Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero

MacRumors

macrumors bot
Original poster
Apr 12, 2001
51,479
13,108



Google's security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.

Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. [...]

Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.
As the 90-day deadline hit during the week, the group began posting its findings online. Google's notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.

But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.
Google's Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.

Article Link: Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero
 

ArtOfWarfare

macrumors G3
Nov 26, 2007
9,056
4,992
The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it.

I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.

I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.
 
Comment

Keirasplace

macrumors 601
Aug 6, 2014
4,059
1,278
Montreal
Anyone hear that that explosion at Cupertino?

The irony that Android right now is biggest botnet source in the world right now because of crap level security and upgrade policy... That I could have 100+ separate security patches for Microsoft in one year... Makes Apple pretty secure from any derision from the likes of Google or Microsoft.
 
Comment

genovelle

macrumors 65816
May 8, 2008
1,145
1,073
I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.

I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.
They should first expose the holes in Android that they refuse to patch or can't.
 
Comment

genovelle

macrumors 65816
May 8, 2008
1,145
1,073
You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple

Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.
 
Comment

thekeyring

macrumors 68040
Jan 5, 2012
3,441
2,075
London
Google is playing dirty.

Playing dirty would be writing OS X malware.

It occurred to me a few months ago that Apple could write Android malware, to prove how insecure it is, and to worsen people's UX so they switch to iPhone.

Obviously it's ethically questionable, so Apple won't do it, and neither will Google do it for OS X.
 
Comment

Patriot24

macrumors 68030
Dec 29, 2010
2,811
794
California
I'm not sure that 90 days is a realistic expectation for a major operating system to patch issues. Most companies simply are not that nimble.

Lets also not forget that when Apple did push a fix to all computers for a critical vulnerability that there were a lot of upset folks.

No one wins in these deals.
 
Comment

purplemaize

macrumors newbie
Jan 23, 2015
3
0
10.10.2

There are other problems I tried to get out, but my feedback assistance does not work. On the VoiceOver, turned it on followed the instructions and I had no response, at first I thought it was just me. I asked my son who uses the program all the time and on my computer it just not respond properly. Took a short movie of it. Tried to send it thru feed back with other major problems and everything is stuck in Draft.
 
Last edited:
Comment

maflynn

Moderator
Staff member
May 3, 2009
67,503
34,762
Boston
Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.

How do you know they're not.
 
Comment

xdigi

macrumors member
Jan 16, 2015
36
0
Hope it also blocks the installation of Chrome and sets the default search to Bing just to repay Google for being insufferable, childish [bleep]'s.

You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple

As much as Larry Page would like to believe it, Google is not the software police so they can kindly take a long walk off a short cliff.
 
Comment

jay_app

macrumors member
Apr 20, 2004
31
38
Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.
 
Comment

joueboy

macrumors 68000
Jul 3, 2008
1,576
1,545
Makes me wonder if that team found any bugs on the Android and Chrome OS yet?
 
Comment

teslo

macrumors 6502a
Jun 9, 2014
929
599
Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.

is this based on truth, or does it have more to do with Window's more open structure - meaning (and I don't know much about this or the terminology): wouldn't it have more to do with third party integrations than things that Microsoft could/would do about it?
 
Comment

quackers82

macrumors 6502
Mar 13, 2014
340
168
An odd move by Google. They moved from Windows to Mac OS X because Windows caused them to have a big security breach. So Google now has 40,000+ Macs deployed. You would then think that Google would hold off until 10.10.2 was released so that there was an Apple patch for products they use. Its close to exposing yourself.
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.