Slashdot Mirror
Apple Fixes Dangerous SSL Authentication Flaw In iOS
wiredmikey writes "Users of iOS devices will find themselves with a new software update to install, thanks to a certificate validation flaw in the mobile popular OS. While Apple provides very little information when disclosing security issues, the company said that an attacker with a 'privileged network position could capture or modify data in sessions protected by SSL/TLS.' 'While this flaw itself does not allow an attacker to compromise a vulnerable device, it is still a very serious threat to the privacy of users as it can be exploited through Man-in-the-Middle attack,' VUPEN's Chaouki Bekrar told SecurityWeek. For example, when connecting to an untrusted WiFi network, attackers could spy on user connections to websites and services that are supposed to be using encrypted communications, Bekrar said. Users should update their iOS devices to iOS 7.0.6 as soon as possible." Adds reader Trailrunner7: "The wording of the description is interesting, as it suggests that the proper certificate-validation checks were in place at some point in iOS but were later removed somehow. The effect of an exploit against this vulnerability would be for an attacker with a man-in-the-middle position on the victim's network would be able to read supposedly secure communications. It's not clear when the vulnerability was introduced, but the CVE entry for the bug was reserved on Jan. 8."
The update is available to all supported devices (From the iPhone 3GS running 6.1.x and up).
I heard OSX has the same problem.
@Apple: Admit that it exists (plus give advice how to prevent problems) or let us know that OSX is safe.
How does that work? It seems that you need to get iOS 7 to get the patch. Did they back-port it to iOS 6? Or do they have some mechanism like Google does for updating older versions via their app store?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
They also released 6.1.6 which patches this bug.
The bug is that the cn hostname from the certificate is not verified. So it's possible to use your own website SSL cert as a cert for any other site and Apple devices will accept it no question. Of course, to exploit, you'd need to modify a tool like webmitm to serve a fixed certificate.
Very very dangerous, seems to be a result of switching away from OpenSSL although details are still flaky.
in
http://opensource.apple.com/so...
if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
goto fail;
goto fail;
You are a blithering idiot.
Don't forget your tin foil hat on your way out. Now piss off. End off.
The AC seems to be hoping we have all forgotten
"Revealed: how US and UK spy agencies defeat internet privacy and security" (6 September 2013)
http://www.theguardian.com/wor...
Domestic spying is now "Benign Information Gathering"
It's there if you need it, but you have actually to use it.
In the reference they explain why it isn't part of regular -Wall, too.
The AC seems to be hoping we have all forgotten
Bingo!
AC is trying to use bluster and derision to block discussion of Apple's collusion with the US spy agencies.
Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with "brute force", and – the most closely guarded secret of all – collaboration with technology companies and internet service providers themselves.
Through these covert partnerships, the agencies have inserted secret vulnerabilities – known as backdoors or trapdoors – into commercial encryption software.
They're panicking now, and trying to cover up.
Apple's strategy is to release an OS, wait a bit, then start releasing small incremental updates that ought to have been in the initial release in the first place. I suspect they do this on purpose in order to confound the jailbreakers.
What about iOS 6? Is it affected too, and can I get an update without going to iOS 7?
(Now, I don't want eye cancer, TYVM)
Really, why would you trust a system where someone you dont know or trust is in charge of the private keys for the encryption?
And those that cant, send us 700 for a new device. And thanks for playing.
---- Booth was a patriot ----
1) I haven't seen GOTO statements since my GWBASIC days, and I've surely never seen this many.
2) I really like one-liners for if statements in Ruby: "do_this if x==1"
3) Two-liners for C if statements without curly braces feel wrong, are dangerous and hard to read
4) http://xkcd.com/292/
5) GOTO 1
Unlikely to effect me as I never use WiFi and MIM is a bit less likely over a cell connection.
"If any question why we died, Tell them because our fathers lied."
The software Apple distributes to users is proprietary, even if part of that software is built from free software. Proprietary software is never safe for users. Its safety is for the proprietor—what the program allows the proprietor to do to the users.
Apparently memories around here are so short people can't remember when researchers showed Apple can read iMessages anytime Apple wants and the users have no idea which messages are being read. Whether anyone at Apple reads someone's iMessages is a detail so long as Apple can read any iMessage they choose. The same applies to any proprietor for any software which doesn't respect your software freedom. You avoid these problems by avoiding proprietary software.
Digital Citizen
Only if one had the foresight to include -wall in the compiler options AND then actually read all the warnings.
I used the test site set up at https://www.imperialviolet.org... with a X.6.8 rig using both Safari and FF. It passed with flying colors.
Does this mean earlier versions of OS X don't have the bug?
Some days it's just not worth
chewing through my restraints.
Given this bug exists in published open source code, I'm not sure how your point is relevant to this particular issue.
https://www.imperialviolet.org...
Open source code is not a panacea. Have you not been paying attention to the number of RHEL kernel updates (to pick one example) released in 2014?
#DeleteChrome
Unfortunately, Apple seem to have abandoned iOS 5 support already.
iOS 6 isn't even 18 months old yet and was their Windows Vista, so a lot of people didn't upgrade. iOS 7 isn't even 6 months old, had security problems of its own at launch, and runs like a limping dog on some very popular devices still in widespread use, so a lot of people didn't upgrade to that either.
The vulnerability here was caused by a rookie error that could easily have been found and fixed by following any one of several best practices in their software development process, and for something security-related they should have been following all of them.
This is a very poor show from Apple on all counts. :-(
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
iOS 5 does not have the bug (I just checked with 5.1.1)
Grass hopper, this is one of those lessons where you always add { } brackets after any if conditional -- even if its a one line if.
It's not like nobody's ever declared they're done and shipped code without testing it first, or without fixing all the bugs they found, but they obviously didn't test this one.
Fail: goto fail;
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The point you fail to understand is that with software that respects a user's freedom, one doesn't need to wait for someone else to fix the bug for them and then hope that bug actually gets fixed when the ostensible fix is released. Users running nothing but free software have options to fix any bug and verify that fix which proprietary software disallows.
The rest of your statement is a form of false dichotomy—arguing from perfection. I never said anything was perfect.
Digital Citizen
This is exactly when you use gotos in real life. If you look at low-level implementations it's easier to use goto and hit cleanup code than it is to unwind a ridiculous amount of crap.
Also, it's funny - Apple's style guidelines used to require curly braces around all statements in the if, even if it's a one liner. Guess those unix guys have subverted the paradigm.