iPhones and Macs get fix for extremely critical “triple handshake” crypto bug
Apple has patched versions of its iOS and OS X operating systems to fix yet another extremely critical cryptography vulnerability that leaves some users open to surreptitious eavesdropping.
Context & Ripple Effects
This is the second critical transport-crypto hole Apple has shipped fixes for within roughly two months. In late February the Gotofail SSL/TLS verification flaw forced emergency updates for iOS 7.0.6 and 6.1.6 and was later shown to reach Mail, Twitter, iMessage and FaceTime, not just Safari.
The timing compounds an already bruising stretch for Apple's cryptography: the same news cycle includes the Heartbleed fallout, with Apple's newest AirPort Extreme and Time Capsule models affected until the iOS 7.0.6-era patch wave was followed by Base Station Firmware Update 7.7.3. Pickup by Re/code, Threatpost and Bugtraq shows the story travelled well beyond the security trade press.
First-order effects
- iPhone and Mac users running unpatched iOS or OS X builds are directly exposed to surreptitious eavesdropping until they apply the updates Apple released on April 22, 2014.
- IT administrators managing mixed iPhone-and-Mac fleets face a second coordinated patch cycle in two months, with no single fix covering both mobile and desktop at once.
Second-order effects
- After Gotofail and Heartbleed, Apple's TLS implementation choices come under renewed scrutiny from researchers and enterprises evaluating platform trust, raising the reputational cost of each subsequent crypto defect.
- The drumbeat strengthens the case among Apple watchers for wider pre-release testing of its operating systems, a direction the company had just moved toward by opening OS X beta testing to all users through its new public seed program rather than paid developers alone.
Third-order effects
- If the pattern of high-severity crypto flaws in mainstream consumer platforms holds through 2014, expect security response speed and transparency to become a differentiator in platform competition alongside features.
- Sustained pressure on closed-source stacks like Apple's feeds the longer argument that widely deployed cryptographic code needs independent audit and faster disclosure channels, reshaping how large vendors structure their security engineering.
The trend: Consumer computing platforms are being pushed into a continuous emergency-patching posture by a steady stream of transport-layer crypto vulnerabilities, with Apple now patching twice in two months.