Comment by dspillett
5 hours ago
Don't underplay it either though: with a compromised but unrevoked signing cert all it takes is a successful phish, or some problem to allow DNS poisoning (or hack a wireless AP, or …) to direct you to a fake site or (potentially worse as it might be less immediately noticeable and could quietly collect credentials/data for a while) send your automated tools to a malicious API.
It may not be directly exploitable on its own, which is the impression some reports give, but it is a serious hole to leave open especially with the current rate of old security issues being found, as it could be _incredibly_ useful to a malicious actor as part of an exploit chain.
Doesn't affect app bundles though, only *nix commands. This'd be detected pretty quickly, at least by the significant portion of patched devices.
Unless you're clever enough to only poison user agents known to be macOS and CLI. You'd probably get by.
xz-tools was only caught because it had a bug causing slow startups and someone was micro-benchmarking Postgres and decided to dive in further.
One person, at that particular time. The person and the task were also a couple standard deviations away from the norm, the world was incredibly lucky.
The cert is provided before the user-agent string is
Yeah, it increases the attack surface of mitm attacks to your network from the local os level.