You don't expect macrumors to report that part of the story do you? It's less sensational.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Security Researcher Reveals iOS Security Flaw, Gets Developer License Revoked
- Thread starter wrldwzrd89
- Start date
- Sort by reaction score
You don't expect macrumors to report that part of the story do you? It's less sensational.
OK, but how long had Miller known about this bug? When did his app go live on the store? How long did it take for him to build his app and for it to progress through Apple's convoluted verification progress?
It's almost a certainty that he knew about the bug long ago, while iOS5 was still in beta, and yet he waited until 2 days after iOS5 had been released to the public before he informed Apple.
The man is, and always has been, a self-publicising arse. He has a track record of presenting his vulnerabilities such that Apple looks as bad as possible. However, this effort, deliberately placing malware on the app store and timing his report to Apple so that it was far too late for them to address his concerns, is low even by his standards.
If Miller had pulled a stunt like this on Steve's watch, does anyone really believe the outcome would have been any different?
Last edited:
I don't understand why he or anyone else is suprised by this.
Any developer who has ever submitted bugs to Apple will know they don't reply until they have something to reply about. They don't waste time with a pointless thank you response. They'll reply if they need more information, if they've fixed it or if it's erroneous.
I've submitted at least half a dozen bugs, some pretty serious, not security but certainly massive fails but I've never felt the need to shout about them from the roof tops. I was just happy that they fixed them! However they have replied to me every single time.
So the fact that he only submitted the bug report less than a month ago isn't very surpising he hadn't heard back from them yet. Some things take a while to test!
However when he submitted an app which broke the iOS contract he signed, that being loading code, what the heck did he think was going to happen. He broke his legal contract, of course he was going to get kicked out of the program!
Any developer who has ever submitted bugs to Apple will know they don't reply until they have something to reply about. They don't waste time with a pointless thank you response. They'll reply if they need more information, if they've fixed it or if it's erroneous.
I've submitted at least half a dozen bugs, some pretty serious, not security but certainly massive fails but I've never felt the need to shout about them from the roof tops. I was just happy that they fixed them! However they have replied to me every single time.
So the fact that he only submitted the bug report less than a month ago isn't very surpising he hadn't heard back from them yet. Some things take a while to test!
However when he submitted an app which broke the iOS contract he signed, that being loading code, what the heck did he think was going to happen. He broke his legal contract, of course he was going to get kicked out of the program!
Lets get this straight, Charlie put that video up on YouTube almost a whole month before submitting the bug to Apple. Which means he had already created and submitted the app to Apple and got it up on the AppStore by September 23rd. He had no intention of reporting this to Apple straight away. He made the video first, he wanted the fame, he got kicked out for it.
http://www.youtube.com/watch?v=ynTtuwQYNmk&feature=player_embedded
http://www.youtube.com/watch?v=ynTtuwQYNmk&feature=player_embedded
I don't understand why some security researches are so eager to be jerks.
"Waiting... Waiting... Wa--... No, I can't take this anymore! I must be a jerk now! YouTube it is!"
A month is barely enough for Apple to build, test and release a new patch. It's quite an ordeal to release software on this scale. He should just contact product-security@apple.com and move on. Apple is definitely listening quite well to serious, technical, and detailed reports coming in on that e-mail, and rolling fixes into future patches. There's absolutely no logical reason for Apple to ignore serious security problems (it hurts them and it hurts us), and guys like this one should work from that assumption.
Anyone purporting this guy to be some sort of hero or "good guy" in any way shape or form must be completely ignorant or egregiously stupid. He is a white hat hacker of the worst kind. Rather than doing his meaningless day job of consulting work he trolls commercial platforms looking for bugs that he can capitalize on at hacking convention. Just like all white hats he gets shown up by the black hats at every single turn so he needs to constantly be on the look out for anything that could make him look like a big shot.
For some reason, the population at large cannot wrap their heads around the fact that while many black hats are up to no good it's the white hats that all have truly evil intentions.
For some reason, the population at large cannot wrap their heads around the fact that while many black hats are up to no good it's the white hats that all have truly evil intentions.
Fixed.
It's Apple. They have a long-standing policy of not talking about security flaws until they're fixed. So just because he didn't have someone calling him up or personally dropping around to his place to throw some streamers in the air doesn't mean they were ignoring him. This should also not be news to anyone who has had any involvement with the security of Apple products (or for that matter, any random person on the net who subscribes to Apple's security announcements email).
No it doesn't. It makes him look like a smart-ass douche.
Indeed, some people here seem to think that patching a system security hole just happens with a snap of fingers. Apple, contrarily to others we shall not name, release security updates only when they're entirely sure the patch fixes the issue.
It has been witnessed that other prominent software companies had to release patches of patches repeatedly to fix some security problems.
I'm no expert but the way things are described also suggest there's a possibility that the fix needs to encompass both iOS itself and its SDK.
Charlie Miller is such a d*ck...
Is this sarcasm, or are you seriously that ****ing stupid?
----------
............ He didn't tell Apple until iOS 5 was finalized... because it was unfinalized, and there was a chance they were working on it...
He didn't tell Apple until iOS 5 was finalized... because then he'd lose his opportunity to grandstand.
There. Fixed that for you.
This sort of thing happened to me once. Forget about iOS. When I just bought my very first iMac G5, yes, the non-Intel one, some dude from Malaysia could switch on my iMac remotely using his smartphone. He never told me how but I would never let that the son-of-a-bitch into my house again. Anybody knows how you could prevent tho from happening? There is a way to remotely cold boot your iMac, as I read it somewhere in the net. If you live in a dense apartment block, somebody, your neighbor can hack into your wifi into your system and see what are in your folders. This is scary.
----------
I hate hackers. But they are impossible to track & eradicate. Apple should go the other way: employ him, rather him going rogue and develop somekind of underground martyr street cred.
----------
I hate hackers. But they are impossible to track & eradicate. Apple should go the other way: employ him, rather him going rogue and develop somekind of underground martyr street cred.
Charlie did the right thing. Exposing, publicizing and offering proof of concept means Apple must now be on the ball and fix this thing. People here laugh at Android's Market for applications that can mine data, and when a bug shows up in iOS that allows it, they lambast the guy who proved it can be done, it can be put up on the App Store and it's not just some "proof-of-concept" or theoretical exploit.
If he had not submitted the app to Apple and put it up, people that are presently saying all he wants is fame (why would he require this ? He's already famous in this circle. He's found tons of OS X bugs in the past, participated in tons of conferences) would be saying "Apple would never approve such an app into the App Store anyway".
It's a lose/lose for Charlie. I applaud his effort and Apple should have had more class. Now they need to get on the ball and actually fix this before some malicious hackers get on it. Apple is a big corporation. Open source projects that have serious security flaws can usually get a fix out within a day or 2, there's no reason Apple can't do it. Much less in a few weeks.
If he had not submitted the app to Apple and put it up, people that are presently saying all he wants is fame (why would he require this ? He's already famous in this circle. He's found tons of OS X bugs in the past, participated in tons of conferences) would be saying "Apple would never approve such an app into the App Store anyway".
It's a lose/lose for Charlie. I applaud his effort and Apple should have had more class. Now they need to get on the ball and actually fix this before some malicious hackers get on it. Apple is a big corporation. Open source projects that have serious security flaws can usually get a fix out within a day or 2, there's no reason Apple can't do it. Much less in a few weeks.
If you lived next door to me, and I noticed you left your door open, would you want me to let you know or go camp out in your living room without asking? Why go through all the trouble of making a scene about it with an app and whining to Twitter. Next he'll be crying next to Gloria Allred about it.
Absolutely. He's the guy blazin through Apple's security-protections at Pwn2Own on an annual basis.
I'm sure someone is typing up some "fandroids hatin'"-reply already (I got none, tough luck), bring it on.
Oh god, yet MORE tripe about how anyone supports Apple must be an employee. Just like the people who say that anyone who ever writes a favorable review must be bribed. How about this? Try not insulting everyone else's integrity, and get a life while you're at it.
People really don't read any comments in here and just go straight to "Post reply" to spew off some venom, aren't they?
You must be new on the internet. Nobody here reads the articles they are commenting on let alone already posted comments. Read the title and off you go.
The number of people claiming to have read the article and claiming that there is not date of submission to Apple don't add up.
Which means one of two things, most people on this site cannot actually read, or they are just lazy and liars.
I found the date within 3 seconds of opening the link to the Forbes page.
As he submitted the find to Apple, and they just did what they usually do - ignore people - then he was perfectly entitled to make it public knowledge. If this is what it takes for Apple to address a problem it is not this guys fault, it is Apple who are to blame.
Which means one of two things, most people on this site cannot actually read, or they are just lazy and liars.
I found the date within 3 seconds of opening the link to the Forbes page.
As he submitted the find to Apple, and they just did what they usually do - ignore people - then he was perfectly entitled to make it public knowledge. If this is what it takes for Apple to address a problem it is not this guys fault, it is Apple who are to blame.
You are making an assumption they ignored him... what did he want to happen Tim Cook to turn up at his front door with a cake and a bottle of champagne and a years subscription to Playboy?
No more likely they were investigating, fixing and testing, all of which would in all likely hood take longer than the time since he submitted a bug. As someone who apparently submitted dozens of bugs before he would already have known that he wouldn't get a response until it had either been fixed or they needed more information.
As for the comment above about him not submitting it until after iOS5 was released because they might have believed they were fixing it... it is entirely the point of the betas to submit bug reports and not wait until after it's released.
Also releasing a proof of concept on a blog or security research site is a differnet thing, no he had to release it in a downloadable app for people to use. He broke a legal contract that he signed, Apple terminated the contract because of that, end of story.
That is sort of a hen egg situation though. He is famous exactly because he pulls stunts like this one.
Lets be honest here. He found a huge bug. He exploited it for his personal benefits and he did not report it to Apple right away, but waited a while (coincidentally shortly after the major release of iOS). He gets nice publicity and a great talk out of it.
That said. He found a huge bug. He reported it to Apple and waited for a good amount of time before going public with it. Apple had a chance to get in contact with him or actually push out a fix or even pay him to shut up for a little while longer. Just because "Apple has a history to not talk about security risks until they are fixed" doesn't mean it is the right thing to do, nor does it mean that a person making a living of discovering security holes, has to wait forever to go public with his findings.
And just to finalize these thoughts. I'd much rather have a spotlight-seeking analyst find these holes then a Russian (no offense to Russians
hacker trying to actually utilize this. T.