<story><title>On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM</title><url>http://daringfireball.net/2014/02/apple_prism</url></story><parent_chain><item><author>tptacek</author><text>This seems so silly to me, Jon.&lt;p&gt;The OSX&amp;#x2F;IOS SecureTransport TLS vulnerability is getting coverage because it&amp;#x27;s easy for laypeople to understand. Any geek can look at a description of the bug, or even the code itself, and say to themselves, &amp;quot;hey, I could exploit that!&amp;quot;. Because more people understand this bug than they would any other bug, it paradoxically seems scarier.&lt;p&gt;The reality however is that the ease with which a bug can be exploited has little to do with its impact. What matters is the feasibility of exploitation. And in terms of feasibility, this bug is &lt;i&gt;less&lt;/i&gt; exploitable than the kinds of bugs that are disclosed in every platform every month; it requires a specific (common, but not universal) set of circumstances to escalate it to code execution.&lt;p&gt;Matthew Green told a Reuters reporter yesterday that the TLS bug was &amp;quot;as bad as could be imagined&amp;quot;. He was also drinking†, which explains how he managed to find a TLS validation bug worse than memory corruption, which is discovered routinely in all platforms, and produces attacks that directly, instantly hijack machines regardless of their configuration and the network they operate on.&lt;p&gt;Vulnerabilities in TLS code are not all that unusual. We get a new one every couple years or so. There was a vulnerability in the NSS False-Start code a year ago --- it didn&amp;#x27;t get covered because (a) few people know what NSS is (it&amp;#x27;s the TLS library for Firefox and Chrome) and (b) nobody knows or cares about False-Start. Here&amp;#x27;s another example: NSS misparsed PKCS1v15 padding, such that an e=3 RSA certificate could be forged --- anyone on the Internet could run a small Python script to generate a certificate for any site. Certificate chaining has broken within the last ~4 years ago. Again, no coverage: what&amp;#x27;s e=3 RSA? How does chaining work?&lt;p&gt;Simple thought experiment: imagine if, instead of a missing-brace bug that broke all of TLS, it was instead disclosed that NSS had a memory corruption vulnerability in its PKCS1v15 parsing. Would there be a shitstorm in the media and on Twitter? I doubt it: comparable bugs are found routinely without shitstorms.&lt;p&gt;I don&amp;#x27;t know if NSA knew about this bug or didn&amp;#x27;t. If they did, I&amp;#x27;m confident that they exploited it; that&amp;#x27;s what they do. But ask yourself if you&amp;#x27;re sure that NSS and SecureTransport and OpenSSL and SCHANNEL are free from the kinds of memory corruption vulnerabilities that would allow NSA (and other organized criminals) to hijack machines directly. You think &lt;i&gt;this&lt;/i&gt; is the bug they&amp;#x27;re relying on?&lt;p&gt;† &lt;i&gt;No, really.&lt;/i&gt;</text></item></parent_chain><comment><author>briansmith</author><text>&amp;gt; (it&amp;#x27;s the TLS library for Firefox and Chrome)&lt;p&gt;The False Start bug in NSS that you are talking about (CVE-2013-1740) never affected a released version of Firefox; we found the bug during testing of False Start in preparation for enabling it in Firefox 26. We pushed back the enabling of False Start to Firefox 28 (which will be released next month) so that we could fix this bug first.</text></comment>
<story><title>On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM</title><url>http://daringfireball.net/2014/02/apple_prism</url></story><parent_chain><item><author>tptacek</author><text>This seems so silly to me, Jon.&lt;p&gt;The OSX&amp;#x2F;IOS SecureTransport TLS vulnerability is getting coverage because it&amp;#x27;s easy for laypeople to understand. Any geek can look at a description of the bug, or even the code itself, and say to themselves, &amp;quot;hey, I could exploit that!&amp;quot;. Because more people understand this bug than they would any other bug, it paradoxically seems scarier.&lt;p&gt;The reality however is that the ease with which a bug can be exploited has little to do with its impact. What matters is the feasibility of exploitation. And in terms of feasibility, this bug is &lt;i&gt;less&lt;/i&gt; exploitable than the kinds of bugs that are disclosed in every platform every month; it requires a specific (common, but not universal) set of circumstances to escalate it to code execution.&lt;p&gt;Matthew Green told a Reuters reporter yesterday that the TLS bug was &amp;quot;as bad as could be imagined&amp;quot;. He was also drinking†, which explains how he managed to find a TLS validation bug worse than memory corruption, which is discovered routinely in all platforms, and produces attacks that directly, instantly hijack machines regardless of their configuration and the network they operate on.&lt;p&gt;Vulnerabilities in TLS code are not all that unusual. We get a new one every couple years or so. There was a vulnerability in the NSS False-Start code a year ago --- it didn&amp;#x27;t get covered because (a) few people know what NSS is (it&amp;#x27;s the TLS library for Firefox and Chrome) and (b) nobody knows or cares about False-Start. Here&amp;#x27;s another example: NSS misparsed PKCS1v15 padding, such that an e=3 RSA certificate could be forged --- anyone on the Internet could run a small Python script to generate a certificate for any site. Certificate chaining has broken within the last ~4 years ago. Again, no coverage: what&amp;#x27;s e=3 RSA? How does chaining work?&lt;p&gt;Simple thought experiment: imagine if, instead of a missing-brace bug that broke all of TLS, it was instead disclosed that NSS had a memory corruption vulnerability in its PKCS1v15 parsing. Would there be a shitstorm in the media and on Twitter? I doubt it: comparable bugs are found routinely without shitstorms.&lt;p&gt;I don&amp;#x27;t know if NSA knew about this bug or didn&amp;#x27;t. If they did, I&amp;#x27;m confident that they exploited it; that&amp;#x27;s what they do. But ask yourself if you&amp;#x27;re sure that NSS and SecureTransport and OpenSSL and SCHANNEL are free from the kinds of memory corruption vulnerabilities that would allow NSA (and other organized criminals) to hijack machines directly. You think &lt;i&gt;this&lt;/i&gt; is the bug they&amp;#x27;re relying on?&lt;p&gt;† &lt;i&gt;No, really.&lt;/i&gt;</text></item></parent_chain><comment><author>teacup50</author><text>You have an odd definition of &amp;quot;less exploitable&amp;quot;. On what planet is compromise of all trusted communications &amp;quot;less exploitable&amp;quot; just because it doesn&amp;#x27;t immediately lead to code execution?&lt;p&gt;Once you are MITM&amp;#x27;ing, you get passwords. You get personal details. You get everything you need to do &lt;i&gt;far&lt;/i&gt;, &lt;i&gt;far&lt;/i&gt; more than run code on someone&amp;#x27;s phone.&lt;p&gt;&lt;i&gt;All&lt;/i&gt; the vulnerabilities you list are bad. Sometimes I wonder if you post your consistently contrarian posts on HN just to stay visible.</text></comment>