Slashdot Mirror
Google Warns Apple: Missing Bugs in Your Security Bulletins Are 'Disincentive To Patch' (zdnet.com)
Apple has not documented some high-severity bugs it patched that were reported to it by Google's Project Zero researchers. From a report: While it's good news that Apple beat Project Zero's 90-day deadline for patching or disclosing the bugs it finds, the group's Ivan Fratric recently argued that the practice endangered users by not fully informing them why an update should be installed. This time the criticism comes from Project Zero's Ian Beer, who's been credited by Apple with finding dozens of serious security flaws in iOS and macOS over the years. Beer posted a blog about several vulnerabilities in iOS 7 he found in 2014 that share commonalities with several bugs he has found in iOS 11.4.1, some of which he's now released exploits for.
Beer notes that none of the latest issues is mentioned in the iOS 12 security bulletin even though Apple did fix them. The absence of information about them is a "disincentive" for iOS users to patch, Beer argues. "Apple are still yet to assign CVEs for these issues or publicly acknowledge that they were fixed in iOS 12," wrote Beer. "In my opinion a security bulletin should mention the security bugs that were fixed. Not doing so provides a disincentive for people to update their devices since it appears that there were fewer security fixes than there really were."
Beer notes that none of the latest issues is mentioned in the iOS 12 security bulletin even though Apple did fix them. The absence of information about them is a "disincentive" for iOS users to patch, Beer argues. "Apple are still yet to assign CVEs for these issues or publicly acknowledge that they were fixed in iOS 12," wrote Beer. "In my opinion a security bulletin should mention the security bugs that were fixed. Not doing so provides a disincentive for people to update their devices since it appears that there were fewer security fixes than there really were."
Google Says Bad Things About Competitor - The Shocking Story at 11!
Reality distortion field needs to be kept in tact. Security problems? What security problems? Apple devices are perfect!
iOS12 despite being less than a month old, is on something like 50% of active devices now - who else achieves that kind of patch rate?
Most users will never even look at basic patch notes, much less security info. The people it might disincentive are maybe 0.00000000000000000000000000000000000001% of the user base.
Maybe.
That said I totally agree they SHOULD say when a security bug is fixed so at least everyone has a better idea of what has improved without testing.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
For end user products the incentive to patch should just be that a new version exists. End users won't know what to make of CVE # or other technical information anyway. Just plainly mentioning that it fixes security issues should be enough.
Last I heard CVE was being terribly mismanaged, with numbers taking weeks to get assigned (even though they're just sequential numbers and any idiot could hack that together). Does Google know that Apple hasn't assigned the CVEs, or is CVE just not bothering to assign them numbers because they can't figure out how to handle N+1?
Google didn't mention to anyone the issues they had with Google Plus. That said, Apple's devices have always been better updated than any Android device. Apple provides OS updates and patches for about 5 years on their phones whereas Android updates are very hit or miss except for Google's own phones. You're lucky if you get 2 years on major phones and less on cheap ones.
And when Apple does put out an update, every phone and tablet will nag you death to get it installed. Every day it will ask you to install it or remind you later. So, they never have to tell you what they're patching, or what they're changing - you update just to get rid of the daily annoying popup.
The reason that iOS has an upgrade rate that's 10x that of Android is because Apple has conditioned its users to constantly upgrade their OS. My wife upgrades her iPhone without knowing or caring what's in the update. It's always something that makes her phone better in her mind. The only people who care about CVEs are security researchers and extreme geeks like me.
If you say "iOS 11.4.1 fixed CVE-2018-4293 which allowed cookies to persist unexpectedly in CFNetwork calls" to 99.99% of Apple's customers, the only word in that sentence that the might understand is cookies, and their take is "cookies are bad". Putting this in the patch notes doesn't mean anything to regular humans, and it shouldn't.
People should be able to trust that their device manufacturer will keep their phone safe. Apple is the only phone manufacturer (except maybe Google) that does this, and they're the only one people trust to do so.
- Vincit qui patitur.
... The absence of information about them is a "disincentive" for iOS users to patch, Beer argues. ...
I would argue that the details about exactly what bugs -- or even how many bugs, for that matter -- are entirely immaterial to whether or not the vast majority of iOS users are going to install any given security patch. It's pretty simple, actually: release a patch, and tell users that it's related to security. That's it; no further details are necessary. Frankly, most people either don't understand or don't care about the details; their behavior isn't going to be changed in the least by those few extra words that they aren't going to bother reading anyway. And the people who would actually read (and understand) those details fall into two basic categories: those who will patch immediately, regardless of the details, (because, security!!) and those who will delay patching for as long as they reasonably can, regardless of the details. (An obvious example of the latter could be IT types, who are required to manage large numbers of end-user devices.)
No; I think Fratric and Beer are both missing the forest for the trees, and I think there's a pretty obvious reason: all they really care about is their fifteen seconds of fame... that little bit of acknowledgement from Apple, that they done good. Unfortunately for them, Apple happens to know their target audience pretty well, so it's not particularly likely that Beer's latest bit of whining is going to elicit even so much as an annoyed snort from them.
Why do they not update the Python 2.7.10 in their systems? Because there's a needed security hole.
Why do they wait for 10 months to patch security holes in critical components even when all the work is done and handed to them? Because there's a needed security hole.
Why do they routinely ignore security researchers reports on security issues in iOS and macOS? Because they are lying assholes.
If you think your Apple device is secure, then you're just lying to yourself.
So some prick in marketing decided it looks bad if Apple actually admits there were some security problems with its OS, even though they were dealt with promptly and competently after Project Zero found them. Having been in that kind of meeting before, I could probably write a near-verbatim transcript of the little bastard's remarks even without having been in the room to hear them.
Said prick should be fired on the spot "pour encourager les autres", because the Project Zero people are 100% right about how users look at updates. If they know there's a security issue, they'll probably install it in a timely manner, or at least be especially alert for problems. If there isn't a warning, basic user experience, no matter what operating system they use, has proved time and again it's sensible to wait for a while after an update is rolled out to see whether problems emerge in a week or two that weren't immediately obvious.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
They aren't reporting they've fixed all the ISIS exploits? ISIS had 100s of exploits all infecting terrorist bugs 24/7 basically Obama's whole second term. Can we get an list of THAT? Started around 2013 when John Brennan became CIA director, and ended around 2017 when Trump took over and replaced Brennan with Pompeo.
You might want to re-check that figure. Even if it's just *one* person out of the entire 7+ billion that exist on the entire planet, that's still a lot more, as a percentage
Incorrect, that percentage was scientifically calculated using Wolfram Alpha, by asking it how many people cared and to what degree did they actually care.
I should have presented the error though, it's a figure accurate to 0.0000000000000000000000000000000000000000000000000000000000000000000000%.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Google should just stop caring about iOS bugs and let Apple learn about them the hard way...
When many fAnboys will have been biten again and again by bugs, Apple's image will be way less the image of a "secure device which never has critical bugs".
Also, IT departments should be able to make serious decisions about the security (or unsecurity) of a device before allowing it on the enterprise network... which means having correct bug disclosure...
Apple's security bulletins also neglect to mention the presence of cucumbers in its software.
They are now defending that it's ok for Apple to hide from the user that the devices had security problems.
Update notes should include what changed, specially security changes. It doesn't matter that most people would update anyway. The people not updating might read the notes and understand that it is just to slow their phones down so that they buy a new one (a very common complain on iphone users) when in reality there as a legit reason to update.