Slashdot Mirror
Researchers Find Major Keychain Vulnerability in iOS and OS X
An anonymous reader notes a report from El Reg on a major cross-app resource vulnerability in iOS and Mac OS X. Researchers say it's possible to break app sandboxes, bypass App Store security checks, and crack the Apple keychain. The researchers wrote, "specifically, we found that the inter-app interaction services, including the keychain and WebSocket on OS X and URL Scheme on OS X and iOS, can all be exploited by [malware] to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the App sandbox on OS X was found to be vulnerable, exposing an app’s private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications." Their full academic paper (PDF) is available online, as are a series of video demos. They withheld publication for six months at Apple's request, but haven't heard anything further about a fix.
- "This could happen on Android, Windows and Linux, not just on Apple!"
- "It's only theoretical. It cannot happen in practice."
- "This is not how it works. It's because you don't know how to use your Mac/iPhone.."
Perhaps it's a non-trivial flaw in how they've implemented things and it's going to require nothing short of an overhaul. Six months is nothing to fully implement, test and roll out a fix. I write a software package used in house at a company I work for and it can take weeks to find, fix and test even minor bugs. Just sayin'. You also want to be sure to not introduce new bullshit in your fix. Rush it and you're much more likely to do so and that'll look even worse on such a critical system like this one.
Granted, asking a researcher to not publish results is pretty lame. People have a right to know if they're vulnerable or not.
To be fair I don't even use the keychain for anything other than wifi network passwords.
- Dan
"these problems are caused by the lack of app-to-app and app-to-OS authentications"
There is also regression testing. Done wrong, there are a lot of subsystems that will wind up broken.
I do agree that asking not to public results is lame, but I respect the researcher in heeding that, as KeyChain is a security critical element. I also understand that just hinting at a point of a vulnerability will get people going through things with a fine-toothed comb to find it.
So far, Apple seems to be doing OK when it comes to security. Even jailbreaks are history these days.
So that's how that hacker 4chan did it! /s
Gloating over something like that would be pretty weird. Some people can't just enjoy their toys without pretending to be better than people who choose other toys.
In 2009, I alerted Apple to a major security flaw in their dev portal, in which anyone with an account could lock out admin access of any other account in the portal. I called their support hotline, and got a cocky rep from Ireland who assured me that no, such a thing was not possible, and that my understanding of the situation must be incorrect.
I wonder if they've ever fixed that issue, especially when they took the dev portal offline for a few months to fix other glaring security issues.
Keychain keeps your email passwords. Based on that the hacker can have access to your entire web accounts: financial, shoppings, social media, etc. This reminds me to turn off iMessage's access to phone text messages to at least keep the sms secure from same attack vector. Most financial accounts has two factor verification.
It looks like the attacking app needs to be run before the attacked apps have had a chance to put their own entries in keychain.
From their videos they run their "malware" first, setup an empty keychain entry for whatever it is they'd like the password for (eg. iCloud or facebook through chrome). Then they run the app in question which fills in the password into the earlier created keychain entry. Since the malware is the one who created the keychain entry, it has access to the password.
Definitely a vulnerability. But the attack window seems smallish. But, of course, that varies with a user's activities. If they setup their icloud when they installed (or first logged in) or before they did anything else then it looks like the malware can't do anything. But it still leaves a pretty big window.
I'm guessing that the "fix" would be for there to be no way to share passwords among apps.. or for an app to be allowed to specify that "this password is for me and me alone.. nobody else can have access to it". Non-trivial changes, I'm sure.
Definitely an ugly one.
Should Edward Snowden Trust Apple To Do the Right Thing?
http://yro.slashdot.org/story/...
What do you think?
Researchers Find Major Keychain Vulnerability in iOS and OS X
http://it.slashdot.org/story/1...
"If any question why we died, Tell them because our fathers lied."
such as disallowing modification of system files regardless of an application's permission level.
So buggy insecure code somehow becomes secure if you can't modify it?
Maybe it is non-trivial to fix, but the lack of communication with the original author isn't good. Also, if something is going to take that long to fix the only reasonable thing to do is to publish an advisory so people can defend themselves. If this researcher found it, others can find it. If the only mitigation is to stop using the product, then you have to be honest and say that.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Agreed. Or at the very least, make statement/advisory now that the paper has been published and supposedly the software exploit is alive and well in the App store(s).
"The secret token of Evernote" would be a great RPG title.
... or a porn about a character named Evernote. (sorry about the repost, forgot to quote the parent in the original.)
Not being able to change libstdc++ may have its advantages.
Does it go on forever?
What they're complaining about is that they never heard back from Apple at the end of the six months. I'm sure that if Apple rang them up and said, "Hey, we're still working on a fix", that they'd have been willing to continue withholding publication. No mention of whether the researchers tried to contact Apple again at that time.
It's much better practice to allow a company to close a hole, than to inform users, who, in most instances, could do fuck all with that knowledge, anyway. On the other hand, there are other people who could make use of that knowledge, and that's who you want to keep in the dark, if at all possible.
-- sudon't
Air-ride Equipped
Why would "researchers" even bother? Apple is just going to sue them and cover it up. Don't they read tech headlines?
...and slashdot with all its tweaks couldn't implement a decent captcha. gg
- Dan
whether companies don't hold back on fixes to these reported bugs as a concession to governments... could companies offering private services like iMessage patch some holes, while serving up others to the spooks with the understanding they have a limited time-frame to work, in exchange for generally being left alone?
users, who, in most instances, could do fuck all with that knowledge, anyway.
It is not that bloody hard to switch to another platform in the case of an OS flaw, or hardware vendor in the case of something like the Samsung keyboard hack. A hassle? Yes. But certainly not a case where a user "could do fuck all" at least now iOS and Samsung users can make an informed decision whether to take the risk of sticking with their device or move elsewhere.
On the other hand, there are other people who could make use of that knowledge, and that's who you want to keep in the dark
Which is why responsible researchers wait for a reasonable time before releasing their findings to the public, in this case they waited the 6 months requested from them by Apple.
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
Wow nice way of ignoring the second part of my post where I write that Apple were informed by the researchers 6 months ago. so at a minimum this is how long they have been aware of it but left it unpatched since then. And when Apple were informed they asked the researchers to wait 6 months before going public, which they did! Ignoring an issue doesn't make it go away.
And seriously. How many of the apps you bought do you actually need? My bet, not as many you might believe
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
Because some people think that their choice of phone says something about themselves, frankly choosing between the iPhone and a Galaxy is just having an F150 or a Silverado, its the exact same thing that millions of other people have. Much like the iPad/GalaxyTab/Surface, that product that diehards camp on the street for, covet in the corner of the coffee shop and define themselves by is the exact same product that brickies throw around on the jobsite, 12 years olds get in mass handouts at their schools and/or you get (often pretty scratched up) as a glorified menu at some restaurants.
It is a tool for a job, no need to develop an emotional attachment to it or the company that makes it.
Six months is nothing to fully implement, test and roll out a fix.
if i got this right, the unauthorized cross-app resource access is a design flaw in the way different apps are allowed to interact. the apps are already out there. there is no fix unless you are willing to fix all affected apps as well, or break them.
this is a very serious issue and apple's silence and inaction is truly astonishing. at least some mitigation patch would be in place, asking the user's permission whenever any such interactions are about to happen.
In America, author uses analogy; In Soviet Russia, analogy uses author.
Yes, the F150 is popular. Yes, the iPad is popular. But the analogy ends there.
You should try my Appchain app. It apps all your apps into one app. It even apps its own app into the app.
Yeah, but does it tech the tech? Everyone knows you need to be able to tech the tech to the warp drive to fix serious problems.
Yes, the F150 is popular. Yes, the iPad is popular. But the analogy ends there.
Kind of, but he's right: They are the most common, defacto choice because they are a good workhorse tool for the job. The Android world is full of choice - which can be a good thing - but if you aren't really fussed with that then you just get whatever everybody else has, which is an iPhone - it might be boring to do that but in that circumstance it's the logical thing to do...that's certainly what I did.