On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to the NSA’s PRISM Program

[Jesus Malverde]

the SSL vulnerability was introduced in iOS 6.0. It is not present in 5.1.1 and is in 6.0.

iOS 6.0 shipped on 24 September 2012.

According to slide 6 in the leaked PowerPoint deck on NSA’s PRISM program, Apple was “added” in October 2012.

These three facts prove nothing; it’s purely circumstantial. But the shoe fits.

Sure would be interesting to know who added that spurious line of code to the file. Conspiratorially, one could suppose the NSA planted the bug, through an employee mole, perhaps. Innocuously, the Occam’s Razor explanation would be that this was an inadvertent error on the part of an Apple engineer. It looks like the sort of bug that could result from a merge gone bad, duplicating the goto fail; line.

I see five levels of paranoia:

1. Nothing. The NSA was not aware of this vulnerability.
2. The NSA knew about it, but never exploited it.
3. The NSA knew about it, and exploited it.
4. NSA itself planted it surreptitiously.
5. Apple, complicit with the NSA, added it.

http://daringfireball.net/2014/02/apple_prism

Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS

http://support.apple.com/kb/HT6147?viewlocale=en_US&locale=en_US

[bemildred]

1. If it's under revision control, they should be able to retrieve who did it.

And if it isn't they need to ask why not? It should be.

[Jesus Malverde]

3. I'm sure they know

They are unlikely to tell us, and its unlikely the government inquire.

We do know the NSA is sitting on a bunch of Zero day exploits that they are keeping unpatched.

[bemildred]

5. So they release the bad code fragment, but not how it got there?

How subtle.

It looks like an accident, but it circumvents that final test. I've done that to myself more than once, both on purpose and by accident. One time was actually in some authentication code I was writing (that one was an accident).

[Jesus Malverde]

6. Looks like apple actually open sourced this code.

http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c

[bemildred]

7. Nothing wrong with that, as such.

But you have to have revision control once you field it or I'm done trying to figure it out.

And with revision control, you should be able to see what changed and how, and that might help understand how it got there. If there was a prior test that got deleted and left the goto, that would suggest coding error. If not, maybe not.

I don't like goto much, but I found myself using it in authentication dialogs because of the way they work, everything else was uglier.

But Apple may not want to get to close to the idea they are not wizards, hence the silence, they can let NSA take the heat.

[Make7]

2. And what does the timing of the patch say? ( n/t )

[Jesus Malverde]

4. It's curious

We don't know how the bug was found. They don't credit anyone in the security bulletin. It's possible that they found it in an internal code review. It's possible a third party found it and brought it to Apple's attention (although normally you would expect that party to be credited). It's possible they became aware of exploits of the bug and haven't disclosed the fact. This last possibility might also explain why only iOS was patched so far, if perhaps the exploits are somehow only targeting iOS. But I'm speculating, which is all I can do when Apple leaves an information vacuum.

Another sign that Apple views this as an über-high priority bug: They also issued a patch for iOS 6. Apple doesn't want any users on iOS 6 and likes to brag about how quickly iOS users migrate to the next major version. Over two months ago Apple claimed that 74 percent of iOS devices were running iOS 7. There hasn't been a security update for iOS 6 in almost a year. I'm sure Apple doesn't want to do anything to make it easier for iOS users to stay on iOS 6, but they patched it anyhow. That's how serious it is.

http://www.zdnet.com/apple-and-the-ssltls-bug-open-questions-7000026628/