Apple has released iOS 5, which includes a significant number of security updates, most notably the removal of the DigiNotar root certificates from the iOS trusted root list. The new operating system for iPhones, iPads and iPods also includes support for newer versions of the TLS protocol and eliminates support for the MD5 algorithm in almost all cases.
The release of iOS 5 not only addresses the DigiNotar CA compromise issue and the new attack on TLS and SSL, but it also includes patches for dozens of other vulnerabilities, notably a slew of memory-corruption bugs in WebKit. Apple fixed 95 vulnerabilities in all, affecting a wide range of components in iOS, as well as the kernel itself. But it’s the fix for the fraudulent DigiNotar certificates trusted by iOS that’s the most notable entry in the list.
“Fraudulent certificates were issued by multiple certificate authorities operated by DigiNotar. This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar’s certificates, including those issued by other authorities, are not trusted,” the Apple advisory said.
The attack on DigiNotar that was revealed in August involved an attacker compromising the company’s CA infrastructure and issuing fraudulent, but valid, digital certificates to himself for a laundry list of high-value sites including Google, Skype and a number of government and intelligence agencies. The attack resulted in the Dutch government taking over the operations of the CA and all of the major browser manufacturers quickly removed the DigiNotar root certificates from their list of trusted roots. Apple did so as well, but hadn’t made the change on iOS-powered devices until now.
iOS 5 also drops support for the MD5 hash algorithm, which has a number of known security problems, for all certificates except for root certs.
“This algorithm has known cryptographic weaknesses. Further research or a misconfigured certificate authority could have allowed the creation of X.509 certificates with attacker controlled values that would have been trusted by the system. This would have exposed X.509 based protocols to spoofing, man in the middle attacks, and information disclosure. This update disables support for an X.509 certificate with an MD5 hash for any use other than as a trusted root certificate,” Apple’s advisory said.
Apple also has added support for TLS 1.2, a newer version of the encryption protocol, in order to protect users against the attack developed by researchers Juliano Rizzo and Thai Duong. That attack on SSL/TLS enables them to decrypt secure cookies sent over an encrypted connection and hijack a user’s SSL session with a given site.
With the release of iOS 5, Apple also has simplified the backup process for users. The new operating system now will automatically sync IOS devices wirelessly over a shared WiFi connection any time that the device is plugged in to a power source.
