Slashdot Mirror
Apple Criticized For Not Blocking Stolen Certs
CWmike writes "A security researcher is criticizing Apple for lagging with its response to the DigiNotar certificate fiasco. He is urging the company to quickly update Mac OS X to protect users. 'We're looking at some very serious issues [about trust on the Web] and it doesn't help matters when Apple is dragging its feet,' said Paul Henry, a security and forensics analyst with Lumension. Unlike Microsoft, which updated Windows on Tuesday to block all SSL certificates issued by DigiNotar, Apple has not updated Mac OS X to do the same. Meanwhile, even Mac OS X users who want to go DIY are stymied, reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates."
macs cant get hacked
At the request of the Dutch government, Microsoft is delaying the update in the Netherlands (home of DigiNotar) until next week, to avoid confusion (and to buy the government more time to roll out new certs).
I feel much safer now, knowing our government has the power to stop Microsoft from rolling out security updates in a country.
These certs are blocked on all Apple equipment and always have been. Anyone getting the certificate accepted is obviously holding it wrong.
Somewhere deep in Silicon Valley, a programmer is looking at a comment something like this:
/*******
FIXME: WTF Hack here. CRLs require authentication of being revoked, but we never bothered to check the callback of the revoke. Maybe if we bothered to have a revoke infrastructure? For now, we'll just not bother fixing this until 10.1 or 10.2.
******/
return true;
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The biggest issue that has come to light here imho is that it's nigh impossible to revoke an issued certificate. When a certificate is out, and it's signed by a trusted CA, there is basically no way to revoke it. Revoking involves updating browsers, or even complete operating systems (like Windows or OS-X). Just because one CA made a small mistake, got hacked for whatever reason, and the whole world has to update their software.
Errors will be made. Certificates will be issued erroneously by a CA, or through hacking. Certificates will be lost/stolen. But for some reason there is no proper way in the whole system to fix that kind of errors. If we let it be, it's just a matter of time before the whole system crumbles and nothing can be trusted any more.
Any thoughts on this? Any ideas on how this could be fixed?
The problem lies with Safari not with OSX. Use a different browser. This is not an OS problem. I do wish Apple would get their finger out and fix it though.
Comodo hasn't had just one, but two such breaches in the past few years (use the Slashdot search to find the stories).
How come their certificates are still trusted and included with all browsers and operating systems whereas Diginotar's certificates were obliterated from all browser and almost all operating systems immediately?
Is it because DigiNotar is only a regional Dutch CA? Talk about disgusting double standards then.
They lack in security and fixing exploits, and yet, they like to brag about somehow being "more secure" than Windows.
Oh, and Microsoft I believe already released a patch... yesterday? Tuesday?
http://my.opera.com/rootstore/blog/2011/09/06/diginotar-first-step-disabling-the-root
It's funny anyway. Grumpy grumpy grumpy.
The thing is, I am wondering whether they will even bother to fix it for people still running Leopard. Apple historically has released non-security bugfixes for 10.n, security patches only for 10.(n-1), and basically jack shit for all osver
While ordinarily just a dick move, due to the intel transition this means that there is a large user base out there(namely the ones that still run PPC macs) that basically will never get any new security patches for their systems and they are stuck with either pitching their hardware or taking the risk that they will not be a victim.
Apple really needs to make these EOL policies not only clear, but announce them significantly ahead of time so that people who decide to migrate have plenty of time to do so.
Monstar L
Apple don't "need" to do anything. In fact, they should continue doing exactly what they're doing, considering they are one of the most valuable corporations in the history of money. What "needs" to happen is for people to get their heads out of their asses and stop overpaying for Apple [i]innovation[/i].
What, no Micro$oft borg icon? And they already patched Windows?? I find that hard to believe. Come on, give the real details of the story. We all know that M$ technologies is pure crap and that anything Apple does is perfection. That's why Apple can drag its feet. As far as I'm concerned Apple doesn't have to do a single thing (it's perfection).
Do you really believe this is a 'hack by chance'? I believe this is someone exposing the vulnerabilities of monolithic security systems that rely upon 'trusted' entities. One that forces new ideas and systems to deliver better security that governments may not like *cough* 'Pakistan bans encryption'.... which direction do you want to go?
Nothing against Iranian hackers, but do you REALLY believe that iranians exploited CAs to read iranian mail on google? nah... not in my blackbook. I smell NSA and Israelis,,,, I for one welcome a new secure method of CA.
This is stuxnet 2.0
Same here. Snow Leopard user. Can confirm it. Stupid OS. I hope this will forever silence the 'if you think that firefox is a proper Mac application GTFO' trolls. This time, it's *better* to use Firefox.
Religion is what happens when nature strikes and groupthink goes wrong.
As a Dutch reader, I can guarantee you that nobody in his right mind here minds the way DigiNotar's fiasco is handled. They deserve this, and worse. If you're basically selling trust, you'd better be trustworthy.
On the Mozilla Security Blog, the the reason why they handled this as they dit is explained very well:
http://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/
"Money is a sign of poverty." - Iain Banks
Folks,
I have detailed info and tools on my website at
http://ps-enable.com/articles/diginotar-revoke-trust
The short story is that it is possible to protect yourself, but it requires deleting the DigiNotar root cert(s), then revoking trust on the two roots plus four intermediates.
--Paul
What about iOS, Android, WebOS, OperaMini, OperaMobile, etc etc etc. Do they all need to be updated?
reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates."
Really? Cause I just set the trust to 'Never' in Keychain Access and it works just fine.
If you don't know how to do something, you shouldn't talk out your ass.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Meanwhile, even Mac OS X users who want to go DIY are stymied, reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates.
That's what you get for using a toy operating system.
And switch over to any flavor of Linux. Apple is way overpriced anyway.
Android does not currently have a system for adding or removing CAs from the OS. However this particular instance did not affect android as DigitNotar was never a trusted CA as far as I have found to begin with. The Android system has a far smaller trust base than e.g. Firefox (57 CAs vs 96).
Apple has a reputation for its aggressiveness when it comes to its own security, searching the houses of people suspected of finding lost phones and throwing them in jail. But apparently when it comes to the security of their customers, their enthusiasm wanes.
What a shocker!
What do I know, I'm just an idiot, right?
Reading TFA, it sounds like the problem is not in the OS, but in the Safari browser. A nuance might be that the problem is in the OS, but only Safari uses the OS for cert authentication and other browsers roll their own authentication. At any rate, I read TFA to say if you're using some other browser than Safari you're OK. Granted, the usual Mac "Joe Sixpack" equivalent is probably running Safari and is left hanging, but is this a correct read of the article?
Opera does not need to be updated. They have always warned you if a certificate is revoked, and if they can't verify that it is not revoked they regard it as unsecured. See http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2
For Lion & Snow Leopard. http://support.apple.com/kb/HT4920
Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information
Description: Fraudulent certificates were issued by multiple certificate authorities operated by DigiNotar. This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.
http://support.apple.com/kb/HT4920
Continue to troll.
http://www.macrumors.com/2011/09/09/apple-releases-security-update-2011-005-for-os-x-to-address-compromised-certificates/
oops...
I may be just an AC, but Apple released a security update this morning to address the certificate issue discussed in the story.
Slashdot was just a couple days late on this one.
the official apple security update is available to "fix" this issue.
In other news... Apple posted a security update this moring to fix this, making it simple for joe-average user.
d) doesn't require the user to understand the the certificate system and make sound judgments about when it can safely be bypassed.
Doesn't the perspectives firefox plugin handle this? If that concept were included within the browser framework, it might add a secondary check to the top-down hierarchical (and thus critical-point-of-failure) of trusting CAs alone.
Make sure everyone's vote counts: Verified Voting