SSL Exploit

Dev Community Apps & Creations
1

Afternoon lads (and ladettes).

So, I was thinking about this SSL exploit that is affecting all of us on anything else than iOS 7.0.6. 

 

This one guy managed to capture all SSL traffic between iOS/MacOS-devices (including app updates, app store stuff). 

 

So. I'm thinking if it would be possible to intercept stuff on the Apple TV, maybe enabling us to spoof apples signing to be able to put apps on the start screen without having to restore, restart and update and downgrade and mess around. 

 

I'm no hardcore-coder, so it might be a massive task - but I thought I might as well raise the question   :)

(The article I'm basing this on: http://9to5mac.com/2014/02/25/takes-security-consultant-less-than-a-day-to-exploit-os-x-bug-to-capture-all-ssl-traffic/#more-311746)

 

Update:

He say that he won't provide information on how he did the hack until Apple has patched everything that needs patching - but, if we don't update our devices - we could potentially use that information on our non-updated devices to just intercept stuff. Right?

2

This could help ?

https://www.imperialviolet.org/2014/02/22/applebug.html

3

Here is the site to check if you are vulnerable on any iOS device besides the ATV (since there is no browser) and any OSX version: https://gotofail.com


If you are on OSX you will need to update to OSX 10.9.2 unless there is a patch that I am not aware of.


Here is the site/repo/deb to fix if you are jailbroken on iOS devices and do not want to update to a newer IOS. http://www.ibtimes.co.uk/fix-ssl-bug-without-updating-ios-7-0-6-or-ios-6-1-6-1437636


Update - Looks like its missing from his repo. Now its on bigboss.