Apple Kicks Developer That Found iOS Security Flaw

GORANKAR said:
The guy went about it wrong, and if Apple wishes to continue with it's broken app submission process, then people that use iStuff will have to learn to treat apps the same way as Android users do, with suspicion. Especially if it is not from a well established, trusted, developer.
Click to expand...


I understand the reason for no edits in this part of the forum, but it is damn inconvenient at times. I forgot to proof read, my fault, and the edits are in red.
 
Of course they kicked him out. It goes against what they want the public to know, that there are no bugs or security flaws in their products. Of course what they say and what is real are two different things.
 
On the one hand, it's true that the guy didn't follow the established best practices for warning vendors about security flaws. At least as far as we can tell. That's generally bad, although I'd like to think that Apple can put out a fix faster than a hacker can figure out the vulnerability, write an app to exploit it, submit it and have it approved.

So boo on him for being a bit of an ass in the way he went about it.

On the other hand, is Apple's reaction what's best for the company and the users? He wasn't banned for breaking the agreement, after all. He was banned for letting them know he had found a way to break the agreement and that none of their fail-safes had done anything to prevent it. How many other people have found similar vulnerabilities and are quietly exploiting them?

Apple's having a fit is understandable, because Apple's image rests a great deal on the idea of their products being stable and safe. But if their products aren't, they're lying to the public. If the guy hadn't gone public at once, but warned Apple first, Apple could have used it as a point in favor of their walled garden approach, saying that any such vulnerabilities are not a concern because they have fail-safes to ward against them. Thus perpetuating a false image of security, which is not in the interest of the public.

So ok, Apple can have a fit. But is banning the guy the right idea? Yes, they signed an agreement. But Apple is the one that gets to decide how and when to enforce it. I doubt the guy would go to court over Apple not banning him, and that's easily resolved.

The message Apple is sending is that they value people toeing the line and repeating the party line more than they value people doing valuable contributions. And that's a poor attitude for a company to have. It forms the sort of monoculture that leads to spectacular failures when everyone starts believing their own lies.
 
CryingGod said:
CoM is once again exhibiting negligence in their reporting of details - those pesky little fact based things that seem to get in the way of a sensational story.

Charlie Miller broke a cardinal rule of the White Hats - always notify the OS manufacturer before bringing to light a vulnerability.

Not only did he refrain from bringing the vulnerability to Apples attention before his very public display, but he also blatantly broke the rules associated with the Apple Developer Program. As a result he has been justly banned.

The manner in which he exposed the vulnerability proves his motives as less than ethical.
Click to expand...

I wondered who had made exactly the same post to CoM....generally, it is considered less than ethical to cut & paste a comment from one forum to another without identifying one of the two posts as the cut & paste...;)

But, I don't agree with this at all. Hackers are not bound by any ToS, nor do they inform anyone of where and how they have placed their malicious code. To expect this of real hackers is ridiculous.

The fact is that Miller demonstrated for all the world to see the fact that Apple does absolutely no security screening for the apps it clears for distribution via the Apple app store. Had he been angling for himself he probably would have submitted the info to Apple first, demanded a payment from Apple for his services, and then gone public with the info anyway if Apple had been less than forthcoming about it.

It seems to me he has done the Apple app store customers of this world (I am thankfully not one) a valuable service by demonstrating that they cannot simply trust blindly that Apple will be willing or able to protect them from malicious software. Hopefully, this will wake a few of them up to the fact that when it comes to security their first and best line of defense is themselves.

On this occasion, I vote for a new Apple Logo to replace the traditional bitten (diseased?) apple: I vote for three small chimp faces doing the "hear no evil, speak no evil, see no evil" bits...;)
 
WaltC said:
The fact is that Miller demonstrated for all the world to see the fact that Apple does absolutely no security screening for the apps it clears for distribution via the Apple app store.
Click to expand...

No, the only thing he demonstrated is that Apple didn't screen his app for a security bug that he discovered but didn't tell them about. Did you even read the article?
 
CryingGod said:
CoM is once again exhibiting negligence in their reporting of details - those pesky little fact based things that seem to get in the way of a sensational story.

Charlie Miller broke a cardinal rule of the White Hats - always notify the OS manufacturer before bringing to light a vulnerability.

Not only did he refrain from bringing the vulnerability to Apples attention before his very public display, but he also blatantly broke the rules associated with the Apple Developer Program. As a result he has been justly banned.

The manner in which he exposed the vulnerability proves his motives as less than ethical.
Click to expand...
At least you're a tiny bit right.

http://news.cnet.com/8301-27076_3-5...le-lets-apps-run-unsigned-code/?tag=mncol;txt

Miller told CNET he alerted Apple to the exploit three weeks ago,
Click to expand...

He still broke the ToS, but punishing people who help improve your product, for the sake of saving face, is never a good thing.
 
evilsofa said:
No, the only thing he demonstrated is that Apple didn't screen his app for a security bug that he discovered but didn't tell them about. Did you even read the article?
Click to expand...

I know I just posted it but to reiterate, he told them about it three weeks in advance. The original article posted didn't cover everything.
 
Jaerb4 said:
At least you're a tiny bit right.

http://news.cnet.com/8301-27076_3-5...le-lets-apps-run-unsigned-code/?tag=mncol;txt



He still broke the ToS, but punishing people who help improve your product, for the sake of saving face, is never a good thing.
Click to expand...

Yep, definitely appears Miller did follow the SOP with security hole reporting. Apple never responded so Miller outed the information in order to embarrass them and force a fix. Apple can never ever have a security flaw apparently. :rolleyes:

Good for Miller. After all the bad PR I'm betting by the end of the week his developer credentials will be restored.
 
The best motivation for a prompt security patch is for everybody the know about it.

That gives the company two big motivations for patching:
A) All malicious devs now know of a vulnerability and exploits will be forthcoming without a patch
B) Mr. Joe Customer is worried that hackers will turn is device into a bomb and kill his family and so demands a patch

This is good pressure for both sides of the market for a fix.
 
Kicked out for making Apple look bad. Maybe Apple should fix the issue instead of taking it out on the guy who brought it to their attention.
 
Miller followed standard protocol for finding a security flaw.

#1 - Prove it is a real flaw (which he did by getting the app approved)
#2 - Notify the company of the flaw (which he did)
#3 - Notify the public if the company doesn't give you any indication they're going to fix it

If Apple doesn't like that sort of thing then it is no wonder they have the reputation they do.
 
the only reason why they did this to him is because apple has steve jobs on ichat and they seen him roll over in his own grave!
 
techrat said:
He did. Three weeks prior.

This is just Apple being dicks, as usual.
Click to expand...
Doesn't sound like it given the sequence of events.

The app was already in the app store mid-October, which means that it was submitted sometime prior to that. He submitted the app, got it approved, *then* demonstrated that his app could (and did) call home to his private server and download an unsigned code payload.

His app was already in the app store at the time he claims to have notified them.
The breach had already been committed and was already in the wild *prior* to notifying Apple.

He did not notify them, wait for them to do nothing, and *then* release into the wild.
 
More info on the timeline of events:

"Miller, now a research consultant at Accuvant Labs, said he contacted Apple three weeks ago about the vulnerability, but did not tell the company about his disguised app, which had been available in the App Store since September."

http://www.huffingtonpost.com/2011/11/08/apple-charlie-miller-security-flaw_n_1082497.html

Perhaps this thread should be started over, since we've all been having trouble sorting out what happened when. When it was pointed out above that he'd told Apple about the bug 3 weeks ago, I thought I had been wrong. But now that we know he posted the app a month before that, and that the 5.0.1 update which likely has a fix for the bug is already going to selected users, I'm back to thinking he completely deserves to be booted from the program.
 
evilsofa said:
More info on the timeline of events:

"Miller, now a research consultant at Accuvant Labs, said he contacted Apple three weeks ago about the vulnerability, but did not tell the company about his disguised app, which had been available in the App Store since September."

http://www.huffingtonpost.com/2011/11/08/apple-charlie-miller-security-flaw_n_1082497.html

Perhaps this thread should be started over, since we've all been having trouble sorting out what happened when. When it was pointed out above that he'd told Apple about the bug 3 weeks ago, I thought I had been wrong. But now that we know he posted the app a month before that, and that the 5.0.1 update which likely has a fix for the bug is already going to selected users, I'm back to thinking he completely deserves to be booted from the program.
Click to expand...

Isn't what he did though the SOP? Find exploit and exploit it. Tell company about exploit. Wait for response. If no response you then release information. If you get response to do as asked.

Except Apple never responded to him. Apple could have simply said, we have confirmed the bug, the fix will be 5.0.1, please do not release information until after 5.0.1 has been released, and we have pulled your app.

Instead, Apple kicked him out and hasn't said a word since. They haven't even come out and said the fix for this is in 5.0.1.
 
Sounds like he did it in the right order to me. If he would have notified apple and then went public with it and not have submitted the app first, all the apple people/fanboys would have just said "oh, the approval process would have caught it. Nothing to see here, move along."

He notified them three weeks before going public. He had to prove it would work before anyone would take it serious.
 
mope54 said:
Doesn't sound like it given the sequence of events.

The app was already in the app store mid-October, which means that it was submitted sometime prior to that. He submitted the app, got it approved, *then* demonstrated that his app could (and did) call home to his private server and download an unsigned code payload.

His app was already in the app store at the time he claims to have notified them.
The breach had already been committed and was already in the wild *prior* to notifying Apple.

He did not notify them, wait for them to do nothing, and *then* release into the wild.
Click to expand...

Putting the app in the marketplace is not the issue. That's the proof that the system has a flaw and the vulnerability is real. If you warn them about what you are doing before you send the app for review, they could deny the app access to the store and claim that no vulnerability exists because the review team caught it. The review team is part of the App Store's security.

You'd then be unable to show for a fact that the vulnerability exists and someone else could find and exploit it (assuming no one already is).

The only way to be able to show to them and the public that a vulnerability exist is to get the malware on the AppStore, test that the exploit works, warn Apple that the exploit is there and that you tested it, and then wait to release the information to the public if they don't get back to you. That's what he did.
 
I really don't get the complainers here about "another Apple bashing at the [H]".

[H] isn't the writer of a fake anti-apple story - shoving it to you with no recourse.

You get a link to a reported event that actually took place, and the ability to discuss the issues and merits of it here in the forum.

If you don't like the fact that the Apple issues get brought up, then go become the CEO and make them change their business practices. Or start posting Microsoft and PC hardware vendor problems in the Apple sub-forum when they come to light if it makes you feel better, and crap on them all you want.

MicroSuck has gotten it's due just like Crapple.
 
Outamyhead said:
If you get rid of the person that found the problem, it will go away...Apple standard procedure
Click to expand...

Except, of course, for when the problem is the culture that Steve Jobs created...
 
Volume said:
This is the dillema I see:


If he had gone straight to them, they would have silently fixed it to avoid embarassment, or maybe even denied it. They're basically retaliating against him for making them look bad.
Click to expand...


No. Had he gone to them, they'd have fluffed him off telling him that nobody would be able to get such an app past THEIR checker guys.
 
techrat said:
Except, of course, for when the problem is the culture that Steve Jobs created...
Click to expand...

Yes. He may not have left behind all that great a legacy.. especially with the information that's coming out now.

-C
 
You must log in or register to reply here.
Back
Top