Major Malfunction...

Apple CORED: Boffins reveal password-killer 0-days for iOS and OS X
http://arxiv.org/pdf/1505.06836v1.pdf
[1505.06836] Unauthorized Cross-App Resource Access on MAC OS X and iOS
The one from the Register might seem flaky but the other one is good. I've seen it elsewhere also.

The dangers (or lack thereof) that come with exploit aside, I think what's important here is the first (and inevitable) piece of evidence that walled gardens can have holes. Just because Apple checks apps for publication in their stores shouldn't necessarily mean that all is good.

So basically the integration of our apple devices makes us vulnerable if we have downloaded an infected app. I thought all apps were pre-approved by Apple if from the app store but obviously either someone is asleep at the switch or the malicious code is inserted after approval through this exploit.

What I really found interesting is that Apple has not addressed it - or may they have with El Capitan & iOS 9. We just have to wait and what, pray?

And there is the ending comment from the guys who found the problem - "Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed." And where is this simple program that will help protect???


Lisa

lclev said:

So basically the integration of our apple devices makes us vulnerable if we have downloaded an infected app. I thought all apps were pre-approved by Apple if from the app store but obviously either someone is asleep at the switch or the malicious code is inserted after approval through this exploit.

Click to expand...

The issue here highlights that Apple's approval system, like any other, is not perfect. Apple can't test every app for every condition - they just don't have the resources for that.

lclev said:

We just have to wait and what, pray?

Click to expand...

Apple's rather glaical security fix speed in a nutshell.

lclev said:

And there is the ending comment from the guys who found the problem - "Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed." And where is this simple program that will help protect???

Click to expand...

It's called Xavus (they talk about it towards the midpoint of their article on p. 16). As to whether it's publicly available, your guess is as good as mine.

Well now we wait and see. As I said they may be addressing this in El Capitan and iOS 9.

Lisa