Support NeoGAF

PFD · Feb 22, 2014

Apple released a new iOS update yesterday. Initially, it seemed like a very minor update, and the change log was very brief:

This security update provides a fix for SSL connection verification.

It turns out, this update fixes a major security flaw in the operating system that exists on both iOS and OSX. Apple promised a fix soon for OSX.

Here's what Pod2G (security researcher/major contributor to iOS jailbreaks) had to say about this (read from top to bottom):

Here's a technical write-up of why this is bad, linked to by Pod2G

infiniteloop · Feb 22, 2014

Pray For Death said:
Apple released a new iOS update today.

Yesterday.

Interesting take on this here (tinfoil hats on):

On the Timing of iOSs SSL Vulnerability and Apples Addition to the NSAs PRISM Program

IceCold · Feb 22, 2014

So stupid...how could that bug go unnoticed for so long. Nobody does tcp dumps there? This is why it's always a good idea to use curly braces with if-statements no matter what.

PFD · Feb 23, 2014

infiniteloop said:
Yesterday.

Fixed

BocoDragon · Feb 23, 2014

Can 7.0.6 still be jailbroken?

I actually value my jailbreak more than security lol.

condompickle · Feb 23, 2014

I always wished my coconut got messed with. sue apple for a straight 1g. My ipad and last MacBook has been a tank though.

JohnDoe · Feb 23, 2014

OSX too? No fix yet?

*breathing intensifies*

Emperor Bohe · Feb 23, 2014

BocoDragon said:
Can 7.0.6 still be jailbroken?

I actually value my jailbreak more than security lol.

word. anyone know?

kingocfs · Feb 23, 2014

BocoDragon said:
Can 7.0.6 still be jailbroken?

I actually value my jailbreak more than security lol.

It's sad but this is also the first thing I thought of. My bank actually sent me an e-mail about this, though...

Don't Laugh · Feb 23, 2014

BocoDragon said:
Can 7.0.6 still be jailbroken?

I actually value my jailbreak more than security lol.

yes

edit (thanks bocodragon): the new evasion's been released

BocoDragon · Feb 23, 2014

Emperor Bohe said:
word. anyone know?

kingocfs said:
It's sad but this is also the first thing I thought of. My bank actually sent me an e-mail about this, though...

Looks like it's fine.

MuscleNerd on Twitter said:
Apple didn’t apply even 1 update that would’ve broken evasi0n7 at 7.0.6 (i.e. they let JBers have the SSL fix too). Thanks, Apple!

https://twitter.com/MuscleNerd

I'm guessing Apple knows it's a dumb idea to fix their own major flaw and at the same time discourage jailbreakers from doing so.

la_briola · Feb 23, 2014

Braces.

PFD · Feb 23, 2014

BocoDragon said:
Can 7.0.6 still be jailbroken?

I actually value my jailbreak more than security lol.

Fortunately, yes

Download here: http://evasi0n.com/

BocoDragon · Feb 23, 2014

Don't Laugh said:
yes

a new evasi0n will be released soon

Looks like it is already live

http://evasi0n.com/

BGBW · Feb 23, 2014

So are they going to provide a fix for OS X users not on Mavericks?

Bob Dobalina · Feb 23, 2014

BocoDragon said:
Looks like it's fine.

https://twitter.com/MuscleNerd

I'm guessing Apple knows it's a dumb idea to fix their own major flaw and at the same time discourage jailbreakers from doing so.

I'm really glad to see this is the case, even if I think they just had to get a fix out the door without time to block the latest holes.

Like the hat? · Feb 23, 2014

So I just update via my PC then re-jailbreak?

Vyer · Feb 23, 2014

infiniteloop said:
Yesterday.

Interesting take on this here (tinfoil hats on):

On the Timing of iOSs SSL Vulnerability and Apples Addition to the NSAs PRISM Program

Interesting, so the theory here is that the NSA would have discovered the bug and that was when they got added to the prism list?

Guess Who · Feb 23, 2014

BGBW said:
So are they going to provide a fix for OS X users not on Mavericks?

The bug only exists on Mavericks, so no.

BGBW · Feb 23, 2014

Guess Who said:
The bug only exists on Mavericks, so no.

Wow. Snow Leopard still the strongest!

GaimeGuy · Feb 23, 2014

la_briola said:
Brackets.

LMAO.

Don't they have code inspections at apple? Probably a copy/paste error.

Sayter · Feb 23, 2014

Shit. My iP4 can barely handle iOS 6. I wasn't planning on upgrading until the iPhone 6 and iOS 8 came out later this year.

Technosteve · Feb 23, 2014

Wait this was because someone wrote goto fail twice?

xxracerxx · Feb 23, 2014

Guess Who said:
The bug only exists on Mavericks, so no.

Glad I haven't updated yet.

smokeandmirrors · Feb 23, 2014

la_briola said:
Brackets.

Whoops....

Cerity · Feb 23, 2014

Guess I won't be doing all that much important stuff on the 3gs that I'm using while my ZU gets repaired then.

enzo_gt · Feb 23, 2014

Don't Laugh said:
yes

edit (thanks bocodragon): the new evasion's been released

You edited your post, but can I still update through Cydia and not need to rejailbreak for the vulnerability to be patched?

Guess Who · Feb 23, 2014

Cerity said:
Guess I won't be doing all that much important stuff on the 3gs that I'm using while my ZU gets repaired then.

There's actually an update for the 3GS and iPod touch 4th gen (6.1.6) that fixes this, too.

infiniteloop · Feb 23, 2014

Vyer said:
Interesting, so the theory here is that the NSA would have discovered the bug and that was when they got added to the prism list?

Yes. Depending on how far down the rabbit hole you want to go:

1. NSA have not exploited the flaw.
2. NSA found the flaw and exploited it.
3. NSA had a mole at Apple that purposely put in the flaw.
4. Apple consciously put in the flaw for the NSA.

UrbanRats · Feb 23, 2014

BGBW said:
Wow. Snow Leopard still the strongest!

The only mac machines i have are still running Leopard, even.

GaimeGuy · Feb 23, 2014

Technosteve said:
Wait this was because someone wrote goto fail twice?

The first goto fail runs only if the update method returns something other than 0 (which I assume indicates an error).

the second goto always runs.

Basically the code in the rectangle reads like this:

Step 1: If failure condition, goto failure code.
Step 2: Goto failure code.

the code in that screen outside and inside the rectangle essentially verifies that the data, client, and server are all SSL-compliant (I assume). But stuck inside that sequence of verifying each aspect is a random "Execute failure code" instruction that will ALWAYS run if the SSL checks up to that point have been valid.

Tablo · Feb 23, 2014

Did they fix the bluetooth issue yet? Still haven't updated my dad's 5S because of that...

SwiftDeath · Feb 23, 2014

Yikes that's a terrible security flaw and since OS 6.0?

Atilac · Feb 23, 2014

Does this bug exist in iOS 6?

Guess Who · Feb 23, 2014

Atilac said:
Does this bug exist in iOS 6?

Yes.

Devices that are stuck on iOS 6 (3GS and iPod 4th gen) can update to 6.1.6 to fix it. Otherwise you have to update to 7.0.6.

GaimeGuy · Feb 23, 2014

What I want to know is why Apple is automatically sending data unencrypted if the SSL connection fails? Shouldn't they be alerting the user instead and asking them if they want to still send the data without SSL?

Seems like a combination of both bad code and a terrible design for security purposes.

Iolo · Feb 23, 2014

GaimeGuy said:
What I want to know is why Apple is automatically sending data unencrypted if the SSL connection fails? Shouldn't they be alerting the user instead and asking them if they want to still send the data?

Seems like a combination of both bad code and a terrible design for security purposes.

That's the bug, some security checks are bypassed, so a bad connection looks like a good one to the application.

GaimeGuy · Feb 23, 2014

Iolo said:
That's the bug, some security checks are bypassed, so a bad connection looks like a good one to the application.

Well at least the picture is wrong (or at least, not completely accurate in depicting the problem).

For those of you who don't speak code:

Problem #1: The encrypted connection always fails (pictured).
Problems 2 through 5000000000000000000: When an encrypetd connection fails, the system automatically falls back to an unencrypted transmission.

Iolo · Feb 23, 2014

JohnDoe said:
OSX too? No fix yet?

*breathing intensifies*

You can mitigate it for web browsing by using Firefox or Chrome, which are not vulnerable. Check https://gotofail.com to see whether your browser is ok. If you are totally paranoid you should use a browser that was already installed instead of downloading a new one over an insecure Safari connection (although the risk is slight). You could use Chrome on iOS as well, in case you can't upgrade your OS, for example if you don't want to cripple your iPad 3 or iPhone 4 with iOS 7.

This does not help the security of other SSL connections like iCloud or the App Store, although I think app and OS updates are digitally signed which provides an additional layer of protection.

Incandenza · Feb 23, 2014

Is this just for Safari? If I use Chrome exclusively on iOS and Mavericks am I solid?

Ran rp · Feb 23, 2014

So what about my 3rd gen iPod Touch? It can't update past iOS 5.1.1.

Windu · Feb 23, 2014

/facepalm

SRG01 · Feb 23, 2014

PSY・S;101895077 said:
So what about my 3rd gen iPod Touch? It can't update past iOS 5.1.1.

The bug existed from iOS 6 onwards. You're fine.

If you're paranoid, go to the https://gotofail.com/ link above

PFD · Feb 23, 2014

PSY・S;101895077 said:
So what about my 3rd gen iPod Touch? It can't update past iOS 5.1.1.

The vulnerability only affects iOS 6.0 and higher

GaimeGuy · Feb 23, 2014

Incandenza said:
Is this just for Safari? If I use Chrome exclusively on iOS and Mavericks am I solid?

This is from system library code that handles SSL verification from the sounds of it. anything that doesn't utilize its own implementation for Secure Socket Layers (basically every program that connects to the internet and every web browser save for Google Chrome) is vulnerable to sending secure data over an unencrypted channel on Apple devices

Iolo · Feb 23, 2014

GaimeGuy said:
Well at least the picture is wrong (or at least, not completely accurate in depicting the problem).

For those of you who don't speak code:

Problem #1: The encrypted connection always fails (pictured).
Problems 2 through 5000000000000000000: When an encrypetd connection fails, the system automatically falls back to an unencrypted transmission.

Not exactly. You could rename "goto fail" to "goto exit" to remove the confusion; the problem occurs when that block is called with an error code of zero (which is what the second goto does). In other words, when fail is called when there is no failure, it succeeds, bypassing further checks.

Apple's real fail here is not asserting that err is non-zero in the fail block, which would ensure fail is only called on error (and otherwise warn or crash), and would have caught the problem at virtually no cost.

xbhaskarx · Feb 23, 2014

Well then I'm glad I updated...

BocoDragon · Feb 23, 2014

Incandenza said:
Is this just for Safari? If I use Chrome exclusively on iOS and Mavericks am I solid?

Chrome on iOS still uses the safari engine, as I understand it (as all iOS browsers are required to). I bet it has the same flaw.....

SJRB · Feb 23, 2014

This is insane. It took them a year to find this?

How the hell is this even possible?

Iolo · Feb 23, 2014

BocoDragon said:
Chrome on iOS still uses the safari engine, as I understand it (as all iOS browsers are required to). I bet it has the same flaw.....

Chrome did not exhibit the flaw when I tested it on my iPad with iOS 6. The Mercury browser, on the other hand, is vulnerable.

Support NeoGAF

Major security flaw in iOS and OSX, be sure to update to iOS 7.0.6 ASAP

Member

Member

Member

Member

or, How I Learned to Stop Worrying and Realize This Assgrab is Delicious

Banned

Banned

Member

Member

Banned

or, How I Learned to Stop Worrying and Realize This Assgrab is Delicious

Member

Member

or, How I Learned to Stop Worrying and Realize This Assgrab is Delicious

Maturity, bitches.

Member

Banned

Member

Banned

Maturity, bitches.

Volunteer Deputy Campaign Director, Obama for America '16

Member

Banned

Don't worry, I'll vouch for them.

Banned

Member

tagged by Blackace

Banned

Member

Member

Volunteer Deputy Campaign Director, Obama for America '16

Member

Member

Member

Banned

Volunteer Deputy Campaign Director, Obama for America '16

Member

Volunteer Deputy Campaign Director, Obama for America '16

Member

Banned

Member

never heard about the cat, apparently

Member

Member

Volunteer Deputy Campaign Director, Obama for America '16

Member

Member

or, How I Learned to Stop Worrying and Realize This Assgrab is Delicious

Gold Member

Member

Similar threads