Subject: [saag] Problem with most email clients

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 22 Feb 2014 22:46:07 -0500

Someone decoded the iOS patch Apple sent out. Apple is reporting that it
also affects OSX as well.

If this is the issue I reported to Apple a few weeks ago, EVERYONE needs to
check. And there are some non-intuitive ways to extend the attack.

http://www.reuters.com/article/2014/02/22/us-apple-encryption-idUSBREA1L10220140222

Basically I have exploit code that is dumping usernames and passwords out
of the STARTTLS connections...

-- 
Website: http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 22 Feb 2014 23:15:27 -0500

Just to clarify, by EVERYONE I meant other vendors. This is not limited to
Apple.

On Sat, Feb 22, 2014 at 10:46 PM, Phillip Hallam-Baker <[email-masked]>wrote:

> If this is the issue I reported to Apple a few weeks ago, EVERYONE needs
> to check. And there are some non-intuitive ways to extend the attack.
>
>

---

From: "Peter Yee" <[email-masked]>
Date: Sun, 23 Feb 2014 09:47:57 -0800

More details from Adam Langley.  He indicates that the problem fixed has to
do with verifying the signature in the ServerKeyExchange message.  Details
here:

https://www.imperialviolet.org/2014/02/22/applebug.html

                                -Peter

From: saag [mailto:[email-masked]] On Behalf Of Phillip Hallam-Baker
Sent: Saturday, February 22, 2014 8:15 PM
To: [email-masked]
Subject: Re: [saag] Problem with most email clients

On Sat, Feb 22, 2014 at 10:46 PM, Phillip Hallam-Baker <[email-masked]>
wrote:

http://www.reuters.com/article/2014/02/22/us-apple-encryption-idUSBREA1L1022
0140222

Basically I have exploit code that is dumping usernames and passwords out of
the STARTTLS connections...

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 23 Feb 2014 13:33:04 -0500

Yes, it seems that the issue I found affected the Mac because the whole SSL
checking was borked, not just mail clients. So now I know why it took more
to provoke the issue on other platforms. I never though to check Safari

But it can be provoked in some seriously plausible attack scenarios...

On Sun, Feb 23, 2014 at 12:47 PM, Peter Yee <[email-masked]> wrote:

> More details from Adam Langley.  He indicates that the problem fixed has
> to do with verifying the signature in the ServerKeyExchange message.
> Details here:
>
>
>
> *From:* saag [mailto:[email-masked]] *On Behalf Of *Phillip
> Hallam-Baker
> *Sent:* Saturday, February 22, 2014 8:15 PM
> *To:* [email-masked]
> *Subject:* Re: [saag] Problem with most email clients
>
>
>