Very serious security flaw in iOS

JimNtexas

JimNtexas

Pattern Altitude
Joined
Dec 21, 2006
Messages
2,261
Location
Austin, Texas
Display Name
Jim - In Texas!
Home Airfield
KAUS
Today a huge security hole has been found in the iOS 7 operating system. This flaw is believed to exist in OS-X and earlier versions of iOS, but that has not been confirmed.

The bug causes iOS to trust any web site's SSL certificate, enabling simple man-in-the-middle and spoofing attacks.

Apple has released an emergency update.

Short version:
Google ‪#‎gotofail‬ and see
http://support.apple.com/kb/HT6147

Check your Apple device here.

tl;dr; version:

This really hit home to me because just this week I was working on an exactly equivalent function for an Android application.

Fortunately for Apple, the bug is in their open source code in the function SSLVerifySignedServerKeyExchange so that it was discoverable by the technical public.

See if you can see the bug!

I was surprised to discover that the gcc compiler they used doesn't warn about dead code. This bug would be highlighted for dead code by a Windows or Android compiler.
 
Miss curly brackets much?

I always put 'em in. Can't stand code written like that.
 
Matthew said:
I think I found it. At least I found what I would consider a bug.
Click to expand...

They have the

if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
goto fail;
goto fail;

The 2nd "goto fail" is always executing.

The function returns the value of err but if the if statement was ==0 … it's returning success (0)

I can't stand code written like this… and the goto fail stuff is old school.

At least they didn't have a long jump in there :hairraise:
 
Last edited:
That's what I found. I was assuming they didn't mean it that way.

Once I saw GOTOs, I started looking for errors right away.
 
One of my favorites was when I was digging through a bunch of spaghetti and found a routine that was trying to smooth out some analog voltage readings. The original guy intended to go ahead and average three readings. Since it took about 10ms for each reading, the result would be a 30 ms average that would filter out some of the noise on that particular line. It went something like this:

Reading = GetAnalogValue();
Reading = GetAnalogValue();
Reading = GetAnalogValue();
return Reading;

Not even close.
 
Matthew said:
One of my favorites was when I was digging through a bunch of spaghetti and found a routine that was trying to smooth out some analog voltage readings. The original guy intended to go ahead and average three readings. Since it took about 10ms for each reading, the result would be a 30 ms average that would filter out some of the noise on that particular line. It went something like this:

Reading = GetAnalogValue();
Reading = GetAnalogValue();
Reading = GetAnalogValue();
return Reading;

Not even close.
Click to expand...

Haha...

Reading = 30
Reading = 32
Reading = 31

Reading = 35

*Scratches his head* Huh, Why is it not averaging
 
ARFlyer said:
Haha...

Reading = 30
Reading = 32
Reading = 31

Reading = 35

*Scratches his head* Huh, Why is it not averaging
Click to expand...

Unfortunately, the really simple things like that can cost a lot of time and money (like that one did). They are so simple that nobody bothers to verify or test they are actually working properly. That little item persisted for many years until I got a crack at looking at into why we kept getting flaky readings. It was part of a pretty complex control sytstem - nobody bothered to look at the simple things for the problem.
 
Last edited:
Matthew said:
One of my favorites was when I was digging through a bunch of spaghetti and found a routine that was trying to smooth out some analog voltage readings. The original guy intended to go ahead and average three readings. Since it took about 10ms for each reading, the result would be a 30 ms average that would filter out some of the noise on that particular line. It went something like this:

Reading = GetAnalogValue();
Reading = GetAnalogValue();
Reading = GetAnalogValue();
return Reading;

Not even close.
Click to expand...

I have seen worse.

In an endless loop (constantly updating HDMI Screen)

for ( x = 0; x < 50; x++ ){}
Reading = GetAnalogValue();

When I asked they said the person that did it was averaging out the readings for the display so it was easier to read.

They said it worked the display on the screen no longer jumped around so fast they could not see it. They also did not want me to fix it:D
 
ron22 said:
I have seen worse.

In an endless loop (constantly updating HDMI Screen)

for ( x = 0; x < 50; x++ ){}
Reading = GetAnalogValue();

When I asked they said the person that did it was averaging out the readings for the display so it was easier to read.

They said it worked the display on the screen no longer jumped around so fast they could not see it. They also did not want me to fix it:D
Click to expand...

:rolleyes2:

I sometimes have to use different sample rates - one interally that actaully gets used, and a slower one for the display so I don't have to listen to people complain the numbers change too fast to read.
 
Matthew said:
:rolleyes2:

I sometimes have to use different sample rates - one interally that actaully gets used, and a slower one for the display so I don't have to listen to people complain the numbers change too fast to read.
Click to expand...

True, but do you tell them you are averaging it?

Then again the person that told me it was averaging might not even know what averaging is :D
 
ron22 said:
True, but do you tell them you are averaging it?
Click to expand...

I keep it on a need to know basis.

We had a piece of equipment a long time ago that was supposed to crank out something at 100 cycles per minute. I needed to display a running average of the last 10 cycles. That meant the first 10 weren't really valid, but what really got to some people is that it took about 30 seconds or so for this equipment to ramp up to full speed. So, for the first 40 seconds or so the average was always less than 100. I had to deal with someone just unable to comprehend that what was being displayed was not instantaneous.

Gahhh. Some people.
 
Matthew said:
I keep it on a need to know basis.

We had a piece of equipment a long time ago that was supposed to crank out something at 100 cycles per minute. I needed to display a running average of the last 10 cycles. That meant the first 10 weren't really valid, but what really got to some people is that it took about 30 seconds or so for this equipment to ramp up to full speed. So, for the first 40 seconds or so the average was always less than 100. I had to deal with someone just unable to comprehend that what was being displayed was not instantaneous.

Gahhh. Some people.
Click to expand...
What you obviously needed was a zero delay filter, aka: time machine.
 
gismo said:
What you obviously needed was a zero delay filter, aka: time machine.
Click to expand...

That's phase 2 after we complete the mind reading module.

We had a very stupid question on a propoal once and it asked how the software would detect if an envelope had been double stuffed (Invoicing System).

We put in a lengthy explanation of the "fondler module" that we had written. :rofl:
 
bartmc said:
That's phase 2 after we complete the mind reading module.

We had a very stupid question on a propoal once and it asked how the software would detect if an envelope had been double stuffed (Invoicing System).

We put in a lengthy explanation of the "fondler module" that we had written. :rofl:
Click to expand...

Meh - include another $750K for adding a weighing system.
 
What if the "fondler module" becomes self aware and tries to replicate and improve itself. We would have to create a whole new set of sexual predator laws. (just tying in a thought from a previous thread).
 
John221us said:
What if the "fondler module" becomes self aware and tries to replicate and improve itself. We would have to create a whole new set of sexual predator laws. (just tying in a thought from a previous thread).
Click to expand...

What if it just fondles itself?
 
Sac Arrow said:
I think I could have more easily read Chinese.
Click to expand...

That makes at least 2 of us!! I do well to type the right things in to the computers and iPads, much less figure out how they work! :lol:
 
Matthew said:
It's easy. You just have to think like a computer - be really stupid and do only exaxtly what you are told.
Click to expand...

I have a clever reply, but it would get this thrown into the spin zone. :yes:
 
John221us said:
A self gratifying computer? That would be somewhat recursive and could result in an infinite loop. :eek:
Click to expand...

This could be more dystopian than computers becoming intelligent and taking over the world. Once computers become self gratifying, all productivity would stop. Humans would have to do their own accounting, again.
 
John221us said:
This could be more dystopian than computers becoming intelligent and taking over the world. Once computers become self gratifying, all productivity would stop. Humans would have to do their own accounting, again.
Click to expand...
What makes you think they aren't already self gratifying. How else can you explain Windows locking up just a few seconds before you were going to save your work. I can almost see my computer smirk when it does that.
 
bartmc said:
Miss curly brackets much?

I always put 'em in. Can't stand code written like that.
Click to expand...

+1 on that. I've seen this kind of bug happen in places I've worked, and the result was always the same: coding standard was updated to curly brace the one liners.

I find it interesting that the "many community eyes looking at the open source code" even failed to notice.
 
You must log in or register to reply here.
Back
Top