Slashdot Log In
How Apple Orchestrated Attack On Researchers
Posted by
kdawson
on Tue Mar 20, 2007 10:49 PM
from the no-way-to-win-friends dept.
from the no-way-to-win-friends dept.
An anonymous reader sends us to George Ou's blog on ZDNet for a tale of how Apple's PR director reportedly orchestrated a smear campaign against security researchers David Maynor and Jon Ellch last summer. Ou has been sitting on this story ever since and is only now at liberty to tell it. He posits that the Month of Apple Bugs was a direct result of Apple's bad behavior in the Maynor-Ellch affair. From the blog: "Apple continued to claim that there were no vulnerabilities in Mac OS X but came a month later and patched their Wireless Drivers (presumably for vulnerabilities that didn't actually exist). Apple patched these 'non-existent vulnerabilities' but then refused to give any credit to David Maynor and Jon Ellch. Since Apple was going to take research, not give proper attribution, and smear security researchers, the security research community responded to Apple's behavior with the MoAB (Month of Apple Bugs) and released a flood of zero-day exploits without giving Apple any notification. The end result is that Apple was forced to patch 62 vulnerabilities in just the first three months of 2007 including last week's megapatch of 45 vulnerabilities."
Related Stories
[+]
Month of Apple Bugs Debuts in January 171 comments
An anonymous reader writes "A pair of security researchers has picked January 2007 as the Month of Apple Bugs, a project in which each passing day will feature a previously undocumented security hole in Apple's OS X operating system or in Apple applications that run on top of it. According to a post over at The Washington Post's Security Fix blog, the project is being put together by researchers Kevin Finisterre and the guy who ran November's Month of Kernel Bugs project." From the post: "It should be interesting to see whether Apple does anything to try and scuttle this pending project. In November, a researcher who focuses most of his attention on bugs in database giant Oracle's software announced his intention to launch a "Week of Oracle Database Bugs" project during the first week of December. The researcher abruptly canceled the project shortly after the initial announcement, without offering any explanation."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So I don't get it... (Score:5, Interesting)
Yes, you could see in the video that they used a 3rd party driver. However, was it really CLEAR that the exploit only existed for the 3rd party driver? Maynor and Ellch certainly did NOT dwell on this -- they in fact spent more time saying they enjoyed doing this because Mac users were "smug."
And, gullible as the press is, the press most certainly did NOT report "3rd party flaw exposes OS X security hole!" It was more along the lines of "OMGMACCRACKOVERWIRELESS!" It was days before it was clear, and even then it was necessary to specifically explain this to people. Sure, the video showed this, but the fact of the matter is that most people, including the press, did not UNDERSTAND this fact... and this was clearly obvious from the reaction to the matter in the first place.
And what I also don't get is... what are you really showing if you use a 3rd party wireless driver to hack a MacBook which has BUILT-IN wireless? Sure, you can do it, but is that a realistic scenario? I mean, I could compromise someone's system if I stole it and they didn't have disk encryption turned on as well... is that a hack?
Re:So I don't get it... (Score:5, Insightful)
But the quality of third party device drivers isn't really something you can blame Apple for, at least I don't think so. I don't blame Microsoft or Linus if nVidia fubars a driver, I blame the company whose name is on the driver.
Parent
Re:So I don't get it... (Score:5, Informative)
Well, I guess it's moot right now, since Apple broke it's wireless support thoroughly with the 2007-002 update [apple.com] back at the beginning of March, and has remained silent about addressing the problem since then. I've been back to wired connections for weeks now.
It is somewhat problematic to try to hack a connection that won't connect. :-)
I suppose eventually they'll fix this; the silence is a little disturbing, though. It seems... poorly thought out.
Parent
Re:So I don't get it... (Score:5, Interesting)
No question that the update worked for some people. Including - presumably, anyway - the developer who built it.
But the thread I pointed out was but one of many that has sprung up this month, each with several, sometimes many, Mac users going "say... what the heck?" Take look at the other threads. Tons of people talking about failures, with one or two saying "worked for me." Lots of well-intentioned people (not from Apple) suggesting workaround attempts (try deleting your lists of trusted networks, switch encryption modes, use ethernet) and no one saying "here is Apple's fix." That's not the ratio you want to see.
My own situation is Mac centric; I use a mini Intel dual-core as the source of the wifi, and normally have various Mac clients, an XP client, a Wii client and a PS3 client. The update hosed me; no individual client or set of clients can connect to the mini more than once; the mini has to be rebooted before a new connection can be opened. My network is open; no passwords, no WEP or WPx or etc.; There are no other wifi networks within reception range, no competing signals in the same spectrum (rural life has at least these advantages), and the distance of any client to the mini is less than 30 feet along any one vector - meaning full strength reception, basically - so it is about the simplest situation you can imagine.
Everything had been working perfectly until 2007-002. Since then, I've added the .9 update to the OS, no change. Considering that adding 2007-002 to the mini broke the XP machine's ability to play client, I'm rather convinced that there are multiple problems - most reports talk about their Mac not talking to a hub (such as a DLink) - so they can't have broken host for them, only client; while in my situation, the Mac *is* the host, and the update would not have affected the XP, Wii or PS3 clients, though it could, and apparently did, hose my Macbook pro and the other minis. So there are at least two problems, one for host use and one for client use.
It is an interesting and frustrating situation. I hope it is resolved shortly. I don't much like having Ethernet strung all over the place at home, and I can't take my Macbook pro anywhere and get online via wifi; it won't connect unless it is wired. Luckily I have an ethernet connection at work, we don't use wifi there; but I *was* in the habit of surfing at the coffee shop, the doctor's office, the hospital and at friend's houses. You don't realize how much you're going to miss convenience like that until it's gone.
Parent
Re:So I don't get it... (Score:5, Insightful)
Parent
Locked up by process? (Score:5, Insightful)
Debian.
Thats all, just Debian and their record on timely releases.
Parent
Re:So I don't get it... (Score:5, Informative)
1 and 3 were in quicktime (an apple product, but not Mac specific)
4 was in iLife (mac specific)
9, 10, 11, 12, and 13 were related to loading
14 was in appletalk
15 was in the permissions on the
23 was in QuickDraw (mac specific)
24 was in the Mac auto-update logic
28 was in the crash dump handling logic
29, and 30 were in various Mac specific utilities (iChat, Safari, HelpViewer).
I don't think that's "a significant minority". By my guestimate, 5 of the 30 were in 3rd party apps.
Parent
Re:So I don't get it... (Score:5, Informative)
23 in software by Apple
1 in software by Adobe
1 in software by Insanity LLC.
1 in software by Videolan
1 in software by The Omni Group
1 in software by Javelin.cc
1 in software by Maxum Development
1 in software by Panic Inc.
1 in software by Telestream/Microsoft
31 issues, of which:
17 in OS X
8 in third party apps not installed by default
3 in Apple apps installed by default
2 in a third party app for OS X and Windows, not installed by default
1 in an Apple app not installed by default
1 in an Apple app for OS X and Windows
Parent
i didn't know that. (Score:5, Funny)
Karl Rove is Apple's PR director?
George Ou? (Score:5, Informative)
This all sounds a little fantastic to be true. Most folks at Apple I know don't have time for an agenda. And speaking of agendas, George Ou's definitely got a hard-on [zdnet.com] for Apple.
Re:George Ou? (Score:5, Insightful)
I take it you don't know anyone from Apple's [slashdot.org] legal [theregister.co.uk] department [wsj.com]?
Parent
Doesn't quite wash (Score:5, Insightful)
I doubt the real truth has actually surfaced just yet, and it may be a long time, if ever, that it does.
I don't quite buy it. (Score:5, Insightful)
At any rate, though, I don't think it's really any surprise that large parts of Apple still bow to the notion that "if there's a bug in the code, and nobody outside of the company knows about it, is it really a bug?" somehow warrants a 'yes' answer. So as a Mac user, I'm not really unhappy at all that MoAB happened, for whatever reason. I'd rather have stuff out in the open, and patched quickly, than some sort of quasi-secret (because, let's face it, if more than one person knows about it, it's not a secret anymore) unpatched vulnerability. I like Apple's gear but that doesn't mean I don't think they need to get a swift kick in the ass every once in a while to stay on top of things.
Ou appears to be a liar (Score:5, Informative)
http://www.tuaw.com/2007/03/20/clarification-on-t
"While I'm flattered at the possibility of Apple even talking to me, the truth of the matter is that the company pretty much ignores TUAW, and most other Apple-related blogs, entirely. Honestly: Fox and I never exchanged so much as a "mwahaha" over email, or any other form of correspondence for that matter. I've never been contacted by anyone from Apple regarding anything besides the fact that one of my older PowerBook's warranties was about to expire, and that AppleCare would be a great way to stay within their graces."
Re:Ou appears to be a liar (Score:5, Insightful)
Stop posting anything about these guys, they don't deserve the publicity, and all this crap about smearing and breaking Apple's hardware is both moot and full of willful misinterpretation. These guys are attention seekers and no more.
Parent
You can smear shit.... (Score:5, Insightful)
MOAB as "revenge"? A number of "Apple's" bugs as listed in MOAB were in third-party software (VLC on day 2 for fuck's sake!), the same as their original hyperbolic wireless exploit shenanigans. And then they go and use an exploit on the site, and act like petulant children in their communication with others through the site, all the while crying foul that they aren't being treated like serious security professionals.
Re:You can smear shit.... (Score:5, Interesting)
Which of course brings up another point: how does fucking over Omni Group (who have an excellent record of responding to such things very promptly) by publicising a bug without telling them about it first count as "revenge on Apple"? How does "outing" multi-platform bugs in open source projects instead of simply supplying patches to fix them do anything whatsoever to Apple? If these people had a beef against Apple for something or other, then take it out on Apple, not products or projects that have no connection with them besides running on Apple's OS.
NB: I don't know if I'm the only one who noticed that MOAB didn't publish a single bug in Microsoft Office for the Mac despite it (a) having rather a lot of them, and (b) being much more popular on OS X than any of the 3rd. party products or projects they did "examine". Given Microsoft's notably poor record with security issues in Office for Windows, I would have thought that this would have been the first non-Apple product they looked at (closely followed by IE, MSN Messenger, Media Player, and various other known sources of a multitude of exploits on Windows). I'm not suggesting this indicates any involvement by MS in MOAB (I'm not a conspiracy theorist who believes that they're behind every spiteful bunch of childish wankers with a vitriolic hatred of Apple, Linux, or whatever), but rather that it's possibly indicative of a notable bias which the so-called "computer press" doesn't seem to have noticed.
Parent
What a continuing cry for attention (Score:5, Informative)
Apple never claimed there were no flaws in their drivers, I don't know how many more times this can possibly be stated to Ou, if it is necessary to use shorter words with fewer syllables or what. Apple's only statement on the whole matter was that Maynor never provided any specific information to Apple as to what this specific security hole was supposed to be. He jumped up and down and waved his arms and told Apple they needed to fix it real soon, but neither he nor Ou nor anyone else has provided any kind of documentation indicating he gave any actual, useful information to Apple about this security vulnerability. He just made vague pronouncements about wireless security and then expected Apple to read his mind, as far as all the available evidence can prove.
Yes, Apple released patches for network drivers after this whole announcement was made -- they released patches for network drivers before then, too!
Ou continues to be either grossly deceived, completely inept at actually investigating and reporting, or so caught up in his ego that he can't recognize he's been played like a piano.
This is not a case of Apple hiding their heads in the sand, running a smear campaign, or fanbois refusing to accept that something could be less than perfect.
Provide some actual evidence and people will listen to your fearmongering, but it's been a year already since this "huge vulnerability" was disclosed and the most we've seen is a computer crash!
March is 'month of slow news days' on slashdot. (Score:5, Funny)
Skeptical (Score:5, Insightful)
I believe they actually claimed they hadn't had the vulnerability in question demonstrated to them. The fact that they later patched *a* vulnerability in wireless drivers doesn't necessarily prove anything. If it does, then as an Apple basher, my future plan will be:
a) announce that I've found a vulnerability in in $OSX_FEATURE.
b) ignore requests for details, proof, etc
c) be universally regarded as an idiot
d) Wait until someone else finds a vulnerability in $OSX_FEATURE and Apple patches it.
e) trumpet from the rooftops that I said there was a vulnerability in $OSX_FEATURE months ago and OMG! Apple denied it and look, they've just fixed it and I was right all along!
f) Smugly watch the sensationalist articles about how Apple bullied me.
Re:Apple is Evil. (Score:5, Insightful)
Let me ask you this-
What has Microsoft ever done for the open source community other than to try to undermine Linux?
What has Apple done to support the open source community?
Do technologies like hardware acceleration for X windows, more focus on open standards (Open LDAP, SMB, etc.), make Apple as evil as microsoft?
Jobs is as bad as Gates in some respects, but a blanket statement like this cannot possibly apply in all aspects of their work. Is Bill bad because he is supporting his charity now? Is Steve Jobs bad for spending his own money to make an animation company that produced quality family films? You can't judge on one level- it's simply impossible. Your argument needs better qualification. Saying that you like "open source and community review" will earn you a few karma points on slashdot, but in my book that post was all about "Apple is Evil."
< pinky to corner of mouth >
Parent
Re:Apple is Evil. (Links) (Score:5, Informative)
#324253 [mozilla.org], a cross site XSS exploit which nobody responsible for the code seems to care about.
#45375 [mozilla.org], a request to make tooltips not cut off at an arbritrary length, which they refuse to fix in Firefox apparently out of spite.
#18574 [mozilla.org] - The MNG bug... you really have to see this farce with your own eyes. Especially the bit where the asshole in charge of the image code stated that the MNG DLL has to fit within his deliberately impossible to reach size requirements before he'd even consider re-adding it.
Parent
Nov 14, 2006 (Score:5, Informative)
With the latest patches, according to Secunia, Safari has 4 outstanding unpatched advisories, of which the most severe is "Less critical."
By comparison, Firefox 2 has 3 unpatched Secunia advisories, with the most severe also being "Less critical."
IE6 has 20 unpatched advisories, with the most severe rated "Moderately critical." IE7 has 7 unpatched advisories, with the most severe also rated "Moderately critical."
Parent
Re:Go Figure! (Score:5, Insightful)
Once you get past your fascination with Artie, you'll see that many Mac users do not, in fact, think the Mac is utterly and totally bulletproof. OTOH, we're also aware that compromised Windows machines can be found by the hundreds of thousands in the botnets that generated some 90% of the email (spam) traffic last December, while there hasn't been a single large-scale exploit of the Mac since OS X came out.
The sheer difference in exploit numbers suggests that the Mac has some good things going for it in terms of security. Does that make the Mac perfect? Of course not. Does that make the Mac less likely to suffer data loss or force its owner to waste time checking for digital cockroaches every day?
Yes.
Parent
Re:Shooting fish in a barrel (Score:5, Insightful)
No one believed this story about Apple pressuring the security researchers for 2 reasons. No security company would actually let their name be dragged through the dirt by the internet community for the sake of saving face for another company especially Apple. Secondly their story changed by the day and requests to see an exploit/method/code release were constantly denied. The only demonstration was highly dubious as it was presented as a video.
Since the fiasco came about Apple did then commission an external company to look for bugs in their airport drivers, while some bugs were found they were unrelated to the publicised "macbook remote exploit" (the security researchers gave such little information anyway.)
Then finally once all the patches were out by Apple, the security researchers piped up again claiming that the exploits they discovered were the ones that Apple had patched. (When in all reality they probably just examined the old and new drivers and looked for the differences.)
Suggestions that Apple users are blind, security unaware dummies is what caused most of the outrage. Going out claiming that the Apple user base believe they are impervious to spyware/viruses/etc. is an invitation for negative feedback. It has very little to do with "Attacking the mac-zealots precious platform"... after all much of the operating system is open source darwin, a BSD implementation.
As for the followup month-of-apple-bugs and other negative security feedback, those are most definitely not solely rooted by this sole affair. Ou is merely trying to spin them this way to provide some kind of grass-roots response to his purported conspiracy.
Parent