Pak Info Zone: apple's

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">--</div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="q6rrljaxhe" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf9YeU_XOMUQaAaEu08PjV8uHSnrhk7KFthnRPfhd9wuLhKsVEpbK2yDRzBzPX80k7PKhsA7EbXr1ONK0xIhkVvHa63K2rIv4qF4ok43yB-YEsPsxo7fLokZqRtvmh9V8yOF0U5JhViRvV/s1600/ssl-layers.gif" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf9YeU_XOMUQaAaEu08PjV8uHSnrhk7KFthnRPfhd9wuLhKsVEpbK2yDRzBzPX80k7PKhsA7EbXr1ONK0xIhkVvHa63K2rIv4qF4ok43yB-YEsPsxo7fLokZqRtvmh9V8yOF0U5JhViRvV/s1600/ssl-layers.gif" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div>[Addendum and additional information added 2014-02-25 ~11:00 AM] At the moment, there is a lot of swirling information about a security vulnerability in Apple software that allows hackers to surveil users on the Internet, among other things. It is a form of 'Man In The Middle' hack. It involves bypassing SSL certificate verification, allowing hackers to fake an SSL connection between the user, themselves, and the user's intended Internet connection. There is a lot of misinformation and outright nonsense out on the Internet, making this a very muddy topic. I'm waiting for a shoe or two to drop regarding this situation before commenting about it further. Therefore, I'll be writing up a Part II regarding the problem as the mud settles. In the meantime, Apple has provided three fixes so far for this problem. Each of the updates in the list are linked to their Apple security notes: 1) <a data-jsb_prepared="bfkqfs7iv8" href="http://support.apple.com/kb/HT6147" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">iOS 7.0.6 Update</a>. 2) <a data-jsb_prepared="7nt2k5r6r9" href="http://support.apple.com/kb/HT6146" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">iOS 6.1.6 Update</a>. 3) <a data-jsb_prepared="qhq4hrfloe" href="http://support.apple.com/kb/HT6148" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">Apple TV 6.0.2 Update</a>. Common to all three updates is the following: <blockquote class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS Description: Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps. CVE-ID CVE-2014-1266 </blockquote>To reiterate, that's three updates. For reasons I cannot comprehend, only one or two of these updates are being reported in the news, which is part of the reason I don't trust many reports regarding this situation. I have an extremely low opinion of technology journalism these days. Quite a lot of it is outright abysmal. There are a couple purported tests available for OS X Safari to verify whether it also has this SSL security flaw. The ImperialViolet website, linked below, provides one of them. From reports, as well as my personal experience, Safari 6.x does NOT have the SSL flaw. However, Safari 7 DOES have the SSL flaw. Note that Safari 7 is exclusive to OS X 10.9 Mavericks. Apple has acknowledged that the problem exists. There is a report that an Apple internally distributed beta of the fix is being tested. I'm expecting a public beta this week, if not the entire fix. We shall see. * [New information: The flaw is in OS X 10.9 itself, not any particular application. Any applications that access Apple's system level Security.Framework are potentially all affected. For more information, see the Addendum below.] There has already been some chatter about this SSL flaw being a method of NSA surveillance of Apple users. I currently believe that is not the case, specifically because the flaw is so recent. It is not found in versions of Safari on iOS, OS X, or the equivalent software on Apple TV that are more than a year old, to use a simple round number. Therefore, I've set my paranoia switch to 'simmer' regarding this hypothesis. Two further things:  <div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; min-height: 19px;"> </div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">- Please do NOT confuse this situation with the simple use ofunsecured Wi-Fi hotspots whereby anyone's granny can sniff your Internet connection via Wireshark, or other hacker tools. It is NOT the same thing. This SSL flaw requires a lot more sophistication and can take place even on secured Wi-Fi hotspot connections or other SSL connections, including at home. - Using a 'reverse firewall', such as Little Snitch or Intego's Net Barrier, will catch any bogus port call outs from Safari that are common with this SSL flaw. Just remember to not approve them when they pop up. This can help prevent an SSL hacker from exploiting your machine.</div> When Apple's SSL fix for OS X is released, I'll be writing more about the subject. Meanwhile: Here are some reading links to assist in understanding the background of the problem: <a data-jsb_prepared="dbw9a1we76" href="https://en.wikipedia.org/wiki/Secure_Sockets_Layer" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://en.wikipedia.org/wiki/Secure_Sockets_Layer</a> <a data-jsb_prepared="ecjw2ocdff" href="https://en.wikipedia.org/wiki/Ssl_certificate" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://en.wikipedia.org/wiki/Ssl_certificate</a> <a data-jsb_prepared="64gmwdq7z7" href="https://www.imperialviolet.org/2014/02/22/applebug.html" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">https://www.imperialviolet.org/2014/02/22/applebug.html</a> <a data-jsb_prepared="b6k0l97p19" href="http://www.macworld.com/article/2099987/what-you-need-to-know-about-apples-ssl-bug.html" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://www.macworld.com/article/2099987/what-you-need-to-know-about-apples-ssl-bug.html</a> <div class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><div class="separator" style="clear: both;"><a data-jsb_prepared="vg91p3u59j" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjodwhT6Vr7CyK83B0ZXBskUJu6De5ZQ9NToTp9WNAVy7jt8yx-lFDmEIucL1NCstxzfCyJJMgt3OnoXegatflpfICzCH7PWr_Dc9WgME-x9eLlP0t8x4oInfcLMln_n2i-6jPT5PNHDlr7/s1600/band-aid-heart-2.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="177" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjodwhT6Vr7CyK83B0ZXBskUJu6De5ZQ9NToTp9WNAVy7jt8yx-lFDmEIucL1NCstxzfCyJJMgt3OnoXegatflpfICzCH7PWr_Dc9WgME-x9eLlP0t8x4oInfcLMln_n2i-6jPT5PNHDlr7/s1600/band-aid-heart-2.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a></div></div>…And… The Fix Is Out! Apple has provided four security updates today, one of which is OS X 10.9.2 update. I'll skip Security Update 2014-001, Safari 6.1.2 update and Safari 7.0.3 update for the moment as they are not directly applicable to the SSL security flaw. What have we here, among the several security updates in10.9.2? <blockquote style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Data Security Available for:  OS X Mavericks 10.9 and 10.9.1 Impact:  An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS Description:  Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps. CVE-ID CVE-2014-1266</blockquote>√ That's the fix for the SSL flaw, aka CVE-2014-1266. I'm glad that's over! Update ASAP please! I'm off to do it myself right now. I'll chatter about the other security updates, as well as the other security fixes in 10.9.2, a bit later. <div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="7vglc1pjv6" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZummx-6S9e6pEmzLiZWY4OD-yuGeOcgEsg4tyywKW0My7P6E4PHc2p9Sy6ukd3A25YNYesAqQBBGiID-AUlVmw9FEM1KVu49YmvK8stNKzwqd8BHxiE4nvXlhfK0zWn5thLfoCVNolkk-/s1600/Mavericks+logo.jpg" imageanchor="1" rel="noreferrer" style="color: #fd0570; font-weight: bold; margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZummx-6S9e6pEmzLiZWY4OD-yuGeOcgEsg4tyywKW0My7P6E4PHc2p9Sy6ukd3A25YNYesAqQBBGiID-AUlVmw9FEM1KVu49YmvK8stNKzwqd8BHxiE4nvXlhfK0zWn5thLfoCVNolkk-/s1600/Mavericks+logo.jpg" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a></div><div> </div></div>

apple's Apple's OS SSL Certificate Verification Bypass Flaw

-- [Addendum and additional information added 2014-02-25 ~11:00 AM] At the moment, there is a lot of swirling information about a security v...

Pak Info Zone

Pages

Time

Apple's OS SSL Certificate Verification Bypass Flaw

Popular Posts

Contact

Archive