#OPEN TRANSPORT MAC OS X MAVERICKS SOFTWARE#
#OPEN TRANSPORT MAC OS X MAVERICKS CODE#

One of the things that worries me is that this bug would have been caught so easily with basic unit tests. It's a simple coding/merge error, and it's actually a regression from previously working code. The Apple bug isn't really in that class of exploit.

#OPEN TRANSPORT MAC OS X MAVERICKS SOFTWARE#

As software gets more complex, the attack surface increases.

While it's true that almost all software has bugs that can result in exploits, I think most of the exploits used in Pwn2Own are typically the result of complex interactions between subsystems that are hard to predict. Bugs are fundamentally hard to find, and it's not really getting any easier. But that's different from claiming the bugs shouldn't have existed (or should have been caught before making it into production). At least Google patches bugs quickly when they surface at Pwn2Own. You could complain about Apple's response to this bug, and that might be a reasonable complaint to make. And all of these products are deployed to millions of users. Chrome don't stop new vulnerabilities from being found on a regular basis. How many of these vulnerabilities are zero-days? A significant number of those.

#OPEN TRANSPORT MAC OS X MAVERICKS CODE#

At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users.' Yes, everyone makes mistakes, we're all human.

Your argument seems to be that it's not a big issue if the security is totally broke since we don't need security in the first place. > That's certainly a problem, but most people are using trustworthy ISPs But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. Steam your online accounts, including email.

Steal your money (MITM your bank connection). Actually with this he can do all of the latter too. All you need to do is go browse the net in a coffee shop, and some stranger can easily do things like: It's not just one application with a critical vulnerability - effectively, it's half (or whatmany) of all OSX and iOS apps with a critical vulnerability. If you consider those, this is worse than any bug in any application. > I don't understand why this is getting more attention that other (seemingly) more dangerous exploits.Д«ecause it's the foundation for a heap of applications and services that were believed to be secure due to use of SSL. > it seems far less crucial than remote-code-execution It does not perform the most essential part of a SSL implementation - verifying that the peer possesses the private key it claims to posses. With this bug, Apple's library isn't actually a SSL implementation. and it's been there for a long time, nobody knows how many systems have already been compromised due to it. I don't understand why this is getting more attention that other (seemingly) more dangerous exploits. Is it just the 'Ick' factor of having something you thought was encrypted actually being fairly open? I'm sure I'm missing something here, can someone help me understand? It seems like this primarily affects people connecting to untrustworthy access-points, such as Coffee Shops, or Airport Wifi - While that's certainly something that needs to be fixed, it seems far less crucial than remote-code-execution, or many other bugs we see regularly. Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies. That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). It's certainly a bad bug, and it ought to have been caught.Д«ut it feels like this would be much harder to exploit than many other bugs which have had far less hoopla.ДЄs I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. Forgive me, but I'm not really sure why this is getting so much attention.

Open transport mac os x mavericks