Researchers at Okta Security have stumbled across something big. Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.
While at first glance that doesn’t sound so bad, the implications are terrifying. In a nutshell, code signing uses cryptographic “signatures” to verify and validate code. If code bears the digital signature, it is considered trusted. If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.
Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.
An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.
Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.
Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.
Josh Pitts, an Okta engineer, sums the issue up:
“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products. To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”
A completely fair assessment. Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed. We won’t always be so lucky.
President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.
Apple’s Legions of users love FaceTime, but there’s a problem with the highly popular app. It only allows you to see and talk to one person at a time. Apple fans have been clamoring for Group FaceTime for almost as long as the app has existed, and soon, they’ll get their wish.
If you use Apple products, you may have noticed an annoying “feature”. If you’re using the messaging app on your phone and texting someone and then you move to your Mac and access the same program there, the conversation you were having on your phone isn’t present. The two devices are messaging islands that can’t reliably communicate with each other. Since they can’t, you can’t start a conversation on one device and then pick it up later on another.
Apple promised that its iTunes app would be available on the Microsoft Store by the end of 2017. The announcement was greeted with enthusiasm, but unfortunately, the company didn’t meet their own deadline. They cited the need for more time to build a more robust user experience for Windows users.
After more than two decades in the business, Apple is officially going to stop selling routers. The writing has been on the wall for a while now, since the company’s “AirPort” family of products hasn’t received a significant update in more than five years.
Owners of Apple devices have a new attack vector to worry about, called “TrustJacking.” Symantec researchers recently stumbled across a pair of scenarios that take advantage of Wi-Fi syncing of various Apple devices. These are scenarios that also take advantage of the trust users have in the security of their own devices, allowing hackers to take complete control over those devices.
If you recently bought a 13-inch MacBook Pro (without a Touch Bar), you’ll want to head to Apple’s website. The company didn’t make a big announcement, but they’ve quietly introduced a battery replacement program that impacted what the company described as a “limited number” of laptops.
There’s a lot to talk about in Apple’s latest update to iOS. Version 11.3 boasts some significant changes and is well worth getting. We’ll go over the highlights below.
There’s a fun, new update for Apple’s iMessage app that will probably make lots of power users happy. As long as you also have Google’s iOS app installed, you’ll be able to perform Google searches from within iMessage itself.
Freemium software is certainly nothing new. They are free apps that offer premium features if you don’t mind ads displaying while you’re using it or paying a small fee to have the ads removed. At least one company is trying a new business model on for size, albeit with limited success.