Tuesday, November 4, 2014

Yosemite ... And 'Rootpipe'

On November 3, MacRumors and other websites, including Apple Insider reported that Apple had seeded the first beta of a Yosemite update to developers. Coming about three weeks after the first public release of the OS, it puzzled me. The first question that popped into my mind was, "Why so soon?" Everything appeared to be running reasonably well on my machine at least. I did some online research and realised that many other users had complained about issues with Wi-Fi and Bluetooth. Perhaps that was it, I thought, although -- according to both MacRumors and Apple Insider, Apple had asked developers to focus on Exchange accounts in Mail, and the Notification Center as well.

But then I remembered another small piece of information I had read much earlier -- October 31, 2014, to be precise -- on Macworld and other sites, which reported that a Swedish "hacker" had allegedly found a "'serious' vulnerability in OS X Yosemite" and earlier OSes as well. This vulnerability the gentleman had privately named "Rootpipe," refusing to discuss further details, as he'd already reported the 'bug' to Apple and was keeping anything related to this close to his chest until he'd received the go-ahead from Apple. Of course, if one takes reasonable precautions, one should be reasonably safe, write the websites, quoting the 'hacker.'

Today, those same websites, including Apple Insider reported: "Speaking at the Øredev Developer Conference in Malmö, Sweden, Emil Kvarnhammar of security firm TrueSec demonstrated a privilege escalation vulnerability affecting OS X 10.8.5 through the newest 10.10 Yosemite." Does this mean, I thought, that he'd now been given the go-ahead to talk about 'Rootpipe' from Apple? Could the impending release of the new update to Yosemite -- together with Wi-Fi and other issues -- include a fix for the vulnerability found by Emil Kvarnhammar?

Who knows? All we can do is hope that, while we wait for the fix to be issued, no person with illicit intentions gets into our systems.

No comments: