Betteridge’s Regulation of Headlines insists that any headline posed as a query can immediately be answered with a easy “No.”
Apparently, the speculation behind this witticism (it’s not really a Regulation, nor but a rule, nor even the truth is something greater than a suggestion) is that if the creator knew what they had been speaking about, and had actual proof to assist their case, they’d have written the headline as an undiluted truth.
Effectively, we’re not journalists right here on Bare Safety, so thankfully we’re not certain by this regulation.
The ruthless reply to our personal query within the headline above is, “Nobody is aware of besides Apple, and Apple isn’t saying.”
A greater however admittedly middle-of-the-road reply is, “Wait and see.”
Fast responses
This story began late yesterday, on the tail finish of 2023-06-10 UK time, after we excitedly [do you mean ‘excitably?’ – Ed.] wrote an advisory about Apple’s second-ever Fast Safety Response (RSR):
These RSRs are, as we defined beforehand, Apple’s effort to ship single-issue emergency fixes as promptly as well-managed open supply challenge usually do, the place zero-day patches typically come out inside a day or two of an issue being discovered, with updates-to-the-updates following promptly if additional investigations reveal additional points needing to be mounted.
One purpose open supply tasks can take this form of method is that they normally present a obtain web page with the complete supply code of each officially-released model ever, in order that when you rush to undertake the most recent fixes in hours, moderately than in days or even weeks, they usually don’t work out, there’s no barrier to rolling again to the earlier model till the fix-for-the-fix is prepared.
Apple’s offical improve pathway, nevertheless, a minimum of for its cellular gadgets, has all the time been to provide full, system-level patches that may by no means be rolled again, as a result of Apple doesn’t like the concept of customers intentionally downgrading their very own techniques as a way to exploit previous bugs for the aim of jailbreaking their very own gadgets or putting in different working techniques.
Consequently, even when Apple produced emergency one-bug or two-bug fixes for zero-day holes that had been already being actively exploited, the corporate wanted to provide you with (and also you wanted to place your religion in) what was basically a one-way improve, though all you actually wanted was a minmalistic replace to at least one part of the system to patch a transparent and current hazard.
Enter the RSR course of, permitting fast patches which you can set up in a rush, that don’t require you to take your telephone offline for 15 to 45 minutes of repeated reboots, and which you can later take away (and reinstall, and take away, and so forth) when you determine that the treatment was worse than the illness.
Bugs patched briefly by way of an RSR might be patched completely within the subsequent full model improve…
…in order that RSRs don’t want or get an entire new model variety of their very own.
As an alternative, they get a sequence letter appended, in order that the primary Fast Safety Response for iOS 16.5.1 (which got here out yesterday) is displayed in Settings > Common > About as 16.5.1 (a).
(We don’t know what occurs if the sequence ever goes previous (z), however we’d be prepared to take a small wager on the reply being (aa), or maybe (za) if alphabetic sortability is taken into account vital.)
Right here right now, gone tomorrow
Anyway, only a few quick hours after advising everybody to get iOS and iPadOS 16.5.1 (a), as a result of it fixes a zero-day exploit in Apple’s WebKit code and will due to this fact nearly definitely be abused for malware nastinesses equivalent to implanting spy ware or grabbing personal knowledge out of your telephone…
…commenters (particular because of John Michael Leslie, who posted on our Fb web page) began reporting that the replace was not exhibiting up after they used Settings > Common > Software program Replace to attempt to replace their gadgets.
Apple’s personal safety portal nonetheless lists [2023-07-11T15:00:00Z] the newest udpates as macOS 13.4.1 (a) and iOS/iPadOS 16.5.1 (a), dated 2023-07-10, with no notes about whether or not they’ve formally been suspended or not.
However stories by way of the MacRumors web site recommend that the updates have been withdrawn in the interim.
One prompt purpose is that Apple’s Safari browser now identifies itself in internet requests with a Consumer-Agent string that features the appendage (a) in its veraion quantity.
Right here’s what we noticed after we pointed our up to date Safari browser on iOS at a listening TCP socket (formatted with line breaks to enhance legibility):
$ ncat -vv -l 9999
Ncat: Model 7.94 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.42.42.1.
Ncat: Connection from 10.42.42.1:13337.
GET / HTTP/1.1
Host: 10.42.42.42:9999
Improve-Insecure-Requests: 1
Settle for: textual content/html,software/xhtml+xml,
software/xml;q=0.9,*/*;q=0.8
Consumer-Agent: Mozilla/5.0 (iPhone;
CPU iPhone OS 16_5_1 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko)
Model/16.5.2 (a)
Cellular/15E148 Safari/604.1
Settle for-Language: en-GB,en;q=0.9
Settle for-Encoding: gzip, deflate
Connection: keep-alive
NCAT DEBUG: Closing fd 5.
In keeping with some MacRumors commentators, that Model/ string, consisting because it does of the same old numbers and dots together with some bizarre and surprising textual content in spherical brackets, is complicated some web sites.
(Mockingly, the websites we’ve seen blamed on this apparently version-string-misparsing-blame-game all appear to be providers which are far more generally accessed by devoted apps than by way of a browser, however the principle appears to be that they apparently choke on that 16.5.2 (a) model identifier when you determine to go to them with an up to date model of Safari.)
What to do?
Strictly talking, solely Apple is aware of what’s happening right here, and it’s not saying. (At the least, not formally by way of its safety portal (HT201222) or its About Fast Safety Responses web page (HT201224.)
We recommend, if you have already got the replace, that you simply don’t take away it except it genuinely interferes together with your potential to make use of your telephone with the web sites or apps you want for work, or except your individual IT division explicitly tells you to roll again to the “non-(a)” flavour of macOS, iOS or iPadOS.
In spite of everything, this replace was deemed appropriate for a fast response as a result of the exploit it fixes is an in-the-wild, browser-based distant code execution (RCE) gap.
For those who do want or want to take away the RSR, you are able to do this:
- If in case you have an iPhone or iPad. Go to Settings > Common > About > iOS/iPadOS Model and select Take away Safety Response.
- If in case you have a Mac. Go to System Settings > Common > About and click on the
(i)icon on the finish of merchandise entitled macOS Ventura.
Observe that we put in the RSR instantly on macOS Ventura 13.4.1 and iOS 16.5.1, and haven’t had any issues looking to our typical internet haunts by way of Safari or Edge. (Do not forget that all browsers use WebKit on Apple cellular gadgets!)
Subsequently we don’t intend to take away the replace, and we’re not prepared to take action experimentally, as a result of we don’t know whether or not we’ll be capable to reinstall it once more afterwards.
Commenters have prompt that the patch merely doesn’t get reported after they strive from an unpatched machine, however we haven’t tried re-patching a previously-patched machine to see if that provides you a magic ticket to fetch the replace once more.
Merely put:
- For those who’ve already downloaded macOS 13.4.1 (a) or iOS/iPadOS 16.5.1 (a), maintain the replace except you completely need to do away with it, provided that it’s securing you towards a zero-day gap.
- For those who put in it and actually need or need to take away it, see our directions above, however assume that you simply gained’t be capable to reinstall it later, and can due to this fact put your self into the third class beneath.
- For those who haven’t bought it but, watch this area. We’re guessing that the
(a)patch will quickly get replaced by a(b)patch, as a result of the entire concept of those “lettered updates” is that they’re meant to be fast responses. However solely Apple is aware of for certain.
We’ll patch our typical recommendation from yesterday by saying: Don’t delay; do it as quickly as Apple and your machine will allow you to.
