The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole.
This issue really annoyed me, so I decided to procure Apple's PGP key and verify it as best I could. And I snooped my traffic with Wireshark during the downloads. Here are my findings:
- Getting and verifying Apple's PGP key was a waste of time, because as far as I can tell they don't issue signatures for software updates
- The update downloader connects over HTTPS to their software download locator domain, which redirects to the actual update on a CDN (in my case apple.vo.llnwd.net)
- Every single bit of the update package comes over plain old HTTP from the CDN
- Every single packet of the update is followed by a duplicate ACK (this only happens with the update, all my other downloads are fine, so I don't think it's my infrastructure)
- Manually downloading the dmg archive from here is HTTP by default. Enforcing HTTPS causes a redirect to the actual (HTTP) file URI, HTTPS is not enabled for this URI.
Apple (presumably responding to criticism of yesteryear) specifically say that updates are delivered over HTTPS except where "complicated proxy set ups" make this impossible. I have tried to download over my vanilla connection and 2 offshore VPN's, and for love nor money can I get an HTTPS link to that file (software update or via website).
My questions are:
- In your opinion are they - or someone in between - playing funny buggers?
- Is there suspicion to be drawn from all those duplicate ACKs? (I don't know enough about this to even speculate)
I'm suspicious because if I was the NSA/GCHQ and I had a weeks warning to intercept and replace blobs of binary on predictable HTTP endpoints that will auto-execute because code signing on millions of target machines is entirely broken, I'd probably think Christmas had come twice. I don't see any circumstance under which they could pass up such an opportunity if they were capable of it, and from everything I've read they are more than capable such a thing.