Apple Wi-Fi Flaw Disclosure Takes Bizarre Turn

SAN DIEGO, Calif.—The drama surrounding the discovery and disclosure of Wi-Fi driver flaws in Apple products just got a little more bizarre.

First came the Black Hat conference disclosure from SecureWorks researcher David Maynor that the MacBook was vulnerable to a code execution flaw; then came Apples patch that conspicuously nixed SecureWorks from the reporting credits; now a terse one-paragraph statement from SecureWorks has muddied the waters even more.

"SecureWorks and Apple are working together in conjunction with the CERT Coordination Center on any reported security issues. We will not make any additional public statements regarding work under way until both companies agree, along with CERT/CC, that it is appropriate," the Atlanta, Ga. company said.

Apple has made it clear in public statements that its Wi-Fi driver patch was the result of an internal audit, insisting that SecureWorks never provided enough information to reproduce the issue, but the latest SecureWorks statement appears to suggest the two sides have come to some soft of understanding.

But, it gets even more bizarre. SecureWorks Maynor and independent researcher Jon "Johnny Cache" Ellch are on the schedule to "cover the complete story" at the ToorCon conference here, but rumors are flying that SecureWorks has barred Maynor from presenting.

The company did not respond to an eWEEK request for comment. Maynor and Ellch could not be reached.

According to a ToorCon source, Maynor and Ellch are "still on the schedule," although it is likely the Apple issue will not be discussed. There is the possibility that Maynor, who has faced incessant criticism from rabid Mac fans, could disregard his employer and publicly discuss exactly what was shared with Apple.

At the Black Hat conference in 2005, researcher Michael Lynn quit his job on the spot to present information on vulnerabilities in Cisco IOS after his then-employer, Internet Security Systems, cancelled his talk at the last minute.

"Theres a chance David could pull a Michael Lynn," says a ToorCon source. "Who knows?"

It would be another chapter in what is described on security blogs as one of the most bizarre disclosure episodes in recent memory.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.