Hacker News

points by lrvick 4 days ago | 0 comments

I -did- give you clear public evidence of severe gaps in their supply chain security on at least one heavily relied on Apple software library. Same is true of all their public repos and code.

What better evidence could I possibly provide?

Also see the other commenter in this thread who identified themselves as a former Apple contractor admitting Apple uses Jenkins. -Jenkins-.

[–] fastily 4 days ago

> plaintext God access to all of it from their individual engineer ssh keys

Scroll up, I asked for evidence of this specifically. This is a pretty damning allegation and worthy of further examination given the security implications for many, many users. Frankly, whatever they're doing in unrelated public repositories is concerning in a different context but otherwise thoroughly irrelevant to this claim above

[–] lrvick 4 days ago

Was easier to find public proof than I expected.

https://jobs.apple.com/en-us/details/200440680-3337/senior-l...

Puppet does not have quorum signing or approval support. By -design- it means one god server that ultimately trusts every ssh key of every admin to make changes to a fleet of -malleable- RedHat servers via ssh like it is 2005.

But for just one attack chain to humor you:

1. Malicious party gets access to one Apple engineer ssh key (Or literally just their email account since they sign nothing and the key could be swapped out temporarily)

2. They make a PR injecting a subtle malicious dependency to any of the core Apple component repos almost certainly used on prod servers on the Apple github.

3. They use their stolen key to merge the PR.

4. Code lands in next release and eventually lands in Apple production servers because nothing is signed so how would anyone know?

We learned nothing from xz.