On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM

The OSX/IOS SecureTransport TLS vulnerability is getting coverage because it's easy for laypeople to understand. Any geek can look at a description of the bug, or even the code itself, and say to themselves, "hey, I could exploit that!". Because more people understand this bug than they would any other bug, it paradoxically seems scarier.

The reality however is that the ease with which a bug can be exploited has little to do with its impact. What matters is the feasibility of exploitation. And in terms of feasibility, this bug is less exploitable than the kinds of bugs that are disclosed in every platform every month; it requires a specific (common, but not universal) set of circumstances to escalate it to code execution.

Matthew Green told a Reuters reporter yesterday that the TLS bug was "as bad as could be imagined". He was also drinking†, which explains how he managed to find a TLS validation bug worse than memory corruption, which is discovered routinely in all platforms, and produces attacks that directly, instantly hijack machines regardless of their configuration and the network they operate on.

Vulnerabilities in TLS code are not all that unusual. We get a new one every couple years or so. There was a vulnerability in the NSS False-Start code a year ago --- it didn't get covered because (a) few people know what NSS is (it's the TLS library for Firefox and Chrome) and (b) nobody knows or cares about False-Start. Here's another example: NSS misparsed PKCS1v15 padding, such that an e=3 RSA certificate could be forged --- anyone on the Internet could run a small Python script to generate a certificate for any site. Certificate chaining has broken within the last ~4 years ago. Again, no coverage: what's e=3 RSA? How does chaining work?

Simple thought experiment: imagine if, instead of a missing-brace bug that broke all of TLS, it was instead disclosed that NSS had a memory corruption vulnerability in its PKCS1v15 parsing. Would there be a shitstorm in the media and on Twitter? I doubt it: comparable bugs are found routinely without shitstorms.

I don't know if NSA knew about this bug or didn't. If they did, I'm confident that they exploited it; that's what they do. But ask yourself if you're sure that NSS and SecureTransport and OpenSSL and SCHANNEL are free from the kinds of memory corruption vulnerabilities that would allow NSA (and other organized criminals) to hijack machines directly. You think this is the bug they're relying on?

† No, really.

Sneaking this in, and being the 1st (or only) group to know about it, would be valuable to lots of amoral entities, from solo criminals up through state actors. Simply being bold enough to use a bogus signing-key (different than the one in the certificate you just showed) was enough to fool every iOS6/7 device for more than a year!

I'd personally hope that the NSA would be more subtle, and has a longer-term interest in ensuring Apple products seem secure. Other state actors or criminal gangs would be more interested in a short-term benefit, and then wouldn't mind that afterward Apple (and US tech in general) gets egg-on-their face. That could be icing on the cake.

I hope Apple does a deep-dive on how this happened – not just "5 whys" but "50 paranoid whys" – including looking at the employee who made the change's background and personal security practices.

What if the person it's traced to does not recall making that change? What if they find evidence that systems designed to catch such a thing were themselves subverted, such as different code shown to a reviewer, or build tools set to suppress certain warnings? It might be a simple slip up... or a very, very deep compromise that takes weeks or months to unwind.

Letting my paranoid imagination roam wild, recall a few years ago when Google suddenly became very, very chilly towards China, after reports of some deep compromises. My hunch is that Google perceived a threat so extreme – like an attempt to hijack their auto-update mechanisms – that it resulted in an all-new level of lockdown and resentful cold war. What if this is a similar existentially-revelatory moment for Apple, with regard to some state actor?

Unless, of course, we are now using the term PRISM to refer to all NSA activities that we don't agree with.

Gruber should know better.

In June 2010 I reported that Safari 4 did not check the last letter of the hostname, so a certificate for example.de was accepted when accessing example.dk, and it would accept cert for example.co.ug when accessing example.co.uk

The real problem is that Apple did not add unit testing when they fixed the problem in 2010. If they had, the goto bug would have been found.

1) The NSA knew about it, and exploited it.

2) NSA itself planted it surreptitiously.

3) Apple, complicit with the NSA, added it.

Such a bug would've never lasted this long without NSA knowing about it. Even if they didn't find it themselves, which seems unlikely, they would've bought it from the exploit black market long before now. There are people who all they do long is try to find exploits in the iPhone.

And as we know, if NSA can do something, NSA will do it. So they most definitely took advantage of that "bug" and everyone's data that they could get through it.

To me the more likely scenario is still that Apple cooperated with the NSA here. The "adding to PRISM" at the same time this bug appear is way too coincidental.

While it seems possible that Apple conspired with the NSA to add a security hole in SecureTransport, I doubt it. According to sources in the article, this bug was introduced in iOS6; and I haven't heard a mention of it until yesterday, despite it being open-sourced (http://opensource.apple.com/source/Security/Security-55471/l...).

Since nobody was raging on the internet about this bug, I see it as a good-faith effort by Apple to fix a bug that they've just discovered.

I only just heard about this bug a couple of hours ago. I can not for the life of me fathom how this code was not tested. Surely this is a basic function of the security code. You can test for it with a simple bit of js. If something as important and easily testable as this is broken, what other subtle issues are down there?

I, for one, no longer trust the Apple's software (I know that seems a bit dramatic but I just don't enjoy using it anymore, on any level). Intentional or not, this has all been handled very badly. Massive security hole, quietly releases iOS update, doesn't offer update for their freaking desktop os.

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

"Demands made to the companies". It looks to me like PRISM was a voluntary thing, even if the companies didn't know it was named PRISM.

If that's the case, and Apple's "bug" happened at the same time with their voluntary addition to PRISM, then the bug was actually a backdoor, and Apple knew about it.

The idea that they are as fiercely hostile to the security of millions of americans as taking advantage of the vuln would require, is absolutely terrifying.

I get it. NSA is behind everything. And at the end of the article, OP says "[so] if this bug, now closed,2 is not what the NSA was exploiting, it means there might exist some other vulnerability that remains open." So why are we writing this article if there are other bugs?

Okay. I will give the credit and think about it: anyone could be NSA mule. Anyone can contribute to your OSS and inject some clever code into your OSS codebase. And we usually overlook security and just accept anyone's PR as long as the code makes sense. Yeah, think about someone cleverly injecting a line into your docker release or your openstack release last month.

So, the point is: be alert? Be aware of spy everywhere? This reminds me of a scene in movie Eden. Bob, the corrupted federal Marshall, who was actually a PIMP, once said to other marshals: "So who are you [looking for human trafficking mules] looking for? The answer is everyone."

Hence, the main point is: trust is destroyed.

XMPP isn't just for chat, it's for video, server to server message passing, status updates, etc...

> NSA itself planted it surreptitiously.

> Apple, complicit with the NSA, added it.

Neither seems very likely given how visible the goto is. Something just a little more subtle like a semicolon at the end of the if() clause might look better.

Of course given how glaring it is, it could be a case of plausible deniability: would we do something to stupid, so unsubtle.

Just for the record and off topic, this is known as the Hanlon's razor. It's usually attributed to Robert J. Hanlon, not Napoleon Bonaparte.

This is such an easy exploit that somebody found it and was using it. There is no way that this was not spotted by Apple in the field.

> Never attribute to malice that which is adequately explained by stupidity.

A programmer screwed up. It happens every day.

I'm reminded of Chesterton's madman:

>The madman’s explanation of a thing is always complete, and often in a purely rational sense satisfactory. Or, to speak more strictly, the insane explanation, if not conclusive, is at least unanswerable; this may be observed specially in the two or three commonest kinds of madness. If a man says (for instance) that men have a conspiracy against him, you cannot dispute it except by saying that all the men deny that they are conspirators; which is exactly what conspirators would do. His explanation covers the facts as much as yours. Or if a man says that he is the rightful King of England, it is no complete answer to say that the existing authorities call him mad; for if he were King of England that might be the wisest thing for the existing authorities to do. [...] Nevertheless he is wrong. But if we attempt to trace his error in exact terms, we shall not find it quite so easy as we had supposed. Perhaps the nearest we can get to expressing it is to say this: that his mind moves in a perfect but narrow circle. A small circle is quite as infinite as a large circle; but, though it is quite as infinite, it is not so large. In the same way the insane explanation is quite as complete as the sane one, but it is not so large. [...] If we could express our deepest feelings of protest and appeal against this obsession, I suppose we should say something like this: "Oh, I admit that you have your case and have it by heart, and that many things do fit into other things as you say. I admit that your explanation explains a great deal; but what a great deal it leaves out! Are there no other stories in the world except yours; and are all men busy with your business? Suppose we grant the details; perhaps when the man in the street did not seem to see you it was only his cunning; perhaps when the policeman asked you your name it was only because he knew it already. But how much happier you would be if you only knew that these people cared nothing about you! How much larger your life would be if your self could become smaller in it; if you could really look at other men with common curiosity and pleasure; if you could see them walking as they are in their sunny selfishness and their virile indifference! You would begin to be interested in them, because they were not interested in you. You would break out of this tiny and tawdry theatre in which your own little plot is always being played, and you would find yourself under a freer sky, in a street full of splendid strangers"