should have an obvious method of logging out that doesn't require specific knowledge about how to delete cookies for a certain browser/applicationn, and (b) Apple is yet again ignoring and censoring users who are pointing out this flaw.

Re:Huh?

[Moofie]

Seems to me that if you're concerned about security, you should think very carefully about using a public terminal.

Re:Huh?

[admactanium]

That's great and all, but it doesn't change the fact that (a) any web interface with confidential or private information should have an obvious method of logging out that doesn't require specific knowledge about how to delete cookies for a certain browser/applicationn, and (b) Apple is yet again ignoring and censoring users who are pointing out this flaw.

i agree. but fyi, i just did this with my own idisk account. if you quit the browser, then you cannot get back to the idisk interface without a password prompt. there should be a log-out function, but it's not as if it's impossible to end the session.

Re:Huh?

[Knuckles]

Of course its a toss up if an average user would use a log off button

That's why all bank sites I know log you out if you are inactive for a while. Seems like a good idea.

Re:Huh?

[tedrlord]

The whole problem is that they're not concerned about security. Most security measures are because users aren't concerned about security. They get really concerned when they find out someone's taken all their stuff, but that's a different subject.

Anyway, as computer nerds, we're supposed to be concerned about computer security. Most people aren't. They have their own concerns. I'm glad that they're around to look after other things, so I don't have to be concerned about my bank running out of money, or my medication not being poisoned, or my car falling apart while I drive it, or all those nice other things that could be a really big problem if there weren't people making sure we were safe.

Anyway, a good computer security example is antivirus software. I stay the hell away from the stuff, it's slow and buggy and bogs down my system more than most viruses do. On linux, it's not an issue since security issues there are better handled by better configuration and monitoring, and on my windows box I just use manual system/network diagnostic tools to keep an eye on it and fix whatever's needed.

Does that mean I recommend the same to my friends? Hell no! I make sure they always run both a good antivirus and a firewall at all times. Otherwise they get viruses constantly. They just don't have the background to understand what they should and shouldn't do to avoid the things, not to mention the lack of skill necessary to deal with viruses as they come.

My friends aren't stupid (most of them anyway), it's just not what they do. They use computers as tools to get things done, and if they're not making it safe and easy to do the work they want, then the computers aren't working right. That's just how it is, and that's why services that allow people to use public terminals need to be built from the ground up to make it secure to use a public terminal.

You'd think Apple of all people (er, companies) would understand the need to make the right interface for different kinds of applications. Well, maybe I'm thinking back to the Eighties, way before their brushed metal/colorful candy era. If I had my way, they'd have canonized Raskin by now.

Re:Huh?

[eck011219]

All of that is true. But Apple has this whole "I'm a Mac" ad campaign that touts the ease of use of Macs for the average joe out there, but then does something like this where you need to know fairly deeply what's going on internally to keep yourself safe. To the typical user, if it's not on-screen, it's gone. They understand "log out," but won't understand that there are still scrids of their session left on a public computer even if the browser is closed.

Moreover, look at even the phrasing of the examples you give. Firefox is "clear private data" -- pretty straightforward, and you know what you're doing. "Reset Safari" is pretty cryptic by comparison -- it's fewer words (something Apple strives for, often rightly so), but it's far less descriptive of what's going on. Kind of a semantic version of the one-button mouse -- interestingly simple in theory, but it falls apart in practice.

But all of that phrasing business is almost beside the point -- what average MyMom user at a library computer is going to know to clear the browser's history and cache to log out of iDisk? One doesn't seem to have to do with the other. In this case, there simply needs to be a button to log out. I'm sure the Apple interface designers shudder at the thought of the added clutter, but so be it.

another security aspect

[pwizard2]

Is the iDisk connection encrypted, or is it wide open?

This sounds like a job that some sort of graphical SSH frontend could do better. (since OS X has ssh support built in)

In other news...

[Dieppe]

Slashdot editor kdawson and Slashdot submitter deleuth mysteriously disappear...

Re:In other news...

[ColdWetDog]

Slashdot editor kdawson and Slashdot submitter deleuth mysteriously disappear...

I don't know about M. deleuth, but if Apple's Reality Distortion Field(R) can make kdsawson disappear, I'm buying another Mac. Maybe two.

Re:In other news...

[Pop69]

I'd buy a truckload if they could make Zonk go as well !

That's interesting

[Auckerman]

I've never noticed that before. Probably because desktop WebDav on OS X is so slow that I just use dedicated client apps. The poster isn't being perfectly clear on the whole process for accessing your iDisk via dot mac. Here's how it goes. You sign into dot mac, then you sign into your iDisk. Same username, same password for both. You get a web page that access your WebDav folder on Apple's servers. Signing out of dot mac doesn't sign you out of the iDisk. A simple history check pulls it right back up with full write access to your iDisk (clearly not from web cache). No one would expect that behavior. I would assume there is a network idle time out, as dotmac has.

In real experience terms, this isn't going to be much of an issue until it's fixed, but does put a small stain on the portability of the service. Which is one of Apples main advertising points for it. Gotta remember though, Apple, like all other companies is filled with a lot of people. There are moderators on Apple forums, for all we know one of them removed it then notified management of the problem and it's working it's way up the command. It's not like Steve Jobs read it and said, "OMGWTFBBQ!?!?! PULL THAT NOW!".

Though, the extra publicity will help.

When Will Apple Learn

[numbsafari]

I am an new Apple user. And reasonably happy.

However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.

Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.

It's not a question of if, but when. Will Apple be prepared? So far, all signs point to "NO".

PS... the CAPTCHA word for this post was "condom".. how appropriate considering the whole point is to have a good profolactic. A good metaphore for Apple's current approach to security.

Re:When Will Apple Learn

[noewun]

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case. Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes.

I see no proof of this. Apple responds relatively quickly to security holes and releases regular patches and updates.

Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.

Huh? You seem to have conflated their corporate policy, which is sometimes very stupid, with their security policy, which is generally good. The two have nothing to do with each other. Apple's overzealous moderation of their own forums is well known, and unfortunate. But it has nothing to do with how well they manage their OS security and how well they respond to exploits.

Re:When Will Apple Learn

[mr100percent]

I disagree, Apple has responded quite well, building in access control systems, program app exceutable digital signing, sandboxes, Address Space Randomization, Input Manager Restrictions, Filevault encryption, etc.

Apple hasn't experienced a real virus outbreak, but they thought ahead to implement these features before anything has happened. They beat Microsoft in many of these areas.

Re:When Will Apple Learn

[Auckerman]

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.

Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

You are incorrect in so many ways, I find it hard to begin.

1. There is no proof what so ever that Apple's install base is the reason Macs are more secure than Windows. Having network servers off by default and having a default web browser that doesn't run code written in C++, visual basic, and whatever the hell else ActiveX supports these days to be FAR more important than the install base. There are reasons that in the past, if you took a Windows computer out of a brand new box, hooked up via a DSL or Cable modem that your machine was hacked before you were finished logging in for the first time, and it isn't because of the installed base (you do remember that don't you). The Windows machine has active network servers running.

2. Apple doesn't ignore security updates and issues. They fix them. Sometimes even before someone posts about them. If you don't like their update schedule and want Apache or whatnot to be running up-to-date you can install from the CVS just like the Linux and BSD people do. To me it's like saying Red hat doesn't respond rapidly to security holes. If you want a day zero fix, update from CVS. For the common user all of this is irrelevant, since their default install isn't listening to network traffic. Apple has also included other under the hood improvements, just like all other venders, to minimize the risk of buffer over flows.

I'm sorry, Apple's not walking some kind of security minefield just getting lucky all the time. Just like Linux isn't. Unix style security just works very well and is easy to manage. Your computer isn't magic, there's a reason why Microsoft's operating systems are getting owned all the time. There are a LOT of reasons for this, most of them boil down to bad default installs and the environment Microsoft has created within it's developer community. An environment that fosters laziness and has typically done very little to stop their bad practices. Things like making applications that require the admin to be login in order to run. Which in turn leads to the floor level tech just giving everyone admin access.

You computer is not made of magic, there are reasons Microsoft's operating systems suck and people complain about them and it's not because they are "not Apple and have a small install base".

Re:When Will Apple Learn

[Anonymous Coward]

Fair point, but they are still choosing system-level components and laying them out. They would be stupid not to. Perhaps they even have a couple engineers laying out motherboards.

I guess my point was that what they do is make good decisions--that's much more significant than any minor layout tasks they might do. I've worked for a few companies that had engineers working at creating their own chip designs, board layouts, etc. Although it can be "Engineering", it's not particularly hard. (By Hard I mean unproven, how can this be done, etc). Hard is writing a multi-threaded OS core--they can't (and were smart enough to realize that). Hard is trying to get hundreds of video cards to work, taking advantage of the particulars of each different card.

Here's a good hard problem--as an OS vender, create a system and spec that allows two different companies with no knowledge of each other to write applications in such a manner as one might embed itself in the other, allowing in-place editing of the embedded document (switching appropriate UI elements to those of the embedded program as needed). This is virtually impossible, Microsoft tries to do crap like this and gets to the "Functional Demo level" while pretty seriously degrading the stability of the system go do so.

At all these hard problems Microsoft just piles on the engineers, gets some limited success--in many cases at the cost of system stability.

Apple doesn't even try. They know where their strengths lie--they are pretty much a system integrator. Okay, maybe not like Joe's custom computer, but they certainly show no more technical skill than Dell or any laptop maker. (Except, as I said, they write a serviceable X-windows replacement.)

By the way, by far my favorite things that apple did, any one company could have if they tried hard enough, but nobody ever has:
      Make a laptop where suspend WORKS repeatedly, without ever degrading
      Make a desktop/laptop that is dead quiet unless it absolutely needs the power
      Looks cool (hell, I bet 40% of the engineering staff is set to this task, they should get it right)

Hmm, thought the list was longer...

Re:When Will Apple Learn

[jcr]

Don't they just order and piece together hardware just like joe shmoe's computer shop would?

No, they don't. That's why the MacBook Pro is thinner and lighter than machines from other vendors with comparable performance specs, for example.

-jcr

Re:When Will Apple Learn

[Jeff DeMaagd]

Safari for Windows had several big security holes exposed the first day, despite being, as their promo site says "Built with security in mind from the ground up". That did not inspire confidence. Quicktime has a few security holes a year that need to be patched, and a couple of those security holes have caused problems with Myspace and Second Life. I recall it took a two or three months for Apple to address the one that bugged MySpace.

I'm not sure how programming in Objective-C is safer than C++, but I don't know the very guts of both to see the difference, just enough to make programs. It doesn't look like Obj-C really slows down the writing of insecure code to me.

Re:When Will Apple Learn

[TomHandy]

OS X is more than just a "serviceable X Window replacement".

And Apple does more than just pick components to cram into a laptop. The MacBook Pro, for example, was designed from the ground up by Apple, and does feature custom designed internals - yes, obviously some components are standard (the CPU, GPU, etc.) but the motherboard, etc. is original.

If the MacBook Pro was just a bunch of off the shelf components, there would be a lot more 1" thick 5.4 pound laptops out there.

Re:When Will Apple Learn

[99BottlesOfBeerInMyF]

However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.

Apple is a mixed bag when it comes to security. They have employees they acquired from other companies specializing in Web technologies, graphics, video, and numerous other topics, as well as old-school Apple employees many of whom do not take security seriously enough. On the other hand they have all the Next employees and all the old-school Unix guys they've hired on to manage the guts, who live and breath security. As a result, in some ways Apple is way ahead of the game for security (like with their new sandboxing and signing frameworks in Leopard) and in others they seem oblivious. I can't think of another consumer desktop oriented OS that ships with so few services running, and with almost all of those sandboxed. Then you get to other things Apple, like some of their userland applications and Web services and you wonder that the same company could produce both of them. Apple is pretty schizo in this regard.

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

I disagree. Apple is a juicy target for exploitation for many reasons. They are less likely to be exploited due to a number of market and social factors, but in general, Apple's security has been fairly sound and that is why they are not worm food. Further, I don't see Apple's security record becoming poor in the future. Apple, Linux, Solaris, etc. all have one major thing that will keep them more secure than Windows is today... motivation. If Apple's security starts to fail for their users, Apple loses money as they move away. Thus, Apple has direct financial motivation to fix the problem, and they will. This is the advantage of a free market. Microsoft, however, has a monopoly, so even when their users are screaming out for better security, MS loses very few, if any, if they ignore their customers and focus instead on locking in a new market and this latter action will make them more money. They have direct financial motivation to do little more than provide the appearance that they are doing something security-wise, and that is what they keep delivering.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case. Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

Here is my experience with Apple's security response. My co-worker found a potentially exploitable hole in OS X. He went to Apple's Web site and reported it as a security bug in the bug report section, not commenting the forums that are for users not Apple employees. Apple sent him a message a few days later saying they'd look into it. A few weeks later the next security update for OS X came out and fixed the problem, including crediting my co-worker with discovering it. It was painless and quite rapid for that large of a project, considering the time for research, coding a fix, testing, and rollout, in fact a lot faster than our average response time to that same priority of bug (and we sell much more critical security devices). From everything I've seen, Apple responds fairly quickly to security issues reported to them and the only instances where there are major problems are where researchers refuse to give Apple details before p

Re:When Will Apple Learn

[99BottlesOfBeerInMyF]

Saying apple makes good hardware though? Don't they just order and piece together hardware just like joe shmoe's computer shop would? Do they manufacture motherboards, CPUs, ram or hard drives? They might make the cases, I doubt they make the power supplies.

Apple is an OEM like Dell or actually, more like Sony. Most of the components they use are standardized, but they do have motherboards designed just for them, they design how all the components go together, which ones to use, and what the required specifications (acceptable failure rate) are. Not all machines are created equal in this regard. Just take a look at the percentage of machines returned due to failed hardware that consumer reports publishes each year and you'll see Apple at the top of the list, closely followed by Sony, Lenovo and (surprisingly Dell this year as they've managed to turn around their laptop manufacturing, although not desktops). Other vendors have up to five times the percentage of hardware failure.

So they made a good OS? Naw, they made a darn good windowing system to replace X though. Of course, all the concepts were out there--nothing technically groundbreaking.

They (or Next who took over Apple) made a lot more than the windowing system. They made the kernel, the APIs the filesystem, the services framework, much of the userspace apps and daemons, and don't forget openstep. As for the graphics, well a PDF (vector) based windowing system was certainly ahead of it's time, although the networking capabilities were retrograde.

So what does Apple actually make?

They make the software, minus some pieces where they share development with the OSS community. They make the hardware.

They restrict the hardware which must avoid thousands of "little annoyances" PC users see (like laptop suspend being flaky).

Ummm. The flakey driver annoyances are always a problem for the hardware vendor, not the OS vendor. MS doesn't write drivers for Dell hardware, Dell does. Each OEM is usually responsible for getting drivers together and each OEM supports a subset of hardware, just like Apple.

They let someone else create the multi-threading OS kernel for them because that's hard.

Mach? Mach has been so remade by the Next engineers that it is pretty much their baby at this point. When Next was acquired by (or acquired) Apple they remade it further making it more monolithic and they've been reworking it ever since. Apple certainly does their own kernel.

The other thing they bring is a lot of people who grab onto anything that they can latch onto to make them appear different--the VW bug, iPod, blackberry...

How does an iPod make one appear different? They make up nearly 70% of portables.

...security-wize, but if they ever start doing any ground-breaking work, they will most likely start seeing some serious problems.

You mean like being the first desktop OS to implement an SELinux style mandatory access control system by default and use it to sandbox services? The verdict is still out, but they seem to have done a pretty kick-ass job with that one so far. Apple has a lot of really good security people from Next and from BSD and other UNIX backgrounds that have been hired into the company in the last five years. Some of them do some solid, cutting-edge work. Apple's problem is that they are such a mixed bag when it comes to engineering, a lot of the userspace and services people are at the opposite end of the spectrum and don't think about security at all. Still, Apple is ready and poised to kick some serious butt when it comes to security enhancements, when and if, security ever becomes a real problem for the majority of their users. They are also getting a lot of free testing and fixes from the community, since so many people in the computer security industry are now using OS X on their own system

Re:When Will Apple Learn

[Ilgaz]

"Feedback" form is for people who (like me) to say "Leopard is awful, you shipped it too early". :)

Actual thing is http://bugreporter.apple.com/ , "New Problem" "Security" from drop down menu.

He seems as an advanced user/developer and yet uses the "Feedback" form. Than posts to public forums ignoring their policies punishing those non techie .Mac users.

Here is the complete open Mozilla project security issue reporting guideline
"IMPORTANT: Anyone who believes they have found a Mozilla-related security vulnerability can and should report it by sending email to the address (removed) @mozilla.org. For more information read the rest of this document."

It doesn't say "Post it using feedback form, if you don't get any response, use mozillazine forums to post it to public and when it is deleted, post it to slashdot" :)

Just another hit against Apple...

[Shifuimam]

Yet another incident where Apple blatantly ignores the customers they claim to value so much...and they will likely continue to do so until there's such a shitstorm about this that they have no choice but to respond. Apple used to be a good company...ten years ago. Now they're just as bad (if not worse, in many regards) as every other IT giant out there. Sad.

Re:How many people actually use iDisk?

[admactanium]

So, my question is, how many people actually use iDisk? How much of a problem is this actually.

actually, i use it all the time. it's a very convenient way for me to let clients download files. i have a hosting account with a traditional host as well, but i never went through the trouble of making/figuring out a nice-looking interface for my clients to use. with idisk i throw them into the public folder, then log into the web interface to set-up/edit their download page. obviously, this isn't great for confidential information, but i rarely deal with stuff that sensitive. i also host one of my personal websites on .mac. i will say however that i don't use the finder's idisk implementation nor do i manage the input/output of my files on the web. i just ftp into my idisk and then deal with the interface afterwards. ftp is much faster than the native interface. but i do find idisk to be really convenient in my particular case.

Wait, what??

[Khyber]

No SSH session for transmission of personal data, and reliable logout for protection? Insane security practice from a now UNIX-certified OS vendor, especially when it comes to something so private as the transfer of one's hard disk contents to an internet backup? Ah well, it was bound to happen, and it has probably happened in the past, and will likely happen again in the future. Anyone can slip up.

No, incident does prove Apple is lacking ...

[AHumbleOpinion]

Huh? You seem to have conflated their corporate policy, which is sometimes very stupid, with their security policy, which is generally good. The two have nothing to do with each other. Apple's overzealous moderation of their own forums is well known, and unfortunate. But it has nothing to do with how well they manage their OS security and how well they respond to exploits.

You are very mistaken, this incident does prove that Apple's security policies and responses are indeed lacking. Don't get fixated on the deletion of a post, consider that they did not respond by adding a logout option to a *web* interface.

Re:No, incident does prove Apple is lacking ...

[Trillan]

You realize that the post was probably deleted by someone in poorly-trained low level support monkeys, right?

Apple has a bug reporting system and an email for security issues. Use them, not the forums, if you want to make sure the post is actually evaluated by someone with understanding of... well, anything technical.

Re:No, incident does prove Apple is lacking ...

[Anonymous Coward]

If you have an ADC account (it's free) you can submit via bugreport.apple.com

Feedback never gets a response from what I have heard, but is listened to. Look at the new feature in the latest Garageband update for example.

As for the forums, they say quite clearly they are for user to user technical support, not discussion of policies.

Re:No, incident does prove Apple is lacking ...

[noewun]

You are very mistaken, this incident does prove that Apple's security policies and responses are indeed lacking. Don't get fixated on the deletion of a post, consider that they did not respond by adding a logout option to a *web* interface.

How? What is the causal connection? Unless you have specific information about Apple's internal organization, and the relationship between the people who admin their forums and the people who work on OS security, the only connection is the one in your mind. Apple is not a monolithic entity with the ever-vigilant head of Steve Jobs on constant watch. It's a large corporation with multiple divisions, each of which has their regions of control and expertise. The decision to nuke posts about a security flaw, while stupid and short-sighted, does not immediately mean that Apple's OS security people are lax or lazy. They may be working on a fix already. They may not. They may roll it out in a week. They may not. And an article may appear tomorrow which proves that this security "flaw" was vastly overrated and is not that serious.

If you wanted to critique Apple's security prowess you could compile a list of known security flaws, with their severity and a list of how long it took Apple to patch them. That would be a logically constructed argument. However, this is Slashdot, so I won't hold my breath. This is the same lax "logic" which leads to a lot of the Microsoft bashing around here, and it looks stupid no matter which way it's pointed.

Re:No, incident does prove Apple is lacking ...

[Tim C]

The decision to nuke posts about a security flaw, while stupid and short-sighted, does not immediately mean that Apple's OS security people are lax or lazy.

No - but not putting a log out button on a protected web resource does mean that they are either lax or lazy. I have no particular antipathy towards Apple, but that's just plain dumb. Even if the flaw isn't serious it certainly *looks* bad, and violates established practice for web applications.

Re:No, incident does prove Apple is lacking ...

[wish bot]

The few times I have submitted comments/bugs to the ADC bugreport email address, I've always received an answer back (even if it's "we're working on it"). The first time it happened I was completely shocked - it was a real email written by a real person with a real answer. Brilliant.

Re:No, incident does prove Apple is lacking ...

[kelleher]

Apple is not a monolithic entity with the ever-vigilant head of Steve Jobs on constant watch. It's a large corporation with multiple divisions, each of which has their regions of control and expertise. The decision to nuke posts about a security flaw, while stupid and short-sighted, does not immediately mean that Apple's OS security people are lax or lazy. Wrong - it means exactly that.

If their security folks weren't lax and/or lazy there would be a well known and well understood process within Apple for all the divisions to follow when a possibly security flaw was reported. The process should include tracking, reporting, and escalation procedures to ensure that big things don't get categorized as small things and overlooked.

Re:No, incident does prove Apple is lacking ...

[solitas]

I've used the same email address too - and while I haven't received a personal response I have a vouched-for 'friend of a friend' who works there and she _was_ able to check it out and found that my email _was_ read and considered.

Her response _also_ repeated the point that Apple (quite naturally) prefers receiving bugreports through the proper (secure) channels and not having to cull them from unrestricted forum postings.

Re:No, incident does prove Apple is lacking ...

[bigstrat2003]

Yet has nothing to do with it. That logout option should've been there from day 1 of *writing* the damn application. Common sense says: if you have a log-in, give the user the option to log out. Apparently some team at Apple lacks (or lacked) common sense.

Re:No, incident does prove Apple is lacking ...

[NMerriam]

If their security folks weren't lax and/or lazy there would be a well known and well understood process within Apple for all the divisions to follow when a possibly security flaw was reported. The process should include tracking, reporting, and escalation procedures to ensure that big things don't get categorized as small things and overlooked.

There is a well known and well understood process, it's called bugreporter.apple.com. The process does include tracking, reporting, and escalation procedures to ensure that big things don't get categorized as small things and overlooked.

What you're complaining about is that random forum administrators don't have the responsibility, time or technical ability to personally evaluate every forum post for whether it contains a bug or a security flaw as opposed to a stupid user error.

Re:No, incident does prove Apple is lacking ...

[NMerriam]

You claim that what forum admins do is unrelated to security. That is mistaken. Either a forum admin failed to report a security issue or they forum admin reported it and no one felt the need to update a *web interface* in a timely manner. Either scenario indicates that something is lacking at Apple.

Or it indicates that user forums are not the place to report security flaws, and that user forum administrators are in no way able to evaluate what is a stupid user error vs what is an actual security issue across the hundreds of different hardware and software combinations Apple offers. If you think every forum post should simply be echoed to the bug tracker, that's your prerogative, but it seems to be a great way to waste a lot of the qualified bug-squashers' time.

Re:No, incident does prove Apple is lacking ...

[Anonymous Coward]

if forum admin don't have the necessary technical skills to evaluate which report are security issues, why are they deleting them so that noone else can? or pointing those users to the correct place to report such issues? putting your head in the sand only makes things worse, and gives apple their reputation for arrogance

Re:No, incident does prove Apple is lacking ...

[NtroP]

The few times I have submitted comments/bugs to the ADC bugreport email address, I've always received an answer back (even if it's "we're working on it"). The first time it happened I was completely shocked - it was a real email written by a real person with a real answer. Brilliant.

This has been my experience as well. I've submitted several bugs. The first one was responded to by the next day and that was to ask for more information. It was followed up after a couple of days with a patch emailed to me. They asked me to test it to see if it fixed the issue - it did and was included in the next roll-up patch. The others received answers along the lines of "Thanks, someone else has already reported this, we are working on it, if you have any new information please reference xyz ticket." I even received a phone call once.

Apple has always been rather prickly when proper procedures aren't followed with bug reporting. A public forum is a good place to ask a question but is definitely *not* the place to submit a security-related report - they were well within their rights to remove it. Although I would have replaced the message with a "Post removed: submit security issues to product-security@apple.com" . My only complaint though, is that if you aren't already familiar with the reporting procedures it's not easy to find where to report bugs. Of course, a little googling or searching on Apple's site give you the answer, but the average noob won't do that. Of course they also don't know how to properly articulate the issue most of the time either.

A minor flaw? Tosh.

[blowdart]

0H N0ES U DIDNT APPLE IS TEH PERFECT

Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Nor is it a user interface problem; by using session cookies closing the browser would logout the user, with or without a logout button.

The site listed (but not linked) in the summary doesn't describe the issue as minor, or a UI problem, so one can only assume that description comes from the summary author.

Re:A minor flaw? Tosh.

[Colin Smith]

Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Macs make up about 3% of the computer using population. This means all flaws are minor.

Re:A minor flaw? Tosh.

[kestasjk]

But that 3% is the most important group; the 3% containing Einstein and Picasso and Vivaldi, Mac evangelists one and all.

Basically if you see Einstein, Picasso, or Vivaldi, or even Gauss or Heisenberg, using a public computer then Apple will treat this vulnerability as serious.
Last I checked scientists, power-managers and artists don't use computers other than their own, so why should Apple care about this "vulnerability"?

Re:A minor flaw? Tosh.

[Malevolyn]

As a player for both all three teams (so to speak) I'd have to say the article title is a bit sarcastic. I'm sure most people can agree that one of the differences between Apple and Microsoft is in how seriously they take themselves. Users tend to follow suit, which leads to sarcastic article title for what is very obviously a very large security flaw; in contrast, Microsoft articles lean more towards the more professional side.

Re:A minor flaw? Tosh.

[vtcodger]

***It's not just the title, but to the article summary as well. And this is slashdot, when was the last professional Microsoft article here? 1993?***

I dunno. When was the last time Microsoft did anything professional?

I agree that Microsoft would get a lot of abuse in this venue even when they did things well/right. But if you ask me, Microsoft doing things well/right hasn't been much of an issue for quite some years.

Re:A minor flaw? Tosh.

[jackpot777]

Macs use computers?

And I thought it was over 5 percent now...

Here's the thing. The only people that have to be worried are Mac users with a dot-mac account. I have an iMac but I wouldn't dream of getting .mac account. Seeing as it costs $99.95 for a year's membership, and for that you get:

a place to share photos online (which I do for free with Photobucket)

your own personal web-space (which for personal use, Blogger does the job just fine for me)

email access anywhere, even on an iPhone (but the iPhone shows your regular ISP email anyway, which is set up the first time you plug your iPhone into your Mac thanks to the settings in the Mail program, and GMail is accessed anywhere with internet connectivity too)

remote access to your Mac (which I personally have never needed)

the ability to sync your favourite stuff to the computer you're using (my iGoogle page shows me all the stuff I usually bookmark on any computer I decide to log into Google ...and after that, I have the URLs in my head or I can search for the stuff I want, or just send the URLs in an email to my GMail account, stick a star on the email and sort by stars to find it quickly)

10GB of storage online for files (XDrive gives 5GB away for free, eSnips gies 5GB away for free, my photos on Photobucket, my videos that I want people to see on YouTube...) .Mac Groups (there are enough free options out there for whatever group I want to start or join ...Google Groups, browsing the old Usenet newsgroups using Thunderbird, etc.)

Online backup if I don't have OS X 10.5 Leopard (or I can just buy Leopard and get all the new-fangled doohickeys too)...

What's the point? It's the equivalent of when people had CompuServe in the early-to-mid 90s. They'd pay through the nose to use a proprietary web browser and get access to groups that only other CIS users could use. It's the internet for people that don't know what's out there for nowt, a gated net community.

Re:A minor flaw? Tosh.

[stuboogie]

"What's the point? It's the equivalent of when people had CompuServe in the early-to-mid 90s. They'd pay through the nose to use a proprietary web browser and get access to groups that only other CIS users could use. It's the internet for people that don't know what's out there for nowt, a gated net community."

hmmm...sounds familiar...what was the name of that?

Ah, Oh weLl.

I can't remember right now.

Re:A minor flaw? Tosh.

[kithrup]

While not commenting on the "feature" in question -- one thing that .Mac does give you, that you didn't list, is the "Back to My Mac" feature for 10.5. This is actually pretty nice: I can (barring firewalls in the way :)) connect to my Mac at home while I'm elsewhere, both for file-sharing and screen-sharing.

You also get iChat encryption for .Mac accounts. But there are other clients to do this -- the BtMM thing is very impressive. (Remember, it works through NAT. Most of the time, anyway. :))

I can't guess for anyone whether that's worth $99/year... but when you need it, it is pretty nice to have.

I'm not sure how to look at my iDisk from a web browser, so I am not sure what's going on with that. I'm still looking, however.

Re:A minor flaw? Tosh.

[0123456789]

As someone who uses Tiger; the $100 per year for .Mac is worth it for the Backup software alone. You're right, I hardly use most of the other features, but I've had enough hassle with other backup software (or, more accurately, with restoring files from other backup software) that I'm willing to pay for reliable backup software (And, given my habit of fat-fingering rm commands, I tend to test the restoration quite frequently...). As to buying Leopard, Tiger works for me. Of course, I will probably upgrade eventually; probably around the same time my .Mac sub is due for renewal :-)

Re:A minor flaw? Tosh.

[shmlco]

So the sequence is IF you use a Mac and IF you're a .Mac member and IF you use iDisk and IF you check your iDisk from a public browser THEN someone could potentially access those files.

Sorry, but the aggregate of all of those conditions is probably 0.000001%. Is it a problem? Yes? A major flaw? No. Worth discussing? Hardly. Check 100,000 public terminals and will you find one instance of the problem? Doubtful. In fact, I'd say that the fact that we're just now discovering the issue five years after .Mac and iDisk premired illustrates more than anything else as to just how "significant" it may be.

Should it be fixed? Sure.

As to your commments, I'm pretty sure I've ever seen anyone at anytime claim that Apple or Mac or OS X or the iPod or the iPhone is "PERFECT". Better, perhaps, but perfect? Nope. One has only to look at the tech notes and Software Updates to realize that. As such your entire anti-fanboi rant is pretty much just a strawman setup so you can knock him down, and pat yourself on the back in the process.

A better issue would have been followed from "A quick review of any public terminal's browser history could bring up all kinds of interesting things." Like failing to log out of Gmail or an Amazon account. But no. We have to do yet another Apple vs. Microsoft vs. Linux flamewar. Guess it's another slow Sunday at /..

Finally, the summary says, "feedback at apple.com/feedback has gone unanswered"... which is ALWAYS the case. It's a feedback site. It says feedback will be unanswered. To quote, "We read all feedback carefully, but please note that we cannot respond to the comments you submit." But again no, we have to make sure it looks like Apple is ignoring the "problem".

Re:A minor flaw? Tosh.

[PM4RK5]

You know the fanboi is well aware of the drivel he spews when he resorts to defending Apple anonymously.

And yet the whole of Slashdot can go ahead bashing Apple without actually investigating the problem. Had anyone actually checked, they'd have noticed that the main .Mac page—which is how one accesses the iDisk interface—has this nifty little logout button, as seen in this screenshot.

But it's more fun to bash Apple unconditionally.

Perhaps it's a minor oversight that the self-contained iDisk interface lacks a logout button, but to say that "there is no way for the average computer user to log-out of their iDIsk on public computers" is patently false. Sure, they have to use the main .Mac page to do it, but you have to open that page to get to your iDisk in the first place. So: it's the user's choice to close that window while working on iDisk (the iDisk interface opens in a second window), and the user's oversight in failing to return there to log out.

Investigative journalism at its best. Cripes.

Re:A minor flaw? Tosh.

[fatlaces]

Interestingly, that $99.99 is paid by you, not by advertisements. I haven't used it, but I think that would lead to a little cleaner interface/experience. I think ye olde internet was like that until the end of Compuseve and such.

Still, for a hundred bucks I would need more storage, and the ability to use PERL/PHP with my sites.

Re:A minor flaw? Tosh.

[Dephex Twin]

Do I ask myself questions and then immediately answer them? Yes.

You are a heretic, sir!

[Quiet_Desperation]

Anyone can slip up.

Ah, but this is Slashdot, where corporations are composed of primordial evil and capitalism is the beefy fart of the Devil. Every slip up is cause for running to the hills to prepare revolutionary strikes, and then run to the other hills and plan counter-revolutionary terror, and we all run around like decapitated chickens shouting comforting mantras like "Information wants to be free!" and "It am teh suk!"

Other Apple security controversy

[DigitAl56K]

The Reg is currently questioning Apple's approach even in addressing well-known security vulnerabilities that it has actually acknowledged:

http://www.theregister.co.uk/2007/12/15/apple_security_fixes/

Re:My testing

[makomk]

According to this post, signing out of .Mac doesn't actually sign you out of the iDisk.

Re:My testing

[prockcore]

Step 5. Notice that clicking the big LOG OUT button doesn't affect iDisk.

Re:The price of popularity

[99BottlesOfBeerInMyF]

...chuckling not only at the security issues that are popping up, but at Apple's reaction to all of them.

I've been working in the security industry for years. I've submitted bugs to Apple, MS, and various Linux and BSD projects. Apple's reaction to such submissions has been better than average. For the most part, they seem to acknowledge security related bugs and fix them before they are exploited, including providing credit to the bug reporter. I guess what I'm saying is, if you're judging "Apple's" response to security related bugs, maybe looking at how they handle problems reported to them through their publicly accessible bug reporting system is a better measuring stick, than looking at how they handle posts in forums. Not that I approve of censoring their forums, it just doesn't seem to be an important aspect of how they respond with regard to security. Not to sound like an Apple fan or anything, but I've frankly been impressed by Apple's quick turnaround on serious bugs.

Re:Your post spells out Apple's shortcomings...

[NMerriam]

No one is saying that a forum admin should evaluate the validity of the issue.

That's precisely what you're saying, otherwise Apple should just pay it's security team to be the forum administrators so that nothing is missed. You can't tell someone to forward some things and not others without asking them to evaluate the messages to determine which need forwarding. In order to evaluate which need forwarding, you need technical knowledge about what is being discussed.

Also you are creating a silly red herring. This particular security problem is independent of hardware or software. The problem and fix lie in a *web* interface

So because it's a web interface it isn't software? It doesn't require any technical knowledge to evaluate? That doesn't even make any sense. There's no difference between a web interface and a standalone application interface in terms of telling a security issue from someone just bitching or being an idiot.

Another silly red herring. There are qualified people between the forum admin and the developers. Isolating developers from the noise is a common thing in many organizations. If your silly scenario were true, if a forum guy could directly contact a developer then that would be yet another example of where a shortcoming may lie. Misrepresenting my position will not revive your failed logic.

Nor will misrepresenting mine. Triage is one of the most important and time-consuming parts of dealing with bugs and security issues, and if you think Apple's finest programmers are running the first-line triage on the bug database, you're crazy. They have a whole staff with actual technical training and resources available whose sole job it is to do that triage, and basically what you're suggesting is that every single Apple employee should be trained in those skills and have those resources, or that the triage team should take over every form of communication "just in case".

Because unless every Apple employee from the janitor to the shipping clerk knows as much as the triage team, they DON'T have the skills necessary to know what does and doesn't need to be reported to the triage team (hi, I'm a catch-22, nice to meet you!).