Apple Says ‘KRACK’ Wi-Fi Vulnerabilities Are Already Patched in iOS, macOS, watchOS, and tvOS Betas

Apple has already patched serious vulnerabilities in the WPA2 Wi-Fi standard that protects many modern Wi-Fi networks, the company told iMore's Rene Ritchie this morning.

The exploits have been addressed in the iOS, tvOS, watchOS, and macOS betas that are currently available to developers and will be rolling out to consumers soon.

A KRACK attack proof-of-concept from security researcher Mathy Vanhoef

Disclosed just this morning by researcher Mathy Vanhoef, the WPA2 vulnerabilities affect millions of routers, smartphones, PCs, and other devices, including Apple's Macs, iPhones, and iPads.

Using a key installation attack, or "KRACK," attackers can exploit weaknesses in the WPA2 protocol to decrypt network traffic to sniff out credit card numbers, usernames, passwords, photos, and other sensitive information. With certain network configurations, attackers can also inject data into the network, remotely installing malware and other malicious software.

Because these vulnerabilities affect all devices that use WPA2, this is a serious problem that device manufacturers need to address immediately. Apple is often quick to fix major security exploits, so it is not a surprise that the company has already addressed this particular issue.

Websites that use HTTPS offer an extra layer of security, but an improperly configured site can be exploited to drop HTTPS encryption, so Vanhoef warns that this is not a reliable protection.

Apple's iOS devices (and Windows machines) are not as vulnerable as Macs or devices running Linux or Android because the vulnerability relies on a flaw that allows what's supposed to be a single-use encryption key to be resent and reused more than once, something the iOS operating system does not allow, but there's still a partial vulnerability.

Once patched, devices running iOS, macOS, tvOS, and watchOS will not be able to be exploited using the KRACK method even when connected to a router or access point that is still vulnerable. Still, consumers should watch for firmware updates for all of their devices, including routers.

Ahead of the release of the update that addresses the vulnerabilities, customers who are concerned about attacks should avoid public Wi-Fi networks, use Ethernet where possible, and use a VPN.


Discuss this article in our forums

Study Finds Significant Number of Macs Running Out-of-Date Firmware Susceptible to Critical Exploits

A new research paper from Duo Security, shared by Ars Technica, reveals that a significant number of Macs are running out-of-date EFI versions, leaving them susceptible to critical pre-boot firmware exploits.


The security firm analyzed 73,324 Macs used in production environments and found that, on average, 4.2 percent of the systems were running the incorrect EFI version relative to the model and version of macOS or OS X installed.

The percentage of incorrect EFI versions varies greatly depending on the model. The late 2015 21.5" iMac had the highest occurrence of incorrect EFI, with 43 percent of systems running incorrect versions.

EFI, which stands for Extensible Firmware Interface, bridges a Mac's hardware, firmware, and operating system together to enable it to go from power-on to booting macOS. EFI operates at a lower level than both the operating system and hypervisors, providing attackers with a higher level of control.
Successful attack of a system's UEFI implementation provides an attacker with powerful capabilities in terms of stealth, persistence, and direct access to hardware, all in an OS and VMM independent manner.
Duo Security found that 47 models capable of running OS X Yosemite, OS X El Capitan, or macOS Sierra, for example, did not have an EFI security patch for the Thunderstrike exploit publicly disclosed nearly three years ago.

The research paper noted that there seems to be something interfering with the way bundled EFI updates are installed alongside macOS, while some Macs never received EFI updates whatsoever, but it doesn't know exactly why.
There seems to be something interfering with the way bundled EFI firmware updates are getting installed, leading to systems running old EFI versions. We are not able to give an exact reason why, but there are significant discrepancies between the firmware version that is actually running on real world production systems and the version that is expected to be running, given the OS build. This means that even if your Mac is still receiving security patch support, there is a non-trivial chance that your system is not running the latest version, even though you thought it was installed.
While its research paper is focused on Apple, Duo Security said the same if not worse EFI issues likely affect PCs running Windows or Linux.

In response to the research paper, Apple said it appreciates the research on the industry-wide issue and noted that macOS High Sierra automatically validates a Mac's EFI on a weekly basis to ensure it hasn't been tampered with.
We appreciate Duo's work on this industry-wide issue and noting Apple’s leading approach to this challenge. Apple continues to work diligently in the area of firmware security and we’re always exploring ways to make our systems even more secure. In order to provide a safer and more secure experience in this area, macOS High Sierra automatically validates Mac firmware weekly.
In a related blog post, Duo Security said users should check if they are running the latest version of EFI on their Macs, and it has released a tool to help do so. It also recommends updating to the latest version of macOS High Sierra.


Discuss this article in our forums

Apple’s Latest Transparency Report Shows Jump in National Security Requests

Apple this week released its latest transparency report [PDF] outlining government data requests received from January 1, 2017 to June 30, 2017.

In the United States, Apple received 4,479 requests for 8,958 devices and provided data 80 percent of the time (in 3,565 cases). Worldwide, Apple received 30,814 requests for data from 233,052 devices and provided data 80 percent of the time (in 23,856 cases).

Overall demands for data were slightly down compared to requests during the same time period last year, but Apple disclosed a much higher number of national security requests that include orders received under FISA and National Security Letters. According to Apple, to date, it has not received any orders for bulk data.

Apple says it received 13,250 - 13,499 National Security Orders affecting 9,000 to 9,249 accounts. That’s up from 2,750 - 2,999 orders affecting 2,000 to 2,249 accounts received during the first half of 2016.


Though Apple attempts to be as transparent as possible in its reports, the government does not allow the company to release specific details when it comes to the number of National Security requests received, instead requiring a number range to be provided to customers. Apple uses the narrowest range permissible by law.

Apple lately has been making more of an effort to be clearer about the type of information governments around the world have asked for, and its last two reports, this one included, have been highly detailed.

Along with the total number of device requests and National Security Orders, Apple also provides data on a range of categories covering government requests for emergencies such as missing children, requests related to stolen devices, fraud requests, account deletion/restriction requests, civil non-government cases and account preservation requests, all of which can be viewed directly in the report.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.


Discuss this article in our forums

Hacker Releases Firmware Decryption Key for Apple’s Secure Enclave

A hacker released what he claimed to be a firmware decryption key for Apple's Secure Enclave on Thursday, initially sparking fears that iOS security had been compromised.

Apple's Secure Enclave Processor (SEP) handles all cryptographic operations for the Apple Watch Series 2, the A7 processor that powers the iPhone 5s, the iPad Air, the iPad mini 2 and 3, and subsequent A-series chips. The encrypted SEP is completely isolated from the rest of the system and handles Touch ID transactions, password verifications, and other security processes on a separate OS to maintain data protection integrity even if the kernel has been compromised.

One of the ways the SEP does this is by generating a Unique ID (UID) for each device for authentication purposes. The UID automatically changes every time a device is rebooted and remains unknown to other parts of the system, further enhancing its security.

Beyond that, little is known about how the SEP actually works outside of Apple, but that's by design – the enclave's isolation serves to obfuscate it from the rest of the system, preventing hackers from rifling through its code to make it as secure as possible.


The decryption key posted on GitHub yesterday would not enable hackers to access data stored inside the Secure Enclave, but it could allow hackers and security researchers to decrypt the firmware that controls it and potentially spot weaknesses in the code.

Speaking to TechRepublic, the hacker that released the key claimed that Apple's effort to obfuscate the code was itself cause for concern.
"The fact that the SEP was hidden behind a key worries me," said xerub. "Is Apple not confident enough to push SEP decrypted as they did with kernels past iOS 10?" He added that while SEP is amazing tech the fact that it's a "black box" adds very little, if anything to security. "Obscurity helps security — I'm not denying that," he said, but added that relying on it for security isn't a good idea.

"I think public scrutiny will add to the security of SEP in the long run," xerub said, noting that was also his intention with releasing the key.
Xerub claimed it's theoretically possible that the decryption key could be used to watch the SEP do its work, which could potentially allow hackers to reverse-engineer its process and gain access to its contents, including passwords and fingerprint data. However, he admitted that a lot of additional work would need to go into exploiting the decrypted firmware.

It's still unclear what the longer term repercussions could be, but an Apple source who wished to remain anonymous told TechRepublic that the release of the SEP key doesn't directly compromise customer data.
"There are a lot of layers of security involved in the SEP, and access to firmware in no way provides access to data protection class information," they said. "It's not an easy leap to say it would make getting at customer data possible."
More accurately, it makes research into the structure of the SEP possible, which could allow hackers to find flaws in its workings. Apple said it did not plan to roll out a fix at this time.


Discuss this article in our forums

Security Researchers Don’t Think Apple Pays Enough for Bug Bounties

Apple's bug bounty program has been available to select security researchers for almost a year now, but according to a new report from Motherboard, most researchers prefer not to share bugs with Apple due to low payouts. More money can be obtained from third-party sources for bugs in Apple software.

"People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly."
Motherboard spoke to several members of Apple's bug bounty program with the condition of anonymity. Every single one said they had yet to report a bug to Apple and did not know anyone who had. iOS bugs are "too valuable to report to Apple," according to Patrick Wardle, a Synack researcher and former NSA hacker who was invited to the bug bounty program last year.

Apple first introduced its bug bounty program in August of 2016 at the Black Hat Conference, an annual global InfoSec event. Apple offers bounties of up to $200,000 depending on the vulnerability. Secure boot firmware components earn $200,000 at the high end, while smaller vulnerabilities, like access from a sandboxed process to user data outside of the sandbox, will earn $25,000.


Discuss this article in our forums

Apple Devices Escape Mention in WikiLeaks’ Latest ‘Vault 7’ CIA Hacking Documents

Wikileaks yesterday published its latest round of allegedly leaked CIA documents, detailing aspects of the U.S. agency's "Cherry Blossom" firmware modification program, which uses modified versions of router firmware to turn networking devices into surveillance tools.

The document is the latest in WikiLeaks' "Vault 7" series of publications on CIA hacking methods. Previous leaks have detailed the agency's targeting of iOS devices and Macs, while this manual relates specifically to network routers: Once installed, the Cherry Blossom program can be used to monitor internet traffic, crawl for passwords, and redirect the target user to a particular website.


The manual also describes how CIA agents might install the modified firmware. "In typical operation, a wireless device of interest is implanted with Cherry Blossom firmware, either using the Claymore tool or via a supply chain operation." While documents have not been made public that detail the "Claymore" tool, the latter tactic refers to the practice of intercepting the target device somewhere between the factory and the end user.

The document lists several network products as susceptible to its hacking protocol, including devices from Asus, Belkin, Buffalo, Dell, DLink, Linksys, Motorola, Netgear, Senao, and US Robotics. Apple's AirPort networking equipment does not appear on the list, however.

The CIA has struggled to penetrate Apple's network router hardware in the past due to a combination of the company's robust encryption and its use of proprietary hardware. Previous Harpy Eagle documents published by Wikileaks show apparently unsuccessful efforts to "gain root access on an Apple Airport Extreme and Time Capsule via local and/or remote means to install a persistent rootkit into the flash storage of the devices".

The Cherry Blossom document dates to 2012, so it's likely CIA methods have moved on in an effort to keep up to date with changing networking hardware. In a response the same day that the iOS device hacking efforts came out, Apple said that many of the vulnerabilities in that leak were already patched. Apple ceased development of its AirPort networking devices last year.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.


Discuss this article in our forums

Apple Helped U.K. Investigate Terrorist Attacks, Says CEO Tim Cook

Apple CEO Tim Cook revealed on Monday that the company has been helping the U.K. government investigate terror attacks in the country, despite being criticized by officials for its steadfast support of digital services that use end-to-end encryption.


"We have been cooperating with the U.K. government not only in law enforcement kind of matters but on some of the attacks," Cook said during a Bloomberg Television interview on Monday. "I cannot speak on detail on that. But in cases when we have information and they have gone through the lawful process we don't just give it but we do it very promptly."
Cook went on to suggest that rather than breaking encryption and risking the security of millions of users' private data, technology companies could provide police with metadata – revealing when, where, and who sent and received messages, but not their content – which could be extremely helpful in criminal investigations. "Metadata, if you're putting together a profile, is very important,” said Cook.

The comments follow a third attack in as many months in the U.K., which has reignited the debate surrounding online surveillance in the country. The current Conservative government is demanding new powers that would force technology companies to compromise encryption protocols.

In the wake of Saturday's terrorist attack at London Bridge, Prime Minister Theresa May again called for new laws to regulate the internet, demanding that internet companies do more to remove places online where terrorists can communicate. "We cannot allow this ideology the safe space it needs to breed," she said. "Yet that is precisely what the internet and the big companies that provide internet-based services provide."

Recently the U.K. government passed a bill that could theoretically mean companies are legally bound to do comply with such requests, although the practicalities of such a law have been repeatedly questioned by security experts. Apple's privacy and encryption policy has also been criticized by U.S. law enforcement officials and the company publicly clashed last year in court with the FBI over the issue.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.


Discuss this article in our forums

Apple’s Latest Transparency Report Shows Spike in U.S. Government Data Requests

Apple last night released its latest transparency report [PDF] outlining government data requests from July 1 to December 31, 2016. According to the data, which features several new request categories, Apple is making an effort to be as clear as possible about the types of information governments around the world have asked for. Apple's report is the most detailed report the company has produced yet.

Worldwide, Apple received 30,184 device requests, covering 151,105 devices. Apple provided data for 21,737 device requests, which equates to a 72 percent response rate. In the U.S. specifically, Apple responded to 3,335 requests out of 4,268 (78 percent). According to Apple, device-based requests cover fraud investigations as well as customers who have asked law enforcement to help locate lost or stolen devices.

Apple received 2,392 financial identifier requests worldwide, covering 21,249 devices. Apple provided information for 1,821 of the requests, which are related to cases where law enforcement officials are working on behalf of customers who have asked for help with fraudulent credit card activity.

When it comes to worldwide government account requests, Apple received 2,231, rejecting 175 of those, and providing no data for 471. Non-content data was provided for 1,350 requests, and content was offered up in 410 cases. A total of 8,880 accounts were affected.

In the United States, Apple says it received between 5750 and 5999 National Security Requests under FISA and National Security Letters, which affected 4750 to 4999 accounts. Apple is not allowed to provide specific numbers, but offers up the narrowest range permissible by law.


U.S. National Security requests increased significantly in the second half of 2016 compared to the first half of the year. In its first 2016 transparency report, Apple said it received 2750 to 2999 National Security orders affecting 2000 to 2249 accounts.

According to the data, Apple also received one "declassified" National Security Letter from the FBI. National Security Letters are traditionally kept secret via a gag order that prevents companies from sharing information about them, but following the USA Freedom Act, the rules have been loosened and tech companies are now able to publish National Security Letters when declassified. Apple is able to publish the content of the letter, but has not done so.

Apple's data is broken down into multiple additional categories, covering government requests for emergencies such as missing children, account deletion/restriction requests, and account preservation requests, all of which can be viewed directly in the report. The company also provides more information on government account requests by legal process type, including search warrant, wiretap orders, subpoenas, pen register/trap and trace orders, and other types of court orders.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.


Discuss this article in our forums

Third-Party Apps Will Need App-Specific Passwords for iCloud Access From June 15

App-specific passwords are set to become a mandatory requirement for third-party apps that access iCloud user data, according to an Apple Support email sent out today.

Currently, app-specific passwords are used to allow non-native apps like email clients to sign in to iCloud accounts that are protected by two-factor authentication. The security measure ensures that users can still link up their iCloud account to apps and services not provided by Apple, while also avoiding the need to disclose their Apple ID password to third parties.

However, app-specific passwords will become a basic requirement from June 15, according to Apple. The policy change basically means that users who want to continue using third-party apps with their iCloud account will have to enable two-factor authentication and generate individual passwords for each app.
Beginning on 15 June, app-specific passwords will be required to access your iCloud data using third-party apps such as Microsoft Outlook, Mozilla Thunderbird, or other mail, contacts and calendar services not provided by Apple.

If you are already signed in to a third-party app using your primary Apple ID password, you will be signed out automatically when this change takes effect. You will need to generate an app-specific password and sign in again.
Two-factor authentication ensures that you're the only person who can access your Apple account, even if someone knows your password. To turn it on from any iOS device running iOS 10.3 or later, open the Settings app, tap your name at the top, and then tap Password & Security.

If you're using iOS 10.2 or earlier, you can enable it from Settings -> iCloud -> Apple ID -> Password & Security. If you're on a Mac, go to System Preferences -> iCloud -> Account Details, click Security, and enable two-factor authentication from there.

To generate an app-specific password, sign into your Apple ID account page (https://appleid.apple.com), go to App-Specific Passwords under Security, and click Generate Password.


Discuss this article in our forums

Researchers Uncover macOS and Safari Exploits at Pwn2Own 2017

The seventeenth annual CanSecWest security conference is underway in downtown Vancouver, British Columbia, where researchers are competing in the 10th anniversary Pwn2Own computer hacking contest for over $1 million in prizes.

Day one results have already been published over at the Zero Day Initiative website, with a couple of successful Mac-related exploits already appearing in the list of achievements. Independent hackers Samuel Groß and Niklas Baumstark landed a partial success and earned $28,000 after targeting Safari with an escalation to root on macOS, which allowed them to scroll a message on a MacBook Pro Touch Bar.


In a partial win, Samuel Groß (@5aelo) and Niklas Baumstark (@_niklasb) earn some style points by leaving a special message on the touch bar of the Mac. They used a use-after-free (UAF) in Safari combined with three logic bugs and a null pointer dereference to exploit Safari and elevate to root in macOS. They still managed to earn $28,000 USD and 9 Master of Pwn points.
Later in the day, Chaitin Security Research Lab also targeted Safari with an escalation to root on macOS, finding success using a total of six bugs in their exploit chain, including "an info disclosure in Safari, four type confusion bugs in the browser, and a UAF in WindowServer". The combined efforts earned the team $35,000.

The participating teams earned a total of $233,000 in prizes on day one, including a leading $105,000 earned by Tencent Security, according to published details. Other software successfully targeted by contestants include Adobe Reader, Ubuntu Desktop, and Microsoft Edge on Windows.

Apple representatives have attended the Pwn2Own contest in the past, and affected parties are made aware of all security vulnerabilities discovered during the contest in order to patch them. Pwn2Own day two began today at 8:30 a.m. Pacific and will involve additional exploit attempts against macOS and Safari.


Discuss this article in our forums