Quickemu: Quickly create and run optimised Win-10,11/macOS/Linux on Linux

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by coldacid on Friday October 08, 2021 @11:06AM (#28800147)

Which, without some form of certificate pinning, could still be MITM'd. At least if there's a catalogue of hashes for everything it downloads (hard-coded or configurable by the user, latter preferred) then at least it can verify the right files are being downloaded regardless of source.

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by password4321 on Friday October 08, 2021 @11:41PM (#28806853)

Apple Internet recoveryOS images are served over plain http, on purpose. The macrecovery.py script used by Quickemu uses http¹, though the server supports https.

https://support.apple.com/guide/security/recoveryos-and-diag...

> When the internet recovery and diagnostic modes were added to Mac computers in 2011, it was decided that it would be better to use the simpler HTTP transport, and handle content authentication using the chunklist mechanism, rather than implement the more complicated HTTPS functionality in the UEFI firmware, and thus increase the firmwareʼs attack surface.

¹https://github.com/acidanthera/OpenCorePkg/blob/4a740c3f256e...

[edit] Added macrecovery.py info

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by tinus_hn on Friday October 08, 2021 @11:15AM (#28800220)

Where would the user realistically get these?

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by coldacid on Friday October 08, 2021 @03:11PM (#28802926)

Well that's a matter of trust as well, isn't it? I would assume that even if it's user configurable, the app itself should still ship with an up to date catalogue whenever a new release is made. After all you're already trusting the app itself at that point.

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by genewitch on Friday October 08, 2021 @01:28PM (#28801727)

From the internet!

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by saagarjha on Friday October 08, 2021 @06:25PM (#28804839)

If you are having your SSL connection to Apple MITMed, then you have much bigger problems. Ones like "why do you have a malicious root cert in your keychain?!"

[ Parent | on HN ]

Re:Quickemu: Quickly create and run optimised Win-10,11/macO... by e12e on Saturday October 09, 2021 @06:38PM (#28813980)

> without some form of certificate pinning, could still be MITM'd

Now, apparently this uses plain http - but if tls/https is an option - any client (like curl/wget) should by definition come with a ssl trust root (os or bundled). If this is mitm'ed, you've got big problems. Certificate pinning doesn't really help that much in this case.

[ Parent | on HN ]