Apple to get a month of security bugs

Independent security researchers to post Apple bug reports

Apple will soon be a member of the "month of bugs" club.

On January 1, two security researchers will begin publishing details of a flood of security vulnerabilities in Apple's products. Their plan was to disclose one bug per day for the entire month, they said.

The project is being launched by an independent security researcher, Kevin Finisterre, and a hacker known as LMH, who declined to reveal his identity.

Some of the bugs "might represent a significant risk", LMH said in an email interview. "Others have a lower impact on security. We are trying to develop working exploits for every issue we find."

The two hackers plan to disclose bugs in the Mac OS X kernel as well as in software such as Safari, iTunes, iPhoto and QuickTime, LMH said. Some of the bugs would also affect versions of Apple's software designed to run on Microsoft's Windows operating system, he said.

LMH was one of the brains behind the recent [Month of Kernel Bugs] project, which exposed flaws at the core of several different operating systems. It was inspired by an earlier effort, called the [Month of Browser Bugs], which was kicked off in July.

This latest Apple project was being launched to raise awareness of security vulnerabilities in Apple's products and to stomp smugness, Finisterre said via email.

While the Macintosh is generally considered to be more secure than the Windows PC, many security researchers believe that this reputation is not attributable to any superior security practices on the part of Apple. They say attackers have been deterred by the Mac OS X's more secure Unix kernel and the product's less widespread adoption.

Apple enthusiasts and security researchers have been at odds since last August, when David Maynor and Jon Ellch claimed to have discovered a flaw that affected Apple's wireless device drivers. They played a video at the Black Hat conference demonstrating how this flaw could be used to run unauthorised code on a MacBook. However, their claims have been slammed because the demonstration used a third-party wireless card rather than the one that ships with the MacBook, and because the two hackers still have not published the code used in their attack.

LMH said the Apple community's negative response to Maynor and Ellch's claims played a role in the decision to launch the Month of Apple bugs.

"I was shocked with the reaction of some so-called Apple fans," he said. "I can't understand why some people react badly to disclosure of issues in their system of choice. ... That helps to improve its security."

A similar effort to disclose flaws in Oracle's software had to be abandoned before it was ever launched last month. The man behind the Week of Oracle bugs, Cesar Cerrudo, of Argeniss Information Security, said he pulled the plug when it became clear that the project could damage the relationship between one of his customers and Oracle. "This customer realised that they could have had serious business problems, so they changed their mind and asked to cancel it," he said.

LMH said he didn't expect any legal problems from Apple. "I keep talking to a guy from the Apple security team and I'm willing to help whenever necessary," he said. "I'm far away from any illegal activity."

Apple, for its part, did not seem to be upset with the project. "We always welcome feedback on how to improve security on the Mac," an Apple spokesperson, Anuj Nayar, said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?