Betteridge’s Regulation of Headlines insists that any headline posed as a query can immediately be answered with a easy “No.”
Apparently, the speculation behind this witticism (it’s not really a Regulation, nor but a rule, nor even in truth something greater than a suggestion) is that if the writer knew what they had been speaking about, and had actual proof to help their case, they’d have written the headline as an undiluted truth.
Nicely, we’re not journalists right here on Bare Safety, so luckily we’re not certain by this legislation.
The ruthless reply to our personal query within the headline above is, “Nobody is aware of besides Apple, and Apple isn’t saying.”
A greater however admittedly middle-of-the-road reply is, “Wait and see.”
Speedy responses
This story began late yesterday, on the tail finish of 2023-06-10 UK time, after we excitedly [do you mean ‘excitably?’ – Ed.] wrote an advisory about Apple’s second-ever Speedy Safety Response (RSR):
These RSRs are, as we defined beforehand, Apple’s effort to ship single-issue emergency fixes as promptly as well-managed open supply mission typically do, the place zero-day patches typically come out inside a day or two of an issue being discovered, with updates-to-the-updates following promptly if additional investigations reveal additional points needing to be fastened.
One purpose open supply tasks can take this form of method is that they normally present a obtain web page with the total supply code of each officially-released model ever, in order that should you rush to undertake the most recent fixes in hours, slightly than in days or perhaps weeks, and so they don’t work out, there’s no barrier to rolling again to the earlier model till the fix-for-the-fix is prepared.
Apple’s offical improve pathway, nevertheless, at the very least for its cellular gadgets, has all the time been to produce full, system-level patches that may by no means be rolled again, as a result of Apple doesn’t like the thought of customers intentionally downgrading their very own programs in an effort to exploit previous bugs for the aim of jailbreaking their very own gadgets or putting in different working programs.
Consequently, even when Apple produced emergency one-bug or two-bug fixes for zero-day holes that had been already being actively exploited, the corporate wanted to give you (and also you wanted to place your religion in) what was primarily a one-way improve, regardless that all you actually wanted was a minmalistic replace to 1 element of the system to patch a transparent and current hazard.
Enter the RSR course of, permitting fast patches that you may set up in a rush, that don’t require you to take your cellphone offline for 15 to 45 minutes of repeated reboots, and that you may later take away (and reinstall, and take away, and so forth) should you determine that the remedy was worse than the illness.
Bugs patched briefly by way of an RSR shall be patched completely within the subsequent full model improve…
…in order that RSRs don’t want or get an entire new model variety of their very own.
As a substitute, they get a sequence letter appended, in order that the primary Speedy Safety Response for iOS 16.5.1 (which got here out yesterday) is displayed in Settings > Common > About as 16.5.1 (a).
(We don’t know what occurs if the sequence ever goes previous (z), however we’d be keen to take a small wager on the reply being (aa), or maybe (za) if alphabetic sortability is taken into account vital.)
Right here in the present day, gone tomorrow
Anyway, only a few brief hours after advising everybody to get iOS and iPadOS 16.5.1 (a), as a result of it fixes a zero-day exploit in Apple’s WebKit code and will subsequently virtually definitely be abused for malware nastinesses reminiscent of implanting adware or grabbing non-public knowledge out of your cellphone…
…commenters on Bare Safety began reporting that the replace was not exhibiting up after they used Settings > Common > Software program Replace to attempt to replace their gadgets.
Apple’s personal safety portal nonetheless lists [2023-07-11T15:00:00Z] the newest udpates as macOS 13.4.1 (a) and iOS/iPadOS 16.5.1 (a), dated 2023-07-10, with no notes about whether or not they’ve formally been suspended or not.
However experiences by way of the MacRumors web site counsel that the updates have been withdrawn in the interim.
One instructed purpose is that Apple’s Safari browser now identifies itself in internet requests with a Consumer-Agent string that features the appendage (a) in its veraion quantity.
Right here’s what we noticed after we pointed our up to date Safari browser on iOS at a listening TCP socket (formatted with line breaks to enhance legibility):
$ ncat -vv -l 9999
Ncat: Model 7.94 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.224.236.91.
Ncat: Connection from 10.224.236.91:54478.
GET / HTTP/1.1
Host: 10.42.42.42:9999
Improve-Insecure-Requests: 1
Settle for: textual content/html,software/xhtml+xml,
software/xml;q=0.9,*/*;q=0.8
Consumer-Agent: Mozilla/5.0 (iPhone;
CPU iPhone OS 16_5_1 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko)
Model/16.5.2 (a)
Cellular/15E148 Safari/604.1
Settle for-Language: en-GB,en;q=0.9
Settle for-Encoding: gzip, deflate
Connection: keep-alive
NCAT DEBUG: Closing fd 5.
In response to some MacRumors commentators, that Model/ string, consisting because it does of the standard numbers and dots together with some bizarre and surprising textual content in spherical brackets, is complicated some web sites.
(Mockingly, the websites we’ve seen blamed on this apparently version-string-misparsing-blame-game all appear to be providers which are way more generally accessed by devoted apps than by way of a browser, however the idea appears to be that they apparently choke on that 16.5.2 (a) model identifier should you determine to go to them with an up to date model of Safari.)
What to do?
Strictly talking, solely Apple is aware of what’s happening right here, and it’s not saying. (At the very least, not formally by way of its safety portal (HT201222) or its About Speedy Safety Responses web page (HT201224.)
We recommend, if you have already got the replace, that you just don’t take away it except it genuinely interferes along with your capacity to make use of your cellphone with the web sites or apps you want for work, or except your individual IT division explicitly tells you to roll again to the “non-(a)” flavour of macOS, iOS or iPadOS.
In spite of everything, this replace was deemed appropriate for a fast response as a result of the exploit it fixes is an in-the-wild, browser-based distant code execution (RCE) gap.
Should you do want or want to take away the RSR, you are able to do this:
- You probably have an iPhone or iPad. Go to Settings > Common > About > iOS/iPadOS Model and select Take away Safety Response.
- You probably have a Mac. Go to System Settings > Common > About and click on the
(i)icon on the finish of merchandise entitled macOS Ventura.
Observe that we put in the RSR straight away on macOS Ventura 13.4.1 and iOS 16.5.1, and haven’t had any issues searching to our traditional internet haunts by way of Safari or Edge. (Keep in mind that all browsers use WebKit on Apple cellular gadgets!)
Subsequently we don’t intend to take away the replace, and we’re not keen to take action experimentally, as a result of we do not know whether or not we’ll be capable to reinstall it once more afterwards.
Commenters have instructed that the patch merely doesn’t get reported after they strive from an unpatched gadget, however we haven’t tried re-patching a previously-patched gadget to see if that offers you a magic ticket to fetch the replace once more.
Merely put:
- Should you’ve already downloaded macOS 13.4.1 (a) or iOS/iPadOS 16.5.1 (a), preserve the replace except you completely need to eliminate it, on condition that it’s securing you towards a zero-day gap.
- Should you put in it and actually need or wish to take away it, see our directions above, however assume that you just gained’t be capable to reinstall it later, and can subsequently put your self into the third class beneath.
- Should you haven’t obtained it but, watch this house. We’re guessing that the
(a)patch will quickly get replaced by a(b)patch, as a result of the entire concept of those “lettered updates” is that they’re meant to be fast responses. However solely Apple is aware of for certain.
We’ll patch our traditional recommendation from yesterday by saying: Don’t delay; do it as quickly as Apple and your gadget will allow you to.
