Apple's iOS 9 Breaks VPNs 88
An anonymous reader writes with a report from The Stack that researchers have discovered a crucial security problem in the latest version of iOS 9: it breaks VPN connections to corporate servers. According to the linked piece, "The flaw was first detected in the iOS 9 beta, and has not been fixed in the released version. Neither has the bug been removed in the current iOS 9.1 beta." The workaround might not be what you want to hear, either, if you've happily upgraded to the latest version: it's to downgrade to iOS 8.4.1.
Good for the minnions (Score:3, Funny)
All the C-levels will be disconnected so we can get work done.
And here I thought Apple was a true business player.
Re:Good for the minnions (Score:5, Informative)
We're using Cisco's VPNs at the office and I've not observed it to be broken under iOS 9. Ditto for a colleague of mine.
Re:Good for the minnions (Score:5, Informative)
FTA "Most notable is that when doing split tunneling, the Tunnel All DNS option no longer functions as expected."
your setup maybe using public dns or published apps like Citrix.
Re: (Score:2)
So I take it this is a set-up where just some traffic goes into the tunnel? I did that with OpenVPN on Linux a while ago. Was a bit tricky and required policy-based routing because of DNS.
But if so, I gather the tunnel gets established fine, but routing of DNS-packets does no work as it should?
Re: (Score:1, Informative)
Yes, please use Android.
Whoops: https://code.google.com/p/andr... [google.com]
Re: (Score:1, Funny)
BlackBerry wins again. Boom
Re: (Score:1)
Yes, please use Android.
Whoops: https://code.google.com/p/andr... [google.com]
Hahahahahahaha!!!!!! That's GREAT!!!!
Re: (Score:1)
Why is this modded down? You guys normally love pointing out when Apple copies Android!
Re:Of course Apple wants into enterprise though? (Score:4, Interesting)
They have a LOT to do. We have had to switch our clients over to a chip and pin AD login from a regular local account. There is no easy way to do this, We can't apply the new security to the old accounts directly, or so I am told, so we have had to make another account and then "port" the old account data into the new one. Time machine broken, because it is protected by UID, no matching UID no backup, period. Keychain wonkiness, everything you know can go wrong with a keychain, has. Dropbox broken, easily fixed, but still... The best part, when 10.11 comes out no one can update because it will break al the chip and pin stuff and users won't be able to login. We have had to send 2 FAQ's on dealing with the asininity of all of this, and we are still stumbling across issues. One of my co-workers is tasked with something to do with programmers and root, that does not like these new accounts. No, I am not helping with that crap. BTW, when this happened with windows, they just pushed a package that did all the wizardry, which was simply installing a card reader driver, and a script that made sure that if there was a matching local account UID that it inherited that account.
That brings me to the next issue, patch management, or rather the lack of it. When 10.11 comes out we have to hope everyone listens, because otherwise we're playing fun account movement games after downgrading them back to 10.10. users cannot install printers now, we have people bringing their printers in to work, so that we can install them. We have to patch everyone manually as there is no way to manage them with what we have.
IT has been an absolute mess, and the boss, who is normally ok with letting a small thing slide without a ticket, is demanding that every interaction related to this, even 15 seconds, have a ticket so that he can show the massive time costs of this nonsense.
Re: (Score:2)
The original argument was saying enterprise was great because a single person represents 10,000 instead of those same 10,000 being represented by 10,000 people. The counter argument is that Apple excels precisely at getting consumers to decide on their platform in an individual fashion, so they have no reason to be attracted to such a prospect.
Re: (Score:3)
Therein lies the crux of the problem for Apple. The way in is basically to do a lot more work enabling concepts like group policies and also 'lighten up licenses' so that effectively people can get use of their work for less money. There isn't an obvious way forward for Apple.
They can hope that players will upend the industry for them in a way that aligns to their sensibilities, but bending their sensibilities to try to capture the way IT works as-is would be a losing proposition.
Re: (Score:3)
They did want to be in the enterprise and hence the XServe being created. They realized they just weren't aligned with the industry and the prospects were grim for return on investment for trying to change that. So they stopped doing things that required them to spend money when the returns may likely never happen.
However when Cisco and IBM want to fall all over themselves to 'partner' with Apple, Apple will take the free endorsement. Note that both the Cisco and IBM deals cost Apple approximately nothin
Source control? (Score:5, Insightful)
Happy to be wrong, but Apple have had a few regression-type bugs before which again make me think their branching/merging strategies may not quite be up to snuff. Would like to be wrong though - anyone know of a changed area in iOS 9 that would have necessitated playing with something like this?
Re: (Score:3)
Re: Source control? (Score:5, Funny)
Please send your resume to me. We need a few d*ck heads that lack the ability to be constructive in their comments.
Re:Source control? (Score:5, Insightful)
Re:Source control? (Score:5, Insightful)
This is what happens when you try to make a software update part of a hardware roll-out. They have hardware that they want to ship at a specific date, but haven't had any chance to get the software tested out in a while. They basically had to release iOS 9 even though they knew there was bugs because it was necessary for the new iPad and iPhone models.
Re: (Score:2)
This is what happens when you try to make a software update part of a hardware roll-out. They have hardware that they want to ship at a specific date, but haven't had any chance to get the software tested out in a while. They basically had to release iOS 9 even though they knew there was bugs because it was necessary for the new iPad and iPhone models.
You mean for publicity? I am sure iOS8 works fine on the new devices. The problem is that they promise a new version every year, and not releasing one would look bad.
Re: (Score:2)
The problem is that they promise a new version every year, and not releasing one would look bad.
So just change the 8 to a 9 and make a subtle graphic change and call it a day. I mean Chrome goes through something like 20 versions a month and doesn't seem to have changed in the past few years.
Re: (Score:2)
It works fine, but without any of the support for the new hardware features or the new OS features that are supposed to work with the new hardware features.
AFAICT, the new hardware basically requires a pretty significant OS revision. To be sure, a lot of the changes (like the "task manager" view which now shows a less convenient overlapping page view of existing open apps) seem purely for cosmetics.
Re: Source control? (Score:2)
Re: (Score:2)
When iOS 8 was released, people noticed straight away that images couldn't be uploaded to web sites. As in, multipart-encoded image data included in a web form was just stripped away.
My reaction was, "How could such a show-stopping lack of QA be allowed to happen at all, let alone WHY it happened?"
The reaction from many of my peers on DeviantArt and other art-related web sites, upon realizing the couldn't upload their art, was, "Oh, I'm sure it'll be fixed soon. No big deal."
Re: (Score:2)
Maybe the integration of a security patch or more important features that caused this. After all, they knew about the issue at launch so there's most probably a reasonable reason for the bug. In addition is appears only specific network configurations will cause the issue to occur.
Because I lack large dev team branching/merging experience, it's hard for me to understand where they could have gone wrong. To me having a branch that makes things work doesn't reverse the fact that another feature may be more im
Re: Source control? (Score:2)
They added support for different types of VPNs.
Re: (Score:2)
Is this a serious comment? Why would you assume they _wouldn't_ make any changes to a given subsystem?
Re: (Score:2)
Why? Source control doesn't prevent regressions. Besides, they've clearly been working in this area for iOS 9, see the new network extension points for example.
This doesn't even seem remotely related to branching/merging. To be
Android Too (Score:2, Interesting)
Makes you wonder why:
1. Cell manufacturers are moving to devices that cannot be truly turned off by removing the battery.
2. Android after 4.4 broke persistent VPN support.
3. Now iOS 9 breaks VPN support.
Coincidence? Who might prefer to have a citizenry carrying locator beacons that cannot be turned off and where encrypting all data communication has been disabled?
Re: (Score:3)
Coincidence? Who might prefer to have a citizenry carrying locator beacons that cannot be turned off and where encrypting all data communication has been disabled?
You can get cell position via DtoA and your actual calls have been broken open for a long time now, so this is not about that. This is about your data, not about your location.
Re: (Score:2)
I'm pretty paranoid, but even I've given up caring about non-removable batteries. If you're that worried, carry an anti-static bag (or other Faraday cage) around with you.
Re: (Score:2)
Never attribute to malice what can be attributed to corporate douche-bags pushing untested software out the door with a promise to fix it with the first few patches.
Re: (Score:1)
Makes you wonder why:
1. Cell manufacturers are moving to devices that cannot be truly turned off by removing the battery.
Aehm, no battery - no power? How is that different from being "turned off"?
Re: (Score:2)
All phones can be truly turned off by removing the battery and all batteries in phones can be removed. The question is how much damage that does.
Impossible (Score:2, Insightful)
Everyone knows that Macs just work, more Micro$oft FUD.
Split Tunneling? (Score:5, Insightful)
Problem is DNS during split tunneling, which isn't the same as "breaks VPN."
I guess the editors are either click-baiting, are technically illiterate, or both.
Re: (Score:2)
Problem is, while people like us understand what's going on here, the other 95% of the population only see's that their facebook isn't loading. To them, it broke VPN.
I'm sure of those 95%, 99% have no idea what DNS is
Re: (Score:1)
Apple's DNS implementations in general are a bit nonstandard and broken and are a huge headache for administrators. That's the real story that should be here.
Why and how? (and please try to resist the temptation to work the words: walled, garden and hipster into the reply)
Re: (Score:3)
Re: Split Tunneling? (Score:2)
Slashdot: Technically illiterate clickbait. Formerly "News for Nerds, Stuff that Matters".
Re: (Score:2)
To be fair, this topic is a bit advanced.
No such problems here (Score:1)
Didn't see any problems with VPNs during the betas, nor with final release. This is with connections to Junos Pulse, StrongSwan/xl2tpd, and racoon VPNs.
Maybe the reason it wasn't "fixed" is it isn't an issue in the first place.
Hint (Score:1)
Don't install .0 versions of operating systems on production systems. At least, not until they've been tested and shown to work.
A little more sense (Score:1)
Workaround is to reinstall that VPN software on your iOS device.
Downgrade? (Score:2, Interesting)
You can't downgrade if you didn't have a backup already.
IOS 9 broke other things as well. IOS 9 won't connect to hidden SSID WIFI networks either. I can verify this issue. There are some other grumblings of WPA / WPA2 connection issues for some as well.
Even some popular apps, like Words with Friends in my case don't work in IOS9.
Re: (Score:2)
My only connection at home is a hidden SSID network and it's working fine. Are you saying you can't connect to unknown hiddens? If so, sounds like the XP version of WiFi. That would bite.
Killing WwF, opening each game, not touching any tiles, going back to the home screen, then reopening the game seems to help. But yeah, it locks really easily. I'm surprised they didn't have an update ready. Then again, the app has always been a POS - at least on iOS.
Re: (Score:2)
Re: (Score:1)
The problem is that Apple is still used to having momentum by taking a market, then making money on an annual basis by incremental upgrades.
Since Jobs left, things just seem different. Simple things like being able to reliably sync an iPhone via a connector have been broken since iOS 5 [1].
Each iteration of OS X was supposed to be "faster" than the one before it, and there were a lot of leaps and bounds in background improvements. El Capitan has some decent improvements (especially in the security departm
Re: (Score:1)
Just to be a pedantic dickweed, SSDs are not rated by RPM, that is hard-drives. An SSD revolving at 7200 RPM would likely fail, probably in a violent fashion. However, I will not be testing this, as I am loath to damage my tools, and am rather lacking in spare SSDs.
That being said, I agree entirely with the spirit of your post.
Re: (Score:3)
HFS has been upgraded to improve. On-the-fly compression, built-in backup/versioning and whole-disk-encryption being some of the more visible things lately. Antivirus has been built-in to OS X since I think 10.5 and two-factor authentication has also been possible since I think 10.3.
As far as repairs, the 'hard drive' is still replaceable but it's not a SATA thing it's a PCI card and there are several aftermarket options.
Re: (Score:2)
In most cases when windows doesn't work it isn't windows that is to blame, it is a bad developer or bad/cheap hardware or drivers.
Great (Score:2, Interesting)
Switched from Android to iOS because Google won't fix their Bluetooth stack. I'll have to try my VPN on Friday and see if iOS 9 broke it. If so, I'll have to have two phones just so I can use two of the most important OS features that have been around for years but nobody can seem to get right (all at once, within one device, that is).
I thought you couldn't downgrade iOS (Score:2)
I thought Apple made it so you couldn't downgrade iOS (as a way to stop people from downgrading to a version that can be jailbroken)
No issues with iOS 9 and OpenVPN (Score:2)
It hasn't caused any problems with my OpenVPN based service. So sad that the corporate guys' software isn't working as well.
Been using IPsec VPNs without any problem (Score:2)
ExpressVPN broken too. (Score:2)
Post-iOS9 install I noticed ExpressVPN doesn't work at all either. At least I only need it for youtube/gmail ish, poor business-users, f'd. This is a pretty serious bug, quite shocked that it was known and let pass into retail release......indicator of slip in quality perhaps? Kinda like macbook 12" forcing users to a single usb-c port, in other words, forcing users into buying an adapter, far before C becomes standard? What's going on here.
iOS9 phones cant use itunes 11.5.5 or WinXP (Score:1)