Developer says now-fixed Apple HomeKit vulnerability was temporarily worsened in iOS 11.2

AppleInsider

Though Apple ultimately solved the issue with iOS 11.2.1 and tvOS 11.2.1, a HomeKit vulnerability discovered in October was simply made more severe in iOS 11.2, according to one developer.

The developer, going by "Khaos Tian," said on Medium that he first discovered the flaw in Apple Watches with watchOS 4.0 or 4.1, which potentially gave someone control of any HomeKit accessory due to insecure data sharing. He reported the issue to Apple Product Security in late October, but the company -- including Software Engineering VP Craig Federighi -- is said to have ignored follow-up emails after saying it would investigate.

iOS 11.2 actually expanded the reach of the problem, letting iPhone and iPad owners sniff out HomeKit data without a Watch.

Tian ended up publicizing the matter by contacting 9to5Mac, which in turn talked to Apple PR. That led to Apple's short-term fix, disabling remote access by shared users, before iOS 11.2.1 and tvOS 11.2.1 went live on Dec. 13.

Apple ordinarily prides itself on the security of HomeKit, which uses heavy encryption. In fact the demands of authentication are one reason many HomeKit accessories require a separate hub, and why some early products were slow to respond to commands.

lkrupp

And not single verified report  of ANY actual hack happening. That’s the thing about these security flaws. They are reported and everybody runs around with their hair on fire, the person who found it gets their 15 minutes of fame and chest thumping, it’s fixed and goes away. And I’m not talking about Apple only here. We hear about flaws in Android that will probably never get patched because of how carriers do things, yet no mass hackings or emptied bank accounts. Remember the Wi-Fi Krack Hack in which the very basis of WPA2 was flawed. Millions upon millions of client devices and routers were vulnerable and the Internet was predicted to cease to exist. How many of those have actually been patched? How many users suffered loses because of it? And of course we have the ‘unforgivable’ I_Am_Root flaw that let someone with physical access to your Mac login as Root without a password. OMG the weeping and gnashing of teeth over that one. Know what I did? Nothing at all. I just waited for the patch to come out.

My point, and I do have one, is that the frenzy and recriminations that follow these reports is completely unjustified. As for this particular report, that iOS 11.2 temporarily exacerbated the problem, my response is a big so what. It’s fixed now and I would like someone to show me one instance of somebody’s door being unlocked and their home burglarized because of this flaw. The security experts with their hair on fire running around in circles predicting the Apocalypse should stop being such asshats about it. It doesn’t help things by scaring people into a coma thinking they’ll lose everything if they touch their keyboard.

livingroom

lkrupp said: A bunch of stuff

I wish I could upvote your post so much. why is it so overblown when it happens to Apple, and yet 300,000 security flaws a year happen in windows and nothing is said? geez I hate people. 

hmurchison

The whole reason for such articles to gain so much traction neatly explained by this image. 



They don't care about security they care about clicks.