News for hackers. Stuff that matters.
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by anonymouse008 on Sunday October 09, 2022 @04:42PM (#33145138)
"For years, macOS allowed any root certificate when checking code signatures, making code signing completely useless."
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by wazzaps on Monday October 10, 2022 @02:25AM (#33148399)
I'm surprised Apple has no comprehensive test suite for this
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by bobbylarrybobby on Monday October 10, 2022 @10:34PM (#33158845)
There was that brief period where repeatedly pressing enter on the Lock Screen with an empty password field would eventually let you in as long as you had never seen a `su` password. And if I recall there was also a bug where the password hint would show your password in clear text?
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by Joyfield on Monday October 10, 2022 @02:37AM (#33148466)
"Think Different".
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by egberts1 on Monday October 10, 2022 @10:28AM (#33151844)
My thoughts exactly. I upvoted this despite some clueless folks downvoting you.
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by Tagbert on Monday October 10, 2022 @12:40PM (#33153525)
patched in macOS 12.4 / iOS 15.5
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by softwarebeware on Monday October 10, 2022 @09:44AM (#33151315)
This is old news, right? Did they not change this yet?
[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by lapcat on Monday October 10, 2022 @10:44AM (#33152028)
> This is old news, right?

The article is from July 2.

> Did they not change this yet?

First line of the article: "patched in macOS 12.4 / iOS 15.5"

[ Parent | on HN ]
Re:Mac Accepted Any Root Cert, Making Code Signing Useless by dserodio on Monday October 10, 2022 @06:13PM (#33157001)
Even if it's already patched, the fact that it was exploitable for years make it very much relevant. And of course, those with older computers that can't be updated to the latest macOS are still vulnerable.
[ Parent | on HN ]