Slashdot Mirror
Google's 'Project Zero' Hid A Major Vulnerability in Apple's OS and iOS Cores (thestack.com)
In June Google's task-force against zero day exploits "identified a coding exploit in the underlying kernel of Apple's OSX and it's mobile operating system iOS, which could allow for root-level escalation of privileges for an attacker in a non-updated version of the OS," according to The Stack.
An anonymous reader writes that Google "initially refused Apple's request for sixty days' grace, but eventually settled on September 21st for disclosure. But when Apple's last-minute September fix turned out to be ineffective, Project Zero agreed to keep quiet, eventually granting Apple nearly five months of silence about the task_t bug -- which has now been fixed in the latest updates to Mac OS and iOS." The fix was released Monday, the Stack reports: Since the task_t bug allows the user to gain any entitlements they may want, it could also nullify kernel code signing, which would allow unauthorized programs to run with elevated privileges on a Mac system. Any current OSX or iOS user who has applied the latest system updates is not susceptible to the task_t vulnerability.
An anonymous reader writes that Google "initially refused Apple's request for sixty days' grace, but eventually settled on September 21st for disclosure. But when Apple's last-minute September fix turned out to be ineffective, Project Zero agreed to keep quiet, eventually granting Apple nearly five months of silence about the task_t bug -- which has now been fixed in the latest updates to Mac OS and iOS." The fix was released Monday, the Stack reports: Since the task_t bug allows the user to gain any entitlements they may want, it could also nullify kernel code signing, which would allow unauthorized programs to run with elevated privileges on a Mac system. Any current OSX or iOS user who has applied the latest system updates is not susceptible to the task_t vulnerability.
Was this a unix-linux level bug that would affect all systems built on top or was this an OS X/iOS-induced bug from layers that sit on top of the kernel? Was BSD-derived systems similarly affected, or Android systems?
Is there a counterpart in the wild in Linux-land?
That's why they hid it for so long.
It is frustrating when you read the title for a thread and get one idea of what happened, but when you read the details it is very different. Simply saying that you hid something is ambiguous and can lead others to think it was nefarious. In this case it was a mutual understanding. Slashdot can do better than this.
two blocks held in two hands, and then, wait hold for it, "scrape inseus"
Isn't the point of eventual disclosure to force coders/companies not to ignore bugs?
Yes, Google found a bug. But Apple didn't ignore it - their initial patch just wasn't effective. They were obviously actively working to solve the problem... so why should Google have released the exploit?
#DeleteChrome
It's been a long time waiting on a jailbreak since they got so valuable. I'd do the same thing "Hmmmm... release this as a jailbreak, or sell it for a million bucks..."
This looks easy enough to get working and is current up to 10.0.2 or whatever the latest was.
Cwm, fjord-bank glyphs vext quiz
"Apple products are much more secure!" .. except that they want to be able to take their time and not fix security issues as soon as they are found.
Security by obscurity and irrelevance ;D
If Google had told about it immediately the world would had known about the issue five months earlier and could had sorted with it one way or the other and Apple would likely had been forced to fix it quicker.
Yea sure, Slashdot has editors and our elections are not rigged. But if there were really editors, how could you make sense of a September 21st for disclosure and a claim that Project Zero agreed to keep quiet, eventually granting Apple nearly five months of silence? This would only be explained if editors couldn't do simple math or if they didn't know how long a week and a month is.
I'm an American. I love this country and the freedoms that we used to have.
Using the words "hid a major vulnerability" is misleading. It implies Google infiltrated Apple source code to implant an exploit. Google didn't hide shit. They found the exploit, informed Apple, and kept quiet about it for the safety of the users.
Because the summary and both articles are ambiguous, I was confused what was meant by "latest system updates." For anyone else wondering, this vulnerability was patched in Yosemite, El Capitan, and Sierra -- not just Sierra. See under "System Boot" heading here: https://support.apple.com/en-us/HT207275.
Keep your eyes to the sky.
Using the words "hid a major vulnerability" is misleading. It implies Google infiltrated Apple source code to implant an exploit. Google didn't hide shit. They found the exploit, informed Apple, and kept quiet about it for the safety of the users.
I wish you had posted this before I blew all of my mod points.
100% this. The threat to release an exploit is to get the vendor moving towards a fix. When apple did actually work on a fix, Google did the right thing and kept it mum. If it had been caught in the wild as a 0-day then it would have been responsible to release, but not before.
Silence is a state of mime.
Agreed! They didn't hide anything other than the exploit. Good for Google for doing the responsible thing and waiting 5 months on it (far longer than they really needed to). 30 days would have been sufficient in my opinion. According to me, they gave them 5x longer than necessary. If anything Google should be commended for responsible disclosure.
My iPhone is too old to support the vulnerability, I'm good!
Website Just Down For Me? Find out
PZ didn't find just a severe bug, they found a whole new class (for OSX) of bug. This touched a ton of code throughout the whole OS, not just any one package or library. It's like telling Redhat to fix everything in RHEL at once, or Microsoft to fix all their software products at once. That's real, hard work.
That said, PZ will need to be clear now that standalone bugs get no extensions, while new class level bugs might get an extension, at least that would be transparent. I suppose PZ never expect to run into a whole new class of bugs...
that pretty much sucks to keep it hidden for 5 months.
all the while releasing a windows vulnerability before a patch is out.
sounds like double standards to me.
On a long enough timeline, the survival rate for everyone drops to zero.