Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero

[MacRumors]

Google's security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.

Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:

At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. [...]

Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.

As the 90-day deadline hit during the week, the group began posting its findings online. Google's notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.

But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.

ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.

Google's Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.

Article Link: Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero

 

[JeffiJers]

what about fixing wifi issues? they can't do that right?

 

[bawbac]

Anyone hear that that explosion at Cupertino?

 

[KdParker]

Google is playing dirty.

 

[bawbac]

Google is playing dirty.

How?
They could expose the issue without the 90 day grace period if they wanted to be dirty.

 

[ArtOfWarfare]

The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it.

I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.

I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.

 

[Keirasplace]

Anyone hear that that explosion at Cupertino?

The irony that Android right now is biggest botnet source in the world right now because of crap level security and upgrade policy... That I could have 100+ separate security patches for Microsoft in one year... Makes Apple pretty secure from any derision from the likes of Google or Microsoft.

 

[maflynn]

Google is playing dirty.

You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple

 

[genovelle]

I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.

I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.

They should first expose the holes in Android that they refuse to patch or can't.

 

[admmasters]

How about Google actually fix their own bugs?

Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548

Those in glass houses...

 

[genovelle]

You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple

Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.

 

[H2SO4]

Great. Please release it tonight Timmy.

 

[thekeyring]

Google is playing dirty.

Playing dirty would be writing OS X malware.

It occurred to me a few months ago that Apple could write Android malware, to prove how insecure it is, and to worsen people's UX so they switch to iPhone.

Obviously it's ethically questionable, so Apple won't do it, and neither will Google do it for OS X.

 

[Patriot24]

I'm not sure that 90 days is a realistic expectation for a major operating system to patch issues. Most companies simply are not that nimble.

Lets also not forget that when Apple did push a fix to all computers for a critical vulnerability that there were a lot of upset folks.

No one wins in these deals.

 

[H2SO4]

Lets also not forget that when Apple did push a fix to all computers for a critical vulnerability that there were a lot of upset folks.

Can you elaborate pls?

 

[purplemaize]

10.10.2

There are other problems I tried to get out, but my feedback assistance does not work. On the VoiceOver, turned it on followed the instructions and I had no response, at first I thought it was just me. I asked my son who uses the program all the time and on my computer it just not respond properly. Took a short movie of it. Tried to send it thru feed back with other major problems and everything is stuck in Draft.

 

[maflynn]

Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.

How do you know they're not.

 

[xdigi]

Hope it also blocks the installation of Chrome and sets the default search to Bing just to repay Google for being insufferable, childish [bleep]'s.

You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple

As much as Larry Page would like to believe it, Google is not the software police so they can kindly take a long walk off a short cliff.

 

[SusanK]

Google is playing dirty.

No. That was Cook when he fired Forstall.

 

[jay_app]

Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.

 

[joueboy]

Makes me wonder if that team found any bugs on the Android and Chrome OS yet?

 

[Patriot24]

Can you elaborate pls?

https://forums.macrumors.com/threads/1831362/

I saw a lot of people on twitter and elsewhere voicing frustration that something was installed on their machine without explicit authorization.

 

[teslo]

Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.

is this based on truth, or does it have more to do with Window's more open structure - meaning (and I don't know much about this or the terminology): wouldn't it have more to do with third party integrations than things that Microsoft could/would do about it?

 

[dugbug]

How?
They could expose the issue without the 90 day grace period if they wanted to be dirty.

they could have asked if a release was imminent. the point is to get them patched, not be the first.

 

[quackers82]

An odd move by Google. They moved from Windows to Mac OS X because Windows caused them to have a big security breach. So Google now has 40,000+ Macs deployed. You would then think that Google would hold off until 10.10.2 was released so that there was an Apple patch for products they use. Its close to exposing yourself.