Betteridge’s Legislation of Headlines insists that any headline posed as a query can immediately be answered with a easy “No.”
Apparently, the idea behind this witticism (it’s not really a Legislation, nor but a rule, nor even in truth something greater than a suggestion) is that if the creator knew what they have been speaking about, and had actual proof to help their case, they’d have written the headline as an undiluted truth.
Properly, we’re not journalists right here on Bare Safety, so thankfully we’re not certain by this regulation.
The ruthless reply to our personal query within the headline above is, “Nobody is aware of besides Apple, and Apple isn’t saying.”
A greater however admittedly middle-of-the-road reply is, “Wait and see.”
Fast responses
This story began late yesterday, on the tail finish of 2023-06-10 UK time, once we excitedly [do you mean ‘excitably?’ – Ed.] wrote an advisory about Apple’s second-ever Fast Safety Response (RSR):
These RSRs are, as we defined beforehand, Apple’s effort to ship single-issue emergency fixes as promptly as well-managed open supply undertaking usually do, the place zero-day patches typically come out inside a day or two of an issue being discovered, with updates-to-the-updates following promptly if additional investigations reveal additional points needing to be mounted.
One purpose open supply tasks can take this type of method is that they normally present a obtain web page with the total supply code of each officially-released model ever, in order that when you rush to undertake the most recent fixes in hours, quite than in days or even weeks, and so they don’t work out, there’s no barrier to rolling again to the earlier model till the fix-for-the-fix is prepared.
Apple’s offical improve pathway, nonetheless, at the very least for its cellular gadgets, has at all times been to produce full, system-level patches that may by no means be rolled again, as a result of Apple doesn’t like the thought of customers intentionally downgrading their very own programs with the intention to exploit outdated bugs for the aim of jailbreaking their very own gadgets or putting in different working programs.
Consequently, even when Apple produced emergency one-bug or two-bug fixes for zero-day holes that have been already being actively exploited, the corporate wanted to give you (and also you wanted to place your religion in) what was basically a one-way improve, regardless that all you actually wanted was a minmalistic replace to at least one part of the system to patch a transparent and current hazard.
Enter the RSR course of, permitting fast patches that you would be able to set up in a rush, that don’t require you to take your telephone offline for 15 to 45 minutes of repeated reboots, and that you would be able to later take away (and reinstall, and take away, and so forth) when you determine that the treatment was worse than the illness.
Bugs patched quickly by way of an RSR will likely be patched completely within the subsequent full model improve…
…in order that RSRs don’t want or get a complete new model variety of their very own.
As a substitute, they get a sequence letter appended, in order that the primary Fast Safety Response for iOS 16.5.1 (which got here out yesterday) is displayed in Settings > Normal > About as 16.5.1 (a).
(We don’t know what occurs if the sequence ever goes previous (z), however we’d be keen to take a small wager on the reply being (aa), or maybe (za) if alphabetic sortability is taken into account vital.)
Right here as we speak, gone tomorrow
Anyway, only a few brief hours after advising everybody to get iOS and iPadOS 16.5.1 (a), as a result of it fixes a zero-day exploit in Apple’s WebKit code and will subsequently nearly actually be abused for malware nastinesses resembling implanting spyware and adware or grabbing non-public information out of your telephone…
…commenters (particular because of John Michael Leslie, who posted on our Fb web page) began reporting that the replace was not displaying up after they used Settings > Normal > Software program Replace to attempt to replace their gadgets.
Apple’s personal security portal nonetheless lists [2023-07-11T15:00:00Z] the latest udpates as macOS 13.4.1 (a) and iOS/iPadOS 16.5.1 (a), dated 2023-07-10, with no notes about whether or not they’ve formally been suspended or not.
However reports by way of the MacRumors website recommend that the updates have been withdrawn in the meanwhile.
One prompt purpose is that Apple’s Safari browser now identifies itself in net requests with a Consumer-Agent string that features the appendage (a) in its veraion quantity.
Right here’s what we noticed once we pointed our up to date Safari browser on iOS at a listening TCP socket (formatted with line breaks to enhance legibility):
$ ncat -vv -l 9999
Ncat: Model 7.94 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.42.42.1.
Ncat: Connection from 10.42.42.1:13337.
GET / HTTP/1.1
Host: 10.42.42.42:9999
Improve-Insecure-Requests: 1
Settle for: textual content/html,utility/xhtml+xml,
utility/xml;q=0.9,*/*;q=0.8
Consumer-Agent: Mozilla/5.0 (iPhone;
CPU iPhone OS 16_5_1 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko)
Model/16.5.2 (a)
Cellular/15E148 Safari/604.1
Settle for-Language: en-GB,en;q=0.9
Settle for-Encoding: gzip, deflate
Connection: keep-alive
NCAT DEBUG: Closing fd 5.
In line with some MacRumors commentators, that Model/ string, consisting because it does of the standard numbers and dots together with some bizarre and surprising textual content in spherical brackets, is complicated some web sites.
(Mockingly, the websites we’ve seen blamed on this apparently version-string-misparsing-blame-game all appear to be companies which can be way more generally accessed by devoted apps than by way of a browser, however the idea appears to be that they apparently choke on that 16.5.2 (a) model identifier when you determine to go to them with an up to date model of Safari.)
What to do?
Strictly talking, solely Apple is aware of what’s happening right here, and it’s not saying. (At the least, not formally by way of its safety portal (HT201222) or its About Fast Safety Responses web page (HT201224.)
We recommend, if you have already got the replace, that you simply don’t take away it until it genuinely interferes along with your means to make use of your telephone with the web sites or apps you want for work, or until your personal IT division explicitly tells you to roll again to the “non-(a)” flavour of macOS, iOS or iPadOS.
In any case, this replace was deemed appropriate for a fast response as a result of the exploit it fixes is an in-the-wild, browser-based distant code execution (RCE) gap.
When you do want or want to take away the RSR, you are able to do this:
- In case you have an iPhone or iPad. Go to Settings > Normal > About > iOS/iPadOS Model and select Take away Safety Response.
- In case you have a Mac. Go to System Settings > Normal > About and click on the
(i)icon on the finish of merchandise entitled macOS Ventura.
Notice that we put in the RSR instantly on macOS Ventura 13.4.1 and iOS 16.5.1, and haven’t had any issues looking to our common net haunts by way of Safari or Edge. (Do not forget that all browsers use WebKit on Apple cellular gadgets!)
Due to this fact we don’t intend to take away the replace, and we’re not keen to take action experimentally, as a result of we do not know whether or not we’ll have the ability to reinstall it once more afterwards.
Commenters have prompt that the patch merely doesn’t get reported after they strive from an unpatched system, however we haven’t tried re-patching a previously-patched system to see if that offers you a magic ticket to fetch the replace once more.
Merely put:
- When you’ve already downloaded macOS 13.4.1 (a) or iOS/iPadOS 16.5.1 (a), hold the replace until you completely need to eliminate it, provided that it’s securing you towards a zero-day gap.
- When you put in it and actually need or wish to take away it, see our directions above, however assume that you simply received’t have the ability to reinstall it later, and can subsequently put your self into the third class beneath.
- When you haven’t bought it but, watch this area. We’re guessing that the
(a)patch will quickly get replaced by a(b)patch, as a result of the entire thought of those “lettered updates” is that they’re meant to be fast responses. However solely Apple is aware of for positive.
We’ll patch our common recommendation from yesterday by saying: Don’t delay; do it as quickly as Apple and your system will allow you to.
