A Little .Mac Security Flaw

deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."

Comments

Apple's response?

[PFAK]

Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.

Re:Apple's response?

[mboverload]

> Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.

0H N0ES U DIDNT APPLE IS TEH PERFECT

Huh?

[Yaztromo]

After accessing your iDisk in Firefox:

• Tools -> Clear Private Data"

In Safari:

• Safari -> Reset Safari

Or if you remember to do so before visiting .Mac's iDisk page:

• Safari -> Private Browsing

Problem solved.

So yes, there are ways for the average user to log-out of their iDisk from a public terminal. They just simply have to use the existing facilities at their disposal.

Yaz.

When Will Apple Learn

[numbsafari]

I am an new Apple user. And reasonably happy.

However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.

Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.

It's not a question of if, but when. Will Apple be prepared? So far, all signs point to "NO".

PS... the CAPTCHA word for this post was "condom".. how appropriate considering the whole point is to have a good profolactic. A good metaphore for Apple's current approach to security.

Re:When Will Apple Learn

[Auckerman]

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.

Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

You are incorrect in so many ways, I find it hard to begin.

1. There is no proof what so ever that Apple's install base is the reason Macs are more secure than Windows. Having network servers off by default and having a default web browser that doesn't run code written in C++, visual basic, and whatever the hell else ActiveX supports these days to be FAR more important than the install base. There are reasons that in the past, if you took a Windows computer out of a brand new box, hooked up via a DSL or Cable modem that your machine was hacked before you were finished logging in for the first time, and it isn't because of the installed base (you do remember that don't you). The Windows machine has active network servers running.

2. Apple doesn't ignore security updates and issues. They fix them. Sometimes even before someone posts about them. If you don't like their update schedule and want Apache or whatnot to be running up-to-date you can install from the CVS just like the Linux and BSD people do. To me it's like saying Red hat doesn't respond rapidly to security holes. If you want a day zero fix, update from CVS. For the common user all of this is irrelevant, since their default install isn't listening to network traffic. Apple has also included other under the hood improvements, just like all other venders, to minimize the risk of buffer over flows.

I'm sorry, Apple's not walking some kind of security minefield just getting lucky all the time. Just like Linux isn't. Unix style security just works very well and is easy to manage. Your computer isn't magic, there's a reason why Microsoft's operating systems are getting owned all the time. There are a LOT of reasons for this, most of them boil down to bad default installs and the environment Microsoft has created within it's developer community. An environment that fosters laziness and has typically done very little to stop their bad practices. Things like making applications that require the admin to be login in order to run. Which in turn leads to the floor level tech just giving everyone admin access.

You computer is not made of magic, there are reasons Microsoft's operating systems suck and people complain about them and it's not because they are "not Apple and have a small install base".

Re:When Will Apple Learn

[99BottlesOfBeerInMyF]

However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.

Apple is a mixed bag when it comes to security. They have employees they acquired from other companies specializing in Web technologies, graphics, video, and numerous other topics, as well as old-school Apple employees many of whom do not take security seriously enough. On the other hand they have all the Next employees and all the old-school Unix guys they've hired on to manage the guts, who live and breath security. As a result, in some ways Apple is way ahead of the game for security (like with their new sandboxing and signing frameworks in Leopard) and in others they seem oblivious. I can't think of another consumer desktop oriented OS that ships with so few services running, and with almost all of those sandboxed. Then you get to other things Apple, like some of their userland applications and Web services and you wonder that the same company could produce both of them. Apple is pretty schizo in this regard.

Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

I disagree. Apple is a juicy target for exploitation for many reasons. They are less likely to be exploited due to a number of market and social factors, but in general, Apple's security has been fairly sound and that is why they are not worm food. Further, I don't see Apple's security record becoming poor in the future. Apple, Linux, Solaris, etc. all have one major thing that will keep them more secure than Windows is today... motivation. If Apple's security starts to fail for their users, Apple loses money as they move away. Thus, Apple has direct financial motivation to fix the problem, and they will. This is the advantage of a free market. Microsoft, however, has a monopoly, so even when their users are screaming out for better security, MS loses very few, if any, if they ignore their customers and focus instead on locking in a new market and this latter action will make them more money. They have direct financial motivation to do little more than provide the appearance that they are doing something security-wise, and that is what they keep delivering.

You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case. Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

Here is my experience with Apple's security response. My co-worker found a potentially exploitable hole in OS X. He went to Apple's Web site and reported it as a security bug in the bug report section, not commenting the forums that are for users not Apple employees. Apple sent him a message a few days later saying they'd look into it. A few weeks later the next security update for OS X came out and fixed the problem, including crediting my co-worker with discovering it. It was painless and quite rapid for that large of a project, considering the time for research, coding a fix, testing, and rollout, in fact a lot faster than our average response time to that same priority of bug (and we sell much more critical security devices). From everything I've seen, Apple responds fairly quickly to security issues reported to them and the only instances where there are major problems are where researchers refuse to give Apple details before p

A minor flaw? Tosh.

[blowdart]

0H N0ES U DIDNT APPLE IS TEH PERFECT

Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Nor is it a user interface problem; by using session cookies closing the browser would logout the user, with or without a logout button.

The site listed (but not linked) in the summary doesn't describe the issue as minor, or a UI problem, so one can only assume that description comes from the summary author.

Re:A minor flaw? Tosh.

[Colin Smith]

Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Macs make up about 3% of the computer using population. This means all flaws are minor.

Re:A minor flaw? Tosh.

[stuboogie]

"What's the point? It's the equivalent of when people had CompuServe in the early-to-mid 90s. They'd pay through the nose to use a proprietary web browser and get access to groups that only other CIS users could use. It's the internet for people that don't know what's out there for nowt, a gated net community."

hmmm...sounds familiar...what was the name of that?

Ah, Oh weLl.

I can't remember right now.