Slashdot Mirror
Apple Criticized For Not Blocking Stolen Certs
CWmike writes "A security researcher is criticizing Apple for lagging with its response to the DigiNotar certificate fiasco. He is urging the company to quickly update Mac OS X to protect users. 'We're looking at some very serious issues [about trust on the Web] and it doesn't help matters when Apple is dragging its feet,' said Paul Henry, a security and forensics analyst with Lumension. Unlike Microsoft, which updated Windows on Tuesday to block all SSL certificates issued by DigiNotar, Apple has not updated Mac OS X to do the same. Meanwhile, even Mac OS X users who want to go DIY are stymied, reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates."
At the request of the Dutch government, Microsoft is delaying the update in the Netherlands (home of DigiNotar) until next week, to avoid confusion (and to buy the government more time to roll out new certs).
I feel much safer now, knowing our government has the power to stop Microsoft from rolling out security updates in a country.
These certs are blocked on all Apple equipment and always have been. Anyone getting the certificate accepted is obviously holding it wrong.
Somewhere deep in Silicon Valley, a programmer is looking at a comment something like this:
/*******
FIXME: WTF Hack here. CRLs require authentication of being revoked, but we never bothered to check the callback of the revoke. Maybe if we bothered to have a revoke infrastructure? For now, we'll just not bother fixing this until 10.1 or 10.2.
******/
return true;
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The biggest issue that has come to light here imho is that it's nigh impossible to revoke an issued certificate. When a certificate is out, and it's signed by a trusted CA, there is basically no way to revoke it. Revoking involves updating browsers, or even complete operating systems (like Windows or OS-X). Just because one CA made a small mistake, got hacked for whatever reason, and the whole world has to update their software.
Errors will be made. Certificates will be issued erroneously by a CA, or through hacking. Certificates will be lost/stolen. But for some reason there is no proper way in the whole system to fix that kind of errors. If we let it be, it's just a matter of time before the whole system crumbles and nothing can be trusted any more.
Any thoughts on this? Any ideas on how this could be fixed?
The problem lies with Safari not with OSX. Use a different browser. This is not an OS problem. I do wish Apple would get their finger out and fix it though.
Comodo hasn't had just one, but two such breaches in the past few years (use the Slashdot search to find the stories).
How come their certificates are still trusted and included with all browsers and operating systems whereas Diginotar's certificates were obliterated from all browser and almost all operating systems immediately?
Is it because DigiNotar is only a regional Dutch CA? Talk about disgusting double standards then.
They lack in security and fixing exploits, and yet, they like to brag about somehow being "more secure" than Windows.
Oh, and Microsoft I believe already released a patch... yesterday? Tuesday?
The thing is, I am wondering whether they will even bother to fix it for people still running Leopard. Apple historically has released non-security bugfixes for 10.n, security patches only for 10.(n-1), and basically jack shit for all osver
While ordinarily just a dick move, due to the intel transition this means that there is a large user base out there(namely the ones that still run PPC macs) that basically will never get any new security patches for their systems and they are stuck with either pitching their hardware or taking the risk that they will not be a victim.
Apple really needs to make these EOL policies not only clear, but announce them significantly ahead of time so that people who decide to migrate have plenty of time to do so.
Monstar L
also, bbcode fail
i agree that its an exploitation of weak vulnerability. comodo may have done it to make a point, but what are the chances that others have doing this for a long while?
pass the 'Micro$oft borg' :)
I don't proclaim to be a security expert, but MS, google, etc did the right thing to revoke the certs.its still reactive not proactive.
I vote if it takes an OS update to mandate secure and trusted communication, YOU ARE DOING IT WRONG.
haven't been to iran in a while, but do they have even have a mac store? or get OS updates?
something is awry
Same here. Snow Leopard user. Can confirm it. Stupid OS. I hope this will forever silence the 'if you think that firefox is a proper Mac application GTFO' trolls. This time, it's *better* to use Firefox.
Religion is what happens when nature strikes and groupthink goes wrong.
And from that fraction most would be fine with an Open Source Alternative.
However apple looks 'cool' and 'fashionable' and most people who I know have macs don't use any of those.
... most people who I know have macs don't use any of those.
There you have it... proof positive! I'll need to register your comment with a DOI for further citation. Until then, I think it would be safe to refer to this as "Haedrian's Llaw".
As a Dutch reader, I can guarantee you that nobody in his right mind here minds the way DigiNotar's fiasco is handled. They deserve this, and worse. If you're basically selling trust, you'd better be trustworthy.
On the Mozilla Security Blog, the the reason why they handled this as they dit is explained very well:
http://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/
"Money is a sign of poverty." - Iain Banks
Folks,
I have detailed info and tools on my website at
http://ps-enable.com/articles/diginotar-revoke-trust
The short story is that it is possible to protect yourself, but it requires deleting the DigiNotar root cert(s), then revoking trust on the two roots plus four intermediates.
--Paul
What about iOS, Android, WebOS, OperaMini, OperaMobile, etc etc etc. Do they all need to be updated?
reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates."
Really? Cause I just set the trust to 'Never' in Keychain Access and it works just fine.
If you don't know how to do something, you shouldn't talk out your ass.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Allright, lets both camp outside of apple stores and ask people why they're buying macs.
Alternativly we could look at the sales of those 3 programs, and compare them to the Mac userbase.
The problem may be that browsers may not check for CRLs by default, or the DigiNotar's CRL cannot be relied on. So for either scenarios, MS/Google/Mozilla sent out system/software updates to just deal with this CA at the core. Not a bad approach.\
Yes, ideally each browser should by default check if a certificate has been revoked. Hopefully this will be reviewed for the future.
Wearing pants should always be optional.
I believe you should get your sarcasm detector checked.
I'm much more funny, interesting and insightful than the moderators think
Android does not currently have a system for adding or removing CAs from the OS. However this particular instance did not affect android as DigitNotar was never a trusted CA as far as I have found to begin with. The Android system has a far smaller trust base than e.g. Firefox (57 CAs vs 96).
Apple has a reputation for its aggressiveness when it comes to its own security, searching the houses of people suspected of finding lost phones and throwing them in jail. But apparently when it comes to the security of their customers, their enthusiasm wanes.
What a shocker!
What do I know, I'm just an idiot, right?
Reading TFA, it sounds like the problem is not in the OS, but in the Safari browser. A nuance might be that the problem is in the OS, but only Safari uses the OS for cert authentication and other browsers roll their own authentication. At any rate, I read TFA to say if you're using some other browser than Safari you're OK. Granted, the usual Mac "Joe Sixpack" equivalent is probably running Safari and is left hanging, but is this a correct read of the article?
Opera does not need to be updated. They have always warned you if a certificate is revoked, and if they can't verify that it is not revoked they regard it as unsecured. See http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2
For Lion & Snow Leopard. http://support.apple.com/kb/HT4920
Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information
Description: Fraudulent certificates were issued by multiple certificate authorities operated by DigiNotar. This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.
d) doesn't require the user to understand the the certificate system and make sound judgments about when it can safely be bypassed.
Doesn't the perspectives firefox plugin handle this? If that concept were included within the browser framework, it might add a secondary check to the top-down hierarchical (and thus critical-point-of-failure) of trusting CAs alone.
Make sure everyone's vote counts: Verified Voting