Diginotar and Safari / Mobile Safari patches

[rwbean]

This story just gets worse and worse! There hasn't been any Safari patch for the "man in the middle" attacks -- patches have to be done manually. There has been no iPhone update.

http://arstechnica.com/apple/news/2...tm_source=rss&utm_medium=rss&utm_campaign=rss

And today we find out there were 531 fake certificates issued. This is going to happen again at another CA; we need a better system.

http://www.securelist.com/en/blog/208193111/Why_Diginotar_may_turn_out_more_important_than_Stuxnet

 

[sk1wbw]

Saw that Firefox issued a patch a few days ago, but what about IE and the others?

 

[(marc)]

It's Apple's "security by denial" technique.

 

[sk1wbw]

It's Apple's "security by denial" technique.

That would be true IF you worked at Apple and the wherewithal to know that there was denial going on. I'm sure every browser is coming out with patches, it just kills me to listen to people harp on Safari. If Apple had not made Safari, nobody would give a **** about it.

 

[(marc)]

That would be true IF you worked at Apple and the wherewithal to know that there was denial going on.

I don't work at Apple, but I remember MR reporting that Apple staff were instructed not to tell people about the MacDefender malware, even when asked about it.

 

[sk1wbw]

And did Apple issue security updates about it? I'm sure they did. Maybe they don't issue them fast enough for you or something.

 

[(marc)]

And did Apple issue security updates about it? I'm sure they did. Maybe they don't issue them fast enough for you or something.

Apple hasn't even warned it's users of the Diginotar problem. Microsoft has already reacted and invalidated all Diginotar certificates.

 

[rwbean]

Apple hasn't even warned it's users of the Diginotar problem. Microsoft has already reacted and invalidated all Diginotar certificates.

Correct ... it's starting to get a bit of mainstream press coverage now.
Unfortunately Apple is proving as bad as Diginotar in terms of not communicating! Kudos for remembering about MacDefender, most people's (and my) memory isn't that long.

http://www.theregister.co.uk/2011/09/06/iphone_android_users_vulnerable/

A bug in the OS X keychain software makes it hard for Mac users to completely
distrust certificates signed by DigiNotar. Until Apple issues a patch, users can follow instructions here to protect themselves. They can also stop using Safari and instead use Chrome or Firefox. It's unclear what steps users of Apple's iDevices can take to block the bogus certificates.

http://www.foxnews.com/scitech/2011...-business-diginotar-could-spell-disaster-for/

Apple has made no official statements about plans to issue a patch for the Safari browser. Victor warns not to wait.
"For Apple, iPhone and iPad users, download the Opera browser. They'll be faster to issue a fix for this than Safari. And it's free," he told FoxNews.com.

 

[rwbean]

It is also getting attention on the Apple discussions forum:

https://discussions.apple.com/searc...ankBy=relevance&newq=diginotar*&numResults=30

Some (not all) people note that visiting https://www.diginotar.com or https://www.diginotar.nl on their iPad or iPhone gives them a warning, but it's hard to say if the problem is fixed. There is no communication from Apple.

 

[Bigmacduck]

TOR Blog on DigiNotar CA Debacle

Check out this blog: https://blog.torproject.org/blog/diginotar-damage-disclosure

I really wonder which of all the root certificates I absolutely need and which ones are leafs from the fraudulent root CA's

----------

This story just gets worse and worse! There hasn't been any Safari patch for the "man in the middle" attacks -- patches have to be done manually.

Checkout the following webpage. The author created a downloadable script that automatically marks the suspected root certificates an UNtrusted. There is also a good description of the debacle and more useful links.

http://ps-enable.com/articles/diginotar-revoke-trust

"good" thing is that with this CA attack every Apple user should now recognize that our beloved Apple products are indeed in the same boat as the Windows PC world when it comes to such security man-in-the-middleattacks.