The Worst Security Blunder I’ve Seen This Year
Apple just “fixed” CVE-2007-4703.
The “Set access for specific services and applications” setting for the Application Firewall allows any process running as user “root” (UID 0) to receive incoming connections, even if its executable is specifically added to the list of programs and its entry in the list is marked as “Block incoming connections”. This could result in the unexpected exposure of network services.
I am utterly speechless. Shouldn’t the firewall have been built by a security team? Not a bunch of monkeys smashing their keyboards with a femur then committing?
I’m not sorry if I’ve offended you. If you work for Apple, and the Firewall code passed through your hands,
Letting any root process listen no matter what is like a bank security guard letting nobody except ex-convicts in after hours. The history of Unix security from Robert Morris up to today is that a single chink in any root daemon’s armor means your entire system is laid bare to anyone who knows what Metasploit is. It is inconceivable to me that someone being paid to write security code in 2007 would turn off all firewalling for any root process—and make it impossible for users to specifically request it.
There are those who say firewalls and network security are solving the wrong problem. At DefCon 15, Bruce Potter made the compelling argument that the right way to improve security is to fix the buggy code, and that “defense in depth” is just a band-aid. That may be, but for today, we still have buggy daemons, and sometimes we want to hide them from the world.
Again: I hope someone at Apple lost his or her goddamned career for this.
November 16th, 2007 at 4:12 pm
For what it’s worth I’d say the blame falls on the hiring personnel who brought on the “security” team who doesn’t know what security is and the managers who kept them. It isn’t a stupid programmer’s fault that his stupidity screws something up — it’s to be expected. Hiring and retaining stupid programmers for your world class operating system’s security team is, however, an inexcusable offense.
December 2nd, 2007 at 2:08 am
This isn’t exactly where this should go, BUT I figured out (I think) why you broke my RSS feed and I’ve been failing at reading your blog for liek, the last 5 months… You switched to whatever this is, TEXTPATTERN (?), and, maybe, the URL got changed? I dunno, but it’s fixed now. Continue as if nothing happened.