Apple says iOS, OS X and certain Web services protected against 'Heartbleed'

Posted:
in General Discussion edited April 2014
Apple on Thursday released a statement saying its major operating platforms, iOS, OS X and certain Web services, are not affected by the massive "Heartbleed" security flaw discovered earlier this week.



As reported by Re/code, Apple has confirmed that its systems and services remain largely untouched by the secure sockets layer (SSL) bug known as "Heartbleed," a bug found in open source software that could potentially compromise the passwords and personal information of millions.

"Apple takes security very seriously. iOS and OS X never incorporated the vulnerable software and key web-based services were not affected," the spokesperson said.

News of Heartbleed, a name given to the bug officially designated as CVE-2014-0160 by MITRE, first hit earlier this week. The flaw was discovered in the OpenSSL implementation of the TLS/DTLS heartbeat extension and, when exploited, leaks both server-client and client-to-server cached memory.

According to Heartbleed.org, the bug allows anyone on the Internet to read the memory of systems protected by vulnerable versions of OpenSSL software, including secret keys websites used to encrypt traffic. Nefarious users can use the data to gather usernames and passwords, eavesdrop on communications and steal data directly from services affected.

Major websites like Google, Facebook and others have already implemented fixes for the flaw, but security researchers still urge users to change their passwords as there was a point when these sites were not patched.
«1

Comments

  • Reply 1 of 37
    nhtnht Posts: 4,522member
    If you ever used MacPorts to download anything check your openssl package.

    In the console type:

    $ openssl version

    If it shows 0.9.8y (the Mavericks default) you're fine. If it shows 1.0.1 then your mac has the vulnerability. 1.0.1g has the patched library.

    do:

    $ sudo port upgrade openssl

    For brew users I THINK the proper way to update is:

    $ brew update
    $ brew install openssl
    $ brew link --force openssl

    But check on the web. I don't use brew.
  • Reply 2 of 37
    d4njvrzfd4njvrzf Posts: 797member

    This information is only really relevant if you running OS X on your servers. The heartbleed bug targets web servers, not end user machines. As long as the sites you visit are vulnerable to the heartbleed bug, the credentials you use to authenticate to those sites could be at risk regardless of what OS you are running on your personal machine.

     

    Edit: I don't know what I'm talking about; I did not consider the possibility of a client initiating a "secure" SSL connection to an untrustworthy server. Heartbleed can definitely affect clients as well. http://security.stackexchange.com/questions/55119/does-the-heartbleed-vulnerability-affect-clients-as-severely?lq=1

  • Reply 3 of 37
    nhtnht Posts: 4,522member
    Quote:

    Originally Posted by d4NjvRzf View Post



    This information is only really relevant if you running OS X on your servers. The heartbleed bug targets web servers, not end user machines. As long as the sites you visit are vulnerable to the heartbleed bug, the credentials you use to authenticate to those sites could be at risk regardless of what OS you are running on your personal machine.

     

    True, but some things are services that might run on your desktop.  For example PostgreSQL uses OpenSSL.  I have that installed on my machine for stuff.  Then again, I'm a dev.

  • Reply 4 of 37
    inoseyinosey Posts: 89member
    Good ole Apple protecting us!
  • Reply 5 of 37
    mdriftmeyermdriftmeyer Posts: 7,503member
    Quote:

    Originally Posted by d4NjvRzf View Post



    This information is only really relevant if you running OS X on your servers. The heartbleed bug targets web servers, not end user machines. As long as the sites you visit are vulnerable to the heartbleed bug, the credentials you use to authenticate to those sites could be at risk regardless of what OS you are running on your personal machine.

     

    The hell it is. It's relevant to anyone running MacPorts, BREW or any other add-on series of UNIX Services not provided by Apple's OS X infrastructure and Dev Tools.

  • Reply 6 of 37
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by mdriftmeyer View Post

     
    Quote:
    Originally Posted by d4NjvRzf View Post



    This information is only really relevant if you running OS X on your servers. The heartbleed bug targets web servers, not end user machines. As long as the sites you visit are vulnerable to the heartbleed bug, the credentials you use to authenticate to those sites could be at risk regardless of what OS you are running on your personal machine.

     

    The hell it is. It's relevant to anyone running MacPorts, BREW or any other add-on series of UNIX Services not provided by Apple's OS X infrastructure and Dev Tools.


    If your personal machine allows access from the Internet and has either a self signed certificate or a valid certificate and is exposing any SSL suites using the unpatched version of OpenSSL, then it would be vulnerable to Heartbleed. If it is not offering any SSL suites to clients then it is not vulnerable. So in that sense, the other poster is correct because unless you are serving connections to SSL suites then there is no attack possible. This has nothing to do with you, as a client, connecting to a server using SSL, except that if whatever server you are connecting to is vulnerable, your personal information is at risk. Heartbleed is not a virus. It is a method of attacking a server running something in SSL with OpenSSL in which the vulnerability exposes access to the server's memory, cache, cookies, etc where information about recent visitors is stored, but not the disk storage. The attack can also steal the server's private keys in the same manner, which could allow malicious impersonation of a trusted certificate.

  • Reply 7 of 37
    nhtnht Posts: 4,522member
    Quote:

    Originally Posted by mstone View Post

     

    If your personal machine allows access from the Internet and has either a self signed certificate or a valid certificate and is exposing any SSL suites using the unpatched version of OpenSSL, then it would be vulnerable to Heartbleed. If it is not offering any SSL suites to clients then it is not vulnerable. So in that sense, the other poster is correct because unless you are serving connections to SSL suites then there is no attack possible. This has nothing to do with you, as a client, connecting to a server using SSL, except that if whatever server you are connecting to is vulnerable, your personal information is at risk. Heartbleed is not a virus. It is a method of attacking a server running something in SSL with OpenSSL in which the vulnerability exposes access to the server's memory, cache, cookies, etc where information about recent visitors is stored, but not the disk storage. The attack can also steal the server's private keys in the same manner, which could allow malicious impersonation of a trusted certificate.


     

    This is false.  Clients are vulnerable too.

     

    According to RFC 6520, heartbeats should not be sent during handshakes. In practice, OpenSSL accepts heart beats right after the sending a ServerHello (this is what Jared Stafford's ssltest.py does). Upon further testing, I have discovered that servers can abuse clients by sending a Heartbeat right aftersending the ServerHello too. It triggers the same bug.

    A proof of concept can be found in my repo at https://github.com/Lekensteyn/pacemaker. From its README:

    The following clients have been tested against 1.0.1f and leaked memory before the handshake:


    • MariaDB 5.5.36

    • wget 1.15 (leaks memory of earlier connections and own state)

    • curl 7.36.0

    • git 1.9.1 (tested clone / push, leaks not much)

    • nginx 1.4.7 (in proxy mode, leaks memory of previous requests)

    It has been demonstrated that about 64 KiB of memory (65565 bytes) is indeed returned. It has also been demonstrated that clients (wget) can leak more data under certain circumstances (after a HTTP redirect over HTTPS).

    Also, a lot things are servers that we forget about.  For example Call of Duty is a server and is vulnerable to the Heartbleed exploit and as I mentioned PostgreSQL.

    The more I look the more I see OpenSSL in stuff I use.  Even updating the version MacPorts installs isn't a guarantee.

  • Reply 8 of 37
    bdkennedy1bdkennedy1 Posts: 1,459member
    Apple needs to make an ad for that.
  • Reply 9 of 37
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by nht View Post

     
    Also, a lot things are servers that we forget about.  For example Call of Duty is a server and is vulnerable to the Heartbleed exploit and as I mentioned PostgreSQL.


    PostgreSQL CAN use SSL as a server instance, only if there is a certificate being presented, otherwise, the management desktop suite cannot connect using SSL. I'm certainly not a security expert but I have spent the better part of two days learning and checking all of our servers against https://www.ssllabs.com/ssltest/index.html to help our lame IT department, You'll need to go into considerable detail to refute my original comments. I don't think you have researched this as much as I have, I can be corrected, but you'll need to cite authoritative sites. Clients are vulnerable but only if they are connecting to a compromised server.

  • Reply 10 of 37
    It was probably the 7.0.6 and 6.1.6 update
  • Reply 11 of 37
    Was SSL update so I wonder if they reported it. It really affected a lot sites. Glad that's patched.
  • Reply 12 of 37
    Quote:

    Originally Posted by bdkennedy1 View Post



    Apple needs to make an ad for that.

     

     

    I can just picture the interaction between the PC Guy and the Mac Guy about Heartbleed..

  • Reply 13 of 37
    d4njvrzfd4njvrzf Posts: 797member
    Quote:

    Originally Posted by BestKeptSecret View Post

     

     

     

    I can just picture the interaction between the PC Guy and the Mac Guy about Heartbleed..


    Windows is not affected by this bug either, as it does not use OpenSSL.

  • Reply 14 of 37
    ezhikezhik Posts: 101member
    bdkennedy1 wrote: »
    Apple needs to make an ad for that.
    About what, exactly? Apple is not in the server business.
  • Reply 15 of 37
    crowleycrowley Posts: 10,453member
    ezhik wrote: »
    About what, exactly? Apple is not in the server business.
    http://www.apple.com/mac-mini/server/
  • Reply 16 of 37
    ezhikezhik Posts: 101member
    crowley wrote: »
    Well it's not really fit for the type of stuff Linux is used for. Even iCloud uses Windows Azure (which is not vunerable btw).
  • Reply 17 of 37
    chipsychipsy Posts: 287member

    Good to hear, though again this article makes it sound as if when using Apple you are better protected against Heartbleed while it is pretty much the same. Google's Chrome OS, Android and Chrome also weren't affected (nor is Windows btw). Just like Apple it did affect some of Google's online services but are already patched just like is the case with Apple I presume. I guess it's the way you spin it, saying most are unaffected sounds better as some are affected I guess but it's the same thing. Yahoo and Tumblr seems to be the most affected of the big names on the internet.

    A more important question actually is, how many and which apps in the Play Store, App Store and Windows Phone store are affected?

  • Reply 18 of 37
    marvfoxmarvfox Posts: 2,275member

    Is there any protection we can use for this problem?

  • Reply 19 of 37
    negafoxnegafox Posts: 480member
    I guess under the same token Microsoft could claim they take "security very seriously" and never incorporated OpenSSL in their products.
  • Reply 20 of 37
    chipsychipsy Posts: 287member
    Quote:
    Originally Posted by marvfox View Post

     

    Is there any protection we can use for this problem?




    Unfortunately there isn't much (if anything) we can do. We pretty much are dependent on the companies/developers to fix it, all we can do is when it's fixed is to change our password. Changing your password while it's not yet fixed would be useless as well. As far as I know there is no pro-active way of protecting yourself against this (edit: with the exception of using two-factor authentication as d4NjvRzf mentions below, this doesn't guarantee that your password won't be leaked but it at least prevents access even if it did).

Sign In or Register to comment.