Apple Finally Removes DigiNotar Certs In Safari

Trailrunner7 writes "Apple has finally released a fix for the certificate trust issue caused by the attack on DigiNotar, more than a week after the fraudulent certificates were identified and other browser vendors moved to revoke trust in them. While Microsoft, Mozilla and Google had been communicating with users about the issue and pushing out new versions and updates to eliminate the compromised certificate authorities from their browsers, Apple had been mum about the attack and hadn't given any indication of when it might issue an update for Safari. On Friday the company published a security advisory for Mac OS X users, saying that it was removing DigiNotar's certificates from its trust list."

Comments

Re:Pointless Apple-bashing

[CharlyFoxtrot]

Also the summary praises Google for their quick reaction but Android is still vulnerable, as is iOS BTW. You'd think that'd rate a mention at least.

Re:Pointless Apple-bashing

[v1]

So, it took them 1 week to come out with an update to patch their browser?

They didn't patch their browser. That's not the way to fix the problem. The certificates Safari trusts are in the system keychain. Security Update 2011-005 addresses the problem.

Certificate Trust Policy

Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.1, Lion Server v10.7.1

Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information

Description: Fraudulent certificates were issued by multiple certificate authorities operated by DigiNotar. This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.

So (1) it pulls DigiNotar from the chain of trust, and (2) sends all browsers (and email apps, and anything else that cares to validate certs) accurate information for EV certificates that chain off an untrusted root. Patching the browser shouldn't be necessary and wouldn't address the actual problem, although considering it took Apple an unusually long time to get this update out the door, I can see why some other browser vendors hardcoded out DigiNotar.

But for Apple this wasn't merely a matter of pulling a cert, they also had to fix a bug. Rushing a security bug fix out the door without testing it is arguably a worse security respopnse than taking a few days longer to test before pushing. (it's not like it took months like a few other big names I could toss in the ring to ignite a flame war)

Re:Pointless Apple-bashing

[node 3]

>> "Restart" (if necessary)

"If necessary"? way to downplay it. It IS necessary, but not on windows or Linux. Deal with it, they are facts.

Sometimes it is, sometimes it isn't (just like sometimes it is and sometimes it isn't on Windows and Linux).

Demonstrating your ignorance of Macs, as usual, I see...

Re:Pointless Apple-bashing

[BitZtream]

You got a virus because you downloaded something from somewhere you shouldn't have.

Unless you downloaded something from a SSL site, also had your DNS and your upstream DNS compromised to direct you to a fake SSL download site, and then actually downloaded something via SSL with a stolen cert ... then well theres no way this had anything to do with it.

You got a virus because you did something stupid, not because someone else did.

You got a virus for the same reason every windows user gets a virus, STOP CLICKING ON RANDOM LINKS FROM EMAIL ADDRESSES YOU'VE NEVER SEEN. THERE IS NO PACKAGE WAITING ON YOUR FROM DHL OR REPORT FOR YOU TO REVIEW IN ORDER TO GET YOUR MILLIONS.