Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

New Version of 'January 1, 1970 Bug' Can Brick Pre-iOS 9.3.1 Devices Over Compromised Wi-Fi Networks

farleysmaster said:
If you have OS X, you can remove them but yes it wouldn't be a bad idea to let you do that from your iDevice.
Click to expand...

But only if you use iCloud Keychain (which I do not). For a networking device, the iPhone is missing some key settings like this one. You can also not specify a preferred network if multiple known networks are available. It is actually really annoying.
 
  • Like
Reactions: magicman32 and JackANSI
KALLT said:
But only if you use iCloud Keychain (which I do not). For a networking device, the iPhone is missing some key settings like this one. You can also not specify a preferred network if multiple known networks are available. It is actually really annoying.
Click to expand...
Yeah, I do use iCloud Keychain. I'm not sure if it carries across the network priorities from that. I'd rather have them separate to be honest as some networks are more preferred for some of my devices...
 
KALLT said:
But only if you use iCloud Keychain (which I do not). For a networking device, the iPhone is missing some key settings like this one. You can also not specify a preferred network if multiple known networks are available. It is actually really annoying.
Click to expand...

I've posted this (complete lack of a basic function) as a bug on every release version and beta version since iOS 6...
 
  • Like
Reactions: ardent73, alvindarkness, t1meless1nf1n1t and 1 other person
KPOM said:
They probably should have waited another few weeks before publishing this. Corporate users with mobile device management are often told to wait (or even prevented from) upgrading until the update gets approved. They do this to make sure the updates don't interfere with their servers or proprietary apps. At my employer, we just got the approval for 9.3.1 about 2 weeks ago.
Click to expand...
you must be at the big 4 too huh
 
KPOM said:
They probably should have waited another few weeks before publishing this. Corporate users with mobile device management are often told to wait (or even prevented from) upgrading until the update gets approved. They do this to make sure the updates don't interfere with their servers or proprietary apps. At my employer, we just got the approval for 9.3.1 about 2 weeks ago.
Click to expand...

Agreed. As another person noted, this only alerts malicious people to a new toy to play with.
 
I'm just going to assume people are discovering these sorts of bugs on other peoples' phones.
 
  • Like
Reactions: Demo Kit
viperGTS said:
Wait, so you mean that Apple didn't fix the actual cause of the bug (which was apparently how the OS handles January 1st, 1970 in binary), and instead just prevented the user from setting the date as such?

Great...
Click to expand...
The earliest you can set it now is 2000, but what's even the point of that?
 
  • Like
Reactions: V.K.
BasicGreatGuy said:
Every flavor of OS has bugs and obscure flaws waiting to be found. Just because another flaw was found, that doesn't mean that Apple's focus on security is a joke.
Click to expand...

It's not that hard to think: "oh maybe we should double check the input on that setting before we use it".

That was covered in a high school programming class I took... decades ago.

I routinely get the feeling I'm using a device that was programmed by nit wits sometimes.
 
  • Like
Reactions: ardent73, alvindarkness, g-7 and 1 other person
KALLT said:
That right there is your problem. As if automatic joining of known SSIDs was not a bad enough idea, iOS also offers no way to see, edit and remove these known SSIDs, unless you are in range. You can only reset your networking settings to clear everything, but who does that on a regular basis? I do not understand why Apple has not done anything about it. I’d wager that there are many iPhone users out there who have long lists of known SSIDs.
Click to expand...

Yes! This!!!

If your using iCloud and have a OS X device as well, can delete SSID associations in network settings and they get removed from the iPhone. But pretty clumsy... Maybe they are trying to sell MacBooks?
 
  • Like
Reactions: CreatorCode
This is old news. As soon as the 1970 bug was discovered, people on Reddit were talking about how you could use NTP to brick iPhones. And people here were defending Apple because "nobody is stupid enough to set their date to 1/1/1970"...

I guess I'll update to 9.3.1 now. I thought this was fixed in 9.3.
 
  • Like
Reactions: JackANSI, alvindarkness and discuit
Dhmspector said:
Should never happen if apple is using ntp - the spec and all common implementations forbid time travel (setting clock backwards). So this is purely and Apple bug, not ntp.
Click to expand...

Very tiny nitpick: In some situations, the clock will indeed be set backwards with ntp, but it's an unusual circumstance and the change should be quite small.

However, ntp's defaults (last I knew) forbid any clock correction exceeding 1000 seconds, so this kind of massive, 40-year correction should not be possible under any circumstances. Either Apple wrote their own time sync client (why?) or changed this default in their implementation of ntp. (Again, why?)

Incorrect device clocks have major security implications for any network, so even without this bricking bug, Apple should be paying closer attention to this. Time sync should never be an afterthought.
 
  • Like
Reactions: alvindarkness, Avalontor, 69Mustang and 3 others
smacrumon said:
Come on, Apple! Find and Replace 1970 in entire Project!
Always fascinating to hear what little bugs present in iOS.
Click to expand...

pat500000 said:
Another 1970 crap. If you don't know about, don't worry about it. If you know about.....pretend you don't know about it.
Click to expand...

viperGTS said:
Wait, so you mean that Apple didn't fix the actual cause of the bug (which was apparently how the OS handles January 1st, 1970 in binary), and instead just prevented the user from setting the date as such?

Great...
Click to expand...

maxsix said:
Apple iOS, it just works... oh wait :eek:
Click to expand...

JackANSI said:
Apple's "focus on security" is a joke.
Click to expand...

Andres Cantu said:
So now we need an update to the update to the update to the update :D
Click to expand...
Apple already fixed the issue in iOS 9.3.1.
 
  • Like
Reactions: centauratlas
coolfactor said:
Were they not validating the NTP responses, allowing garbage in?
Click to expand...
Yeah... People on StackOverflow are saying that NTP is usually used in the unsecured form. I don't know why. NTP security is complicated since normal security mechanisms rely on the current date/time to verify certificates, and of course, you can't do that in this case ;). That made me think: Besides this bug, spoofed NTP servers could trick clients into validating expired certificates, right? Isn't this something everyone should be worried about?
 
  • Like
Reactions: alvindarkness, centauratlas and V.K.
Another notable reason why it's so important for timely updates to be delivered to devices and not be held to the whims of the cell carriers (or manufacturers who support their products for short periods of time).
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back