Hacker News Reader

Comment by remus | Hacker News Reader

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

View on HN

> We disclosed our results to Apple on May 24, 2024. Apple’s Product Security Team have acknowledged our report and proof-of-concept code, requesting an extended embargo beyond the 90-day window. At the time of writing, Apple did not share any schedule regarding mitigation plans concerning the results presented in this paper.

The vulnerability is over half a year old and over a quarter over the embargo window.

I wonder if Apple are being slow due to the complexity of the potential fix, or because they're dragging their feet.

Or it's a hardware issue and they don't have any way to do a microcode fix for this

It's could be unfixable without a significant performance penalty, but at minimum they could make safari do proper process isolation like every other browser does.

I could easily imagine such a refactor of Safari taking more than 90 days even if Apple made it the highest possible priority.

The bug is open since 2018, so clearly they don’t actually care about that.

https://bugs.webkit.org/show_bug.cgi?id=184466

Right, but that was before they knew about this exploit. My point was that even if they decided they needed to urgently switch to a multiprocesses architecture because it's the only way to mitigate this exploit, they might not be done yet.

This class of attacks is not new. Spectre demonstrated this possibility in 2018, and Apple was previously targeted by speculation attacks, e.g. https://gofetch.fail/ or https://ileakage.com/.

Because the fix will most likely kill performance, like Spectre/Meltdown did, and then their pretty graphs wont look so impressive any more.

As someone who has reported several (software) security vulnerabilities to Apple, I couldn’t care less. Some of the things I reported are trivial to fix, and dealing with their team has been a frustrating experience. They don’t deserve extensions, they need to get their shit together and stop releasing new crap every year. Clearly they can’t do it properly.

The LVP vulnerability was reported in September, for what it's worth.

That's still more or less 120 days ago. Well over the 90 day typical window.

I'm not saying it's bad (I'm pretty close to a disclosure absolutist), though I don't really know what the norms are for hardware attacks --- both papers are well past the normal coordinated disclosure window for software.

The vendor requested embargo timelines can get pretty crazy.

Intel requested an embargo for 21 months for SRBDS/Crosstalk.

For Downfall, a more recent one, Intel requested a 12 month embargo to release a microcode update.

For all I know, that might be a reasonable ask for these kinds of vulnerabilities --- not that researchers have to honor them.

> We disclosed SLAP to Apple on May 24, 2024, and FLOP on September 3, 2024

I think also this isn't fundamentally different to Spectre. Spectre introduced a whole new class of vulnerabilities (hence the name) and this is one of them. An impressive one, but still, it definitely doesn't deserve the coordination & secrecy that Spectre had.

Most browsers have already switched to process-per-site because of Spectre.

Does Apple pay bug bounties?

Yes, they do.

They claim to, but they drag their feet, demand terms most researchers find so unacceptable as to be a bit immoral (the point of "responsible disclosure" isn't, in fact, to hold secrets from the public arbitrarily long), and often end up paying only a fraction of what was expected, if anything.

https://pxlnv.com/linklog/apple-bug-bounty-troubles/

https://www.marketplace.org/shows/marketplace-tech/looking-f...

https://mjtsai.com/blog/2021/07/13/more-trouble-with-the-app...

The vibe I got talking to people like Mark Dowd about this is that they're running something closer to an exploit bounty program, and it's pretty focused on patterns of vulnerabilities common to some pretty specific threat actors.

Your links are all from 2021. I remember there was a lot of criticism at the time and so they updated their bug bounty program which quite a number of changes:

https://security.apple.com/blog/apple-security-bounty-upgrad...

Would be interesting to see if it made a difference.

Reply on news.ycombinator.com