Mac OS X Struck By Severe Security Hole

An anonymous reader writes "Macworld is reporting about a new security hole in Mac OS X that can be exploited to compromise a system if the user simply visits a web site with Safari. Currently, no vendor patch is available. Secunia has a demonstration of the vulnerability and suggestions for temporary workarounds."

I guess the H4x0rs

.. finally learned how to "Think Different".

Re:Seriously

I believe the poster's comments better relate wishing that hackers would act more like ex-criminals developing security systems. Ie, reformed bank robbers providing a service to make banks more secure; they obviously have the skills, they might as well use them for good.

I think your analogy doesn't really support your point and in fact supports the GP. Reformed bank robbers are not really security experts who can design new security systems, I think you your opinion is based more on movies than on reality. Similarly, hackers are romanticized, their skills exaggerated, in movies and in ill informed nerd mythology spread by sites like slashdot.

It really is that hackers outnumber developers and that developers have to be perfect all the time and one of the hackers just needs to get lucky once. Hackers are often more like specialized technicians that are skilled in a narrow range, not a skilled engineer that can design a system from scratch. And then there are the kiddies.

False analogy

For the most part, it always requires less skill to break something than to get something working.

Your car analogy would be good if we were talking about computer code -- it takes a lot more skill to write some good code than to mess it up (in textual form). But that's not what we're talking about here.

We're talking about circumvention of security, often known as "breaking" it; but that break (to circumvent protection) is a very conceptually different break than your car example (to render nonfunctional).

Finding exploits like this takes time, intelligence, and often understanding of the software in question. Especially in a well-crafted system, you have to know how the system works in order to circumvent it.

Re:Seriously

People figure this out by looking at corner cases, and prodding stuff to see if it breaks. Most exploits are fairly simple though; we're finally getting away from buffer overflows, but they're easy to find by looking at where programs deal with a string, and seeing what happens if you put a much too large string in. Time consuming, but straight forward.

There are some genuinely skilled crackers out there, but they're fairly few and far between. I maintain a bunch of computers, and most of them deal with a cracking attempt a day. Let me give you a quick log extract:

Feb 21 03:22:56 <hostname> sshd[25243]: Invalid user firebird from <IP removed>
Feb 21 03:22:57 <hostname> sshd[25245]: Invalid user art from <IP removed>
Feb 21 03:22:59 <hostname> sshd[25247]: Invalid user manu from <IP removed>
Feb 21 03:23:00 <hostname> sshd[25249]: Invalid user peru from <IP removed>
Feb 21 03:23:02 <hostname> sshd[25251]: Invalid user contra from <IP removed>
Feb 21 03:23:03 <hostname> sshd[25253]: Invalid user fbi from <IP removed>
Feb 21 03:23:05 <hostname> sshd[25255]: Invalid user melanie from <IP removed>

That's just someone trying random username/password combinations and hoping. Eventually, they'll find somewhere with looser security, and get in, but that doesn't make them skilled, it makes them annoyingly persistant.

Don't get me wrong, this OS X exploit is actually fairly interesting, but most crackers have just enough knowledge to be dangerous, and not enough to use it wisely.

If you want impressive, have you considered the people securing these things? They don't have to find just one security hole, they have to find them all. They have to know every way someone might try breaking the system, and then some...

Also works in Mail.app

You can send this same shell script masquerading as a JPG file and shown as such by Mail.app, and it gets executed as soon as it is clicked/viewed in Mail.app (obviously not affected by Safari's "safe files" setting).

You can test this by downloading this harmless exmaple:

http://www.heise.de/security/dienste/browsercheck/ demos/safari/Heise.jpg.zip [heise.de]

...and sending the resulting JPG to yourself in Mail.app.

This is rooted in something that has been true about Mac OS in general for over 22 years, which is that any file or document - including executables - can have any icon. Other elements of the OS (such as the Get Info window) properly identify it as a Terminal document (shell script), and show that it is opened with Terminal, but most users won't see or understand this.

I'd expect a security update that addresses this *very* soon. This is a bad one.

Re:Security fix out allready!

And seriously, this isn't any bigger than any number of social engineering security vulnerabilities that take advantage of some flaw or shortcoming in any other OS...

As much as I hate it, I'm going to have to disagree with you here. I can add an exploit to my web page that will tell your browser to automatically download a file when the page is viewed - the only user interaction necessary would be to visit my page. If you haven't configured you browser to NOT open "safe" files (the default is to go ahead and open them automatically) then my exploit is triggered - no user interaction, again. I have now infected your system.

Granted, if I try to change firewall settings or affect anything outside of your account's permissions you will be prompted for a password. But I could still delete or corrupt all your files, change your bookmarks, send email to your friends and family with an exploit and try to IM your buddies with it - I just have to choose a well-crafted malware.

I'd say this is a potentially evil hole. I just had my wife and kids change their default settings (I'd always had mine disabled - never thought to change my family's). I think, though that this one will also be quickly and simply patched. And really, the more "benign" wake-up calls Mac users get the better protected they will be and the more difficult it will be for any malware to gain traction.

Re:Security fix out allready!

From another response I just gave:

Since we've gone through the whole "download safe files" business a year ago, and Apple provided a prompt fix, and, additionally, since this is just Safari's executable-recognition code missing this because the shell script is malformed (i.e., missing the shebang), I expect a fix soon.

I was speaking to the social engineering aspect of this, since the automated aspect of this is so easy to mitigate, has already been addressed in one form a year ago, and I'm assuming will be quickly patched, leaving only the social engineering aspect to deal with. Which, once again, is no more or less serious than any social engineering exploit on any other platform.

Also, in case you hadn't noticed, getting a user to visit a web site is still a social engineering principle. Whether it's double clicking a file or tricking a user to view a web site, it's still "social engineering". What makes this unique is that Safari, in its default state, could potentially download a file and execute a shell script without user interaction. That's a Bad Thing. But since we've already dealt with this a year ago and missing malformed shell scripts was apparently an oversight, I expect this to be fixed soon.

Once fixed (or, in the interim, a single box unchecked) every other aspect of this just becomes tricking the user to click something.

And as we all know, that can happen on any platform.

In other words, this isn't a flaw that is endemic or inherent to any fundamental functionality; by all rights this whole issue was intended to be "fixed" a year ago, but it appears Apple missed malformed shell scripts marked as executable. Oops. So, that will be fixed, and everything else left is social engineering.

This isn't the first time a "view a webpage and something will download that can run without user interaction" exploit has happened on Mac OS X. But I'm sure the press will make a HUGE deal of this one, even though the previous two "viruses" discovered this week are *pure* social engineering, utterly useless, and the vulnerability that one used had even been patched since June 2005 and only affected Mac OS X 10.4.0.

I fully expect this to be the beginning of attacks on Mac OS X as "just as insecure as Windows" in earnest in the mainstream press, and also for people to completely misunderstand and believe it's related to the x86 transition. Yay. :-(

Re:Security fix out allready!

Since we've gone through the whole "download safe files" business...

I think the lesson to be learned is that there is no such thing as a "safe" file type. Zip files can be auto-executed, image files can be run through scripting interpreters, malformed images can create buffer overflows in parsers...

We've seen security updates on Windows, Mac and Linux for GIF, PNG, JPEG and TIFF libraries.

Shell scripts are nothing but executable text files.

The solution, I suspect, is to simply not auto-open *anything* that isn't handled by the downloading app itself. Process whatever transfer encoding, but if the file is a disk image, wait for the user to open it. If it's a StuffIt or Zip archive, wait for the user to open it. If it's a video clip, and it's not playing in the browser, wait for the user to open it.

Sure, it removes a little convenience, but in the long run Apple might be better off disabling and then removing this option entirely.

This IS a bad one

For everybody else who says "thank heavens I use Firefox" in these threads, please read parent post. This is a problem held over from when OS used metadata/extensions to figure out what to do with a file, automatically, before we had to worry about the bad guys trying to manipulate this data. These techniques date back to single-user systems, and they are vulnerable.

(Usual disclaimer: I use a unix>windows mix at work, mac at home, and use primarily firefox on all three).

People need to learn techniques to lock down their boxes - different OS are not all equally vulnerable, but are all vulnerable.

Re:This IS a bad one

Yes, its really a bug in LaunchServices, not the browser (any download method is vulnerable). It takes advantage of Apple's split-personality when dealing with files -is file type determined by extension or creator code? This is what can happen when they don't coincide.

Re:This IS a bad one

FWIK, the JPG extension wasn't really necessary. I think that if you had a properly-formatted shell script, that starts with a shebang line, even if you give it a bad filename extension, Safari will still recognize it as "unsafe" and won't execute it.

The problem occurs when you have a shell script without the shebang line, and it's given Type/Creator codes so that it will open in Terminal.app (which will happily execute shell script without a shebang line, in the user's default shell). The name is unimportant; the only purpose it would serve is to make the user more likely to click on it on the web page. Which, as other people have pointed out, isn't really necessary since the file could be set to download automatically by the page. Clicking a link ON the page isn't necessarily required.

Re:Also works in Mail.app

Thanks for the test file. I downloaded with Safari, but have "Open Safe Files" turned off it did nothing after download.

I then unzipped the file and had a look at it in the Column view of the Finder, at this stage a normal jpeg would have been previewed, but the Finder had the file listed as "Terminal Application", but I think that most Mac users tend to use List or Icon view though, which would force them to open the file, activating it.

I then emailed myself the file with Mail.app 1.3.11 (In 10.3.9) and after the receiving the email I was warned that "Heise.jpg is an Application and could contain viruses, etc". after I attempted to save the attachment - It also did not preview in the mail message (Obviously)

Seems that this type of vulnerability is most likely to affect mid-level users who are somewhat reckless with their clicking and think they know better than new users who read and "cancel" every message box for fear of breaking their computers or advanced users who realize at a glance that the .jpg does not "feel" right.

Re:Good news

It's inevitable though that there will be a major OSX infection, so it's time for Mac users to get more conscious of this stuff.

"Pshaw! OS X will seamlessly update my applications wirelessly while I brew and sip my moca-latte, all with real time AJAX and SOAP requests over https with COCA SVG Widget bindings.

Mac users do not suffer from the contagions of the common masses."

Workaround: Camino

I don't use Safari because it doesn't render pages as well as a mozilla based browser, and now I have a reason to gloat :)

Get Camino here [caminobrowser.org]. Camino is an OS X native browser using the gecko rendering engine. Looks better than Safari, is faster than Safari, and apparently is more secure than Safari. Plus the security is more easily tunable.

Most Mac users have heard of it by now, but I'm just giving them another plug because it kicks ass.

Re:Workaround: Camino

Camino is an OS X native browser using the gecko rendering engine. ... faster than Safari

I don't know what the evidence for this claim is, but my (warm app, cold cache) tests on a few sites showed Camino to range from similar to slower than Safari.

and apparently is more secure than Safari.

Read the Secunia article [secunia.com] - this isn't a Safari security hole, it's an underlying platform issue and can be exploited in other ways.
Besides, the Mozilla family browsers have had their share of security holes.

Re:how bad is it really?

No, it does NOT ask for an admin password, however you need to be logged in as a privledged user (administrator) for it to work. A standard user clicking the test link does not execute calculator, an admin user does. All the more reason to not do your everyday work in an administrative account. My test was Safari 2.0.3/OSX 10.4.5. Now if the code tried to do something more system wide through the terminal window it opened, it would probably require a su or sudo authentication. Opening a program or executing some simple code is enough to cause some problems though.

Transcript of recent telephone phone conversation

*RING*

Jobs: Hello?

Gates: BWAHAHAHAHA! PWNED!!!!

Jobs: Goddamnit, Bill, I told you to stop calling!

Just disable auto-opening files...

The 'workaround' is to just disable auto-opening 'safe' files. I've done this on every Mac I've used, since I started using them, as I always saw it as a potential security risk (and a potential annoyance - I don't want my files opened immediatly sometimes). In my mind, automatically doing almost anything like opening downloaded files without asking is bad.

So just live without automatic file opening for the time being, and you're safe.

Re:Just disable auto-opening files...

Safari gets the zip file, and sees it contains a JPG, which is "safe" because JPGs can't spread a virus. It decompresses the ZIp and opens the JPG... which is really a shell script. Normally, even that wouldn't be a problem. But, the script is malformed in just the right way that the OS doesn't catch it as dangerous.

According to Ars Technica [arstechnica.com]:

...if a Safari user has the "Open 'safe' files after downloading" option checked (which enables movies, images, music, text, PDF, and a few other automatic documents to be automatically opened upon completion of a download), a specially designed shell script can be executed. Normally, shell scripts will not be executed after Safari downloads them without user confirmation. However, if the script lacks a "shebang line" (e.g., #!/bin/csh) and the Finder is set to open scripts using Terminal, the Finder will pass the scripts to the Terminal application, where they will be executed.

Protect yourself in one click

Mac OS X users can protect themselves simply by removing the check mark from the "Open safe files after downloading" option in Safari's preferences under the General tab. I have tested this and it works. This is quite a nasty little exploit so I suggest making the change ASAP.

Re:Protect yourself in one click

This is quite a nasty little exploit so I suggest making the change ASAP.

I did this years ago.

Can someone remind me what is the point of a browser allowing "driveby downloads" and automatically launching the content of the download?

Safari has a nice download manager that lists the most recent downloads, and by simply double clicking on the one you trust and want to view is up to you.

This is at least over a 1 year old issue: http://www.net-security.org/vuln.php?id=3461 [net-security.org]

Is it too much to ask for normal users to double click on a file to launch it? This is what we used to do, and still do with email, ftp, removable media, networked drives, everything. What is the point of a driveby download and launch?

Seems to work with any browser

I just tried the test with Firefox, and it doesn't appear to matter which browser you use. If you open the file after it downloads, the calculator app appears.

The only difference is that the default behavior in Safari is to automatically open downloaded files of certain trusted types.

Who wouldn't try clicking on a movie icon? I would think that most people would.

Re:Only affected at user level?

So the vulnerability 'only' allows a cracker to steal or delete the user's personal data. In other words, the most valuable files stored on the computer. Plus accessing things like web browser cache and history could give them passwords or at least information for a phishing attack.

OS X 10.4.5

Went to the proof of concept, followed directions and it did not execute.

I'm running 10.4.5 with Safari 2.0.3. Looks like not everyone is vulnerable.

Re:OS X 10.4.5

As my long slender finger eagerly depressed the mouse button, I waited with anticipation for the tell tale glow that my computer was performing as I trusted it would. I could hear the sturdy heads of the hard disk chatter as my user data was happily sent to digital heaven. It was not until later that day when I again turned to my computer for comfort that I realize the significance of was had transpired earlier.

Mac users: welcome to 2001

MS Windows users have had this for 5 years. Congrats to Apple for finally catching up to us.

This is just like a .jpg.exe

The vulnerability is caused due to an error in the processing of file association meta data (stored in the "__MACOSX" folder) in ZIP archives. This can be exploited to trick users into executing a malicious shell script renamed to a safe file extension stored in a ZIP archive.

Considering that Mac OSes have never believed in file extensions and have always read file meta-data to determine action, this ranks equal with a browser executing .jpg.exe files when you click on the seemingly innocent nude-zeta-jones.jpg.exe [theregister.co.uk]...

disabling the "Open *safe* files after downloading" option in Safari

So the guys in apple who had the __MACOSX part to zip files didn't communicate that to the Safari folks. Communication gaps happen, but this is gross oversight in a company which claims to sell their software for a premium because it is cool (and well-tested UNIX background).

Shell vulnerabilities seem to be the entry point usually, seeing the firefox shell:// that was recently discovered... Integration comes with its own sweet price.

System should be safe

Someone correct me if I'm wrong, but this exploit can only affect items that the user has rights to. If a script were written to make changes to the system, OSX should prompt you for your password, right?

Re:System should be safe

this exploit can only affect items that the user has rights to

Like ~/Documents/ where you're encouraged to store pretty much everything you make with your machine.
Or ~/Pictures/ where iPhoto keeps everything it loads up.
Or ~/Music/ where iTunes puts all your music.
Or wherever the hell iMovie keeps what you build with it - probably either ~/Movies/ or ~/Documents/
Or wherever the hell GarageBand keeps its work.

Sure, the machine still boots. But if a script does rm -rf ~*.* you're kinda fucked. Why is it that Slashdotters always say 'oh, this exploit just affects userland, no big deal'?

Interesting

But I missed the part in the article where this can all be blamed on Microsoft, can someone please help me out?

Two Words:

Filename extensions.

Tried on Windows

I am envious, the exploit doesn't work on my windows box. If I try to run the proof of concept file, it says it's not a movie file. Damn it!

At least there's one way..

...in which Microsoft is taking the lead and Apple is copying them.

Yep, this is a genuinely bad bug

Quick point of order: the bug doesn't execute automatically if you turned off the "Open Safe Downloads" preference. However, it's still really Really REALLY bad.

Explanation: Apple recognizes a particular folder within a zip archive as resource forks. This way you can correctly upload/download old-style apps and/or OSX metadata. The latter feature is where the problem occurs.

If you take a shell script, rename it to a "safe" file extension (such as mov, jpg, etc), then change its metadata (aka the "Open With..." setting) to Terminal.app instead of the expected default application, you now have a shell script that looks like an ordinary media file.

If you then use OSX built-in BOMarchive command, you have a zipped shell script that looks like a "safe" download.

End result: arbitrary shell script execution (under OSX default settings) upon visiting a malicious URL.

Conclusion: remote metadata should not be trusted. This bug would not occur if downloaded files could only belong to their default app.

Why isn't Secunia Being Flamed Here

Why isn't Secunia being flamed here for releasing details of an exploit before Apple has had a chance to patch it? Are there not enough details for someone to create their own version? I may be wrong, but I did not notice one mention of any fact that indicates that Apple was notified of the problem and/or given an opportunity to fix the problem. I am used to seeing such information releases eing labeled as "irresponsible" but I have not seen any discussion of this aspect of the story yet.

Re:Remote meta-data?

'' Goodness me, I'll admit I don't know that much about the workings of OS X but I'm shocked to hear that meta data stored in a file is trusted in this fashion. ''

No, that is no problem at all. The problem is that two applications (Safari and Finder) used different code to decide whether this is a script or not. Safari thought it was a JPEG file. That would have been no problem at all if the Finder had agreed and had asked Photoshop to open that JPEG file. The problem was that the Finder looked at the same file with the same metadata and came to a different conclusion, believing that the same file was a shell script.

My credit card was "compromised" while using Safar

My credit card has been repeatedly comprimised while using Safari.

Most recently, a $300 charge appeared on my statement after visiting this page. [apple.com]

Earth to Apple: THERE ARE NO SAFE FILES!

None of the steps involved in causing this attack to happen should have been implemented in the first place. They're all well-known to be risky, and have all been used in exploits in the past.

"Open Safe Files After Downloading" is inherently risky. No files should be considered safe. The user should always make an explicit request to open any file not handled by the browser itself. Approving an action requested by a potential attacker is not making an explicit request: even if Safari detected the executable and popped up a dialog it would still not be good enough to prevent many people from reflexively approving it.

In addition, automatic execution or interpretation by a general purpose scripting language of any files in an archive, removable media, disk image, or any other potentially untrusted container is inherently risky. Executing code, using applications found in the volume as handlers, or otherwise using them, should be deferred until the user has explicitly requested the code be run, installed, or used.

This should be such a fundamental principle of secure software design that it shouldn't have even occurred to Apple not to follow it.

Just being less insecure than Microsoft is not enough. One might as well laud smallpox as being less deadly than Ebola.

(and... I told you so)

Inaccurate to say "just by visiting" a web site

The problem happens when you choose to download a file from a web site. Just VISITING the site won't do that. Several others here have observed that setting Safari to not open "Safe" files in the main preferences window will solve this in the short term.

The real problem isn't Safari or Mail.app, it's LaunchServices which needs to smarten up Real Soon Now.

Here's some information.

/.'s comments that you can activate this problem by simply visiting a web site is absolute bunk

It's possible for a website to initiate a download.

and have the automatic "safe file open" option turned on

Which is on by default, therefore it can be used to propogate worms.

Files that don't match their extension should be handled.

WRONG! There's three things that MUST be fixed.

Open safe files after downloading SHOULD NOT BE ON BY DEFAULT EVEN IF IT IS AN OPTION.

Zip files and other containers SHOULD NOT BE TREATED AS SAFE FILES EVEN IF IT IS ON.

Unpackers MUST NOT AUTOMATICALLY OPEN ANY FILES IN THE CONTENTS OF A PACKAGE.

Both Apple's unzipper (attacked in this case) and stuffit expander violate this last in different ways.

This is good news

I for one am happy that each security flaw that appears on the OSX platform gets this much attention. I hope it stays that way. Windows users may think they have a reason to gloat, but security flaws and new viruses there are so commonplace that no one even seems to care -- it's just another iteration of a larger problem. As long as we get this kind of uproar over easily-fixed flaws, OSX will always be a more secure platform.

Re:Totally OT Question

Better integration with the keychain and mail, as well as a native appearance. Me, I use Firefox.

There's also Camino if you want something that looks native. It's gecko based, but doesn't have the extendibility.

Re:Odd...

As the bible says.
He who humbles themselves shall be exhulted he who exhults them selves shal be humbled.

This is true in tech as well.
If you feel that your computer is involnerable to hacks you will get hack eventually. This is true for Linux, Solaris, even OpenBSD users. The more secure you say it is the more people will want to find a way to break in. This is espectially true for OS X users because they like to glote on how secure their OS is. But there are a lot of people still feel bitter with the IBM vs. Apple wares (even though the PC won a while ago) and still hate apple with a pation so they will find ways to break in. Never gloat on how secure your system is because it will only end in tears.

But if you figure your system isn't truely safe and take steps to keep it as safe as possible and not make a big toute of how safe it is, then you may have a chanse of keeping it safe.

Re:Odd...

http://aspell.sourceforge.net/ [sourceforge.net]

Re:Safe default settings

I remember quite distinctly the horror I felt when I first got my mac and discovered that it automatically opened safe files... At least around 10.4.2 or so, this was default behavior. And this option has carried on with me to 10.4.5, but is disabled today.

Re:Totally OT Question

It's just another choice you're free to make. I like Safari a lot more than Firefox, because it works the way you would expect a Mac app to work. I haven't tried Camino yet, though.

Re:Odd...

Apologize for what? How much more secure our operating system is than yours? (many apologies if you're running OpenBSD)