Mac OS X Struck By Severe Security Hole

An anonymous reader writes "Macworld is reporting about a new security hole in Mac OS X that can be exploited to compromise a system if the user simply visits a web site with Safari. Currently, no vendor patch is available. Secunia has a demonstration of the vulnerability and suggestions for temporary workarounds."

I guess the H4x0rs

[by Anonymous Coward]

.. finally learned how to "Think Different".

Re:Seriously

[AHumbleOpinion (546848)]

I believe the poster's comments better relate wishing that hackers would act more like ex-criminals developing security systems. Ie, reformed bank robbers providing a service to make banks more secure; they obviously have the skills, they might as well use them for good.

I think your analogy doesn't really support your point and in fact supports the GP. Reformed bank robbers are not really security experts who can design new security systems, I think you your opinion is based more on movies than on reality. Similarly, hackers are romanticized, their skills exaggerated, in movies and in ill informed nerd mythology spread by sites like slashdot.

It really is that hackers outnumber developers and that developers have to be perfect all the time and one of the hackers just needs to get lucky once. Hackers are often more like specialized technicians that are skilled in a narrow range, not a skilled engineer that can design a system from scratch. And then there are the kiddies.

Also works in Mail.app

[daveschroeder (516195)]

You can send this same shell script masquerading as a JPG file and shown as such by Mail.app, and it gets executed as soon as it is clicked/viewed in Mail.app (obviously not affected by Safari's "safe files" setting).

You can test this by downloading this harmless exmaple:

http://www.heise.de/security/dienste/browsercheck/ demos/safari/Heise.jpg.zip [heise.de]

...and sending the resulting JPG to yourself in Mail.app.

This is rooted in something that has been true about Mac OS in general for over 22 years, which is that any file or document - including executables - can have any icon. Other elements of the OS (such as the Get Info window) properly identify it as a Terminal document (shell script), and show that it is opened with Terminal, but most users won't see or understand this.

I'd expect a security update that addresses this *very* soon. This is a bad one.

This IS a bad one

[QuaintRealist (905302)]

For everybody else who says "thank heavens I use Firefox" in these threads, please read parent post. This is a problem held over from when OS used metadata/extensions to figure out what to do with a file, automatically, before we had to worry about the bad guys trying to manipulate this data. These techniques date back to single-user systems, and they are vulnerable.

(Usual disclaimer: I use a unix>windows mix at work, mac at home, and use primarily firefox on all three).

People need to learn techniques to lock down their boxes - different OS are not all equally vulnerable, but are all vulnerable.

Re:This IS a bad one

[shotfeel (235240)]

Yes, its really a bug in LaunchServices, not the browser (any download method is vulnerable). It takes advantage of Apple's split-personality when dealing with files -is file type determined by extension or creator code? This is what can happen when they don't coincide.

Re:Also works in Mail.app

[joetheappleguy (865543)]

Thanks for the test file. I downloaded with Safari, but have "Open Safe Files" turned off it did nothing after download.

I then unzipped the file and had a look at it in the Column view of the Finder, at this stage a normal jpeg would have been previewed, but the Finder had the file listed as "Terminal Application", but I think that most Mac users tend to use List or Icon view though, which would force them to open the file, activating it.

I then emailed myself the file with Mail.app 1.3.11 (In 10.3.9) and after the receiving the email I was warned that "Heise.jpg is an Application and could contain viruses, etc". after I attempted to save the attachment - It also did not preview in the mail message (Obviously)

Seems that this type of vulnerability is most likely to affect mid-level users who are somewhat reckless with their clicking and think they know better than new users who read and "cancel" every message box for fear of breaking their computers or advanced users who realize at a glance that the .jpg does not "feel" right.

Re:Security fix out allready!

[NtroP (649992)]

And seriously, this isn't any bigger than any number of social engineering security vulnerabilities that take advantage of some flaw or shortcoming in any other OS...

As much as I hate it, I'm going to have to disagree with you here. I can add an exploit to my web page that will tell your browser to automatically download a file when the page is viewed - the only user interaction necessary would be to visit my page. If you haven't configured you browser to NOT open "safe" files (the default is to go ahead and open them automatically) then my exploit is triggered - no user interaction, again. I have now infected your system.

Granted, if I try to change firewall settings or affect anything outside of your account's permissions you will be prompted for a password. But I could still delete or corrupt all your files, change your bookmarks, send email to your friends and family with an exploit and try to IM your buddies with it - I just have to choose a well-crafted malware.

I'd say this is a potentially evil hole. I just had my wife and kids change their default settings (I'd always had mine disabled - never thought to change my family's). I think, though that this one will also be quickly and simply patched. And really, the more "benign" wake-up calls Mac users get the better protected they will be and the more difficult it will be for any malware to gain traction.

Re:Security fix out allready!

[daveschroeder (516195)]

From another response I just gave:

Since we've gone through the whole "download safe files" business a year ago, and Apple provided a prompt fix, and, additionally, since this is just Safari's executable-recognition code missing this because the shell script is malformed (i.e., missing the shebang), I expect a fix soon.

I was speaking to the social engineering aspect of this, since the automated aspect of this is so easy to mitigate, has already been addressed in one form a year ago, and I'm assuming will be quickly patched, leaving only the social engineering aspect to deal with. Which, once again, is no more or less serious than any social engineering exploit on any other platform.

Also, in case you hadn't noticed, getting a user to visit a web site is still a social engineering principle. Whether it's double clicking a file or tricking a user to view a web site, it's still "social engineering". What makes this unique is that Safari, in its default state, could potentially download a file and execute a shell script without user interaction. That's a Bad Thing. But since we've already dealt with this a year ago and missing malformed shell scripts was apparently an oversight, I expect this to be fixed soon.

Once fixed (or, in the interim, a single box unchecked) every other aspect of this just becomes tricking the user to click something.

And as we all know, that can happen on any platform.

In other words, this isn't a flaw that is endemic or inherent to any fundamental functionality; by all rights this whole issue was intended to be "fixed" a year ago, but it appears Apple missed malformed shell scripts marked as executable. Oops. So, that will be fixed, and everything else left is social engineering.

This isn't the first time a "view a webpage and something will download that can run without user interaction" exploit has happened on Mac OS X. But I'm sure the press will make a HUGE deal of this one, even though the previous two "viruses" discovered this week are *pure* social engineering, utterly useless, and the vulnerability that one used had even been patched since June 2005 and only affected Mac OS X 10.4.0.

I fully expect this to be the beginning of attacks on Mac OS X as "just as insecure as Windows" in earnest in the mainstream press, and also for people to completely misunderstand and believe it's related to the x86 transition. Yay. :-(

Workaround: Camino

[Ryan Amos (16972)]

I don't use Safari because it doesn't render pages as well as a mozilla based browser, and now I have a reason to gloat :)

Get Camino here [caminobrowser.org]. Camino is an OS X native browser using the gecko rendering engine. Looks better than Safari, is faster than Safari, and apparently is more secure than Safari. Plus the security is more easily tunable.

Most Mac users have heard of it by now, but I'm just giving them another plug because it kicks ass.

Just disable auto-opening files...

[Justin205 (662116)]

The 'workaround' is to just disable auto-opening 'safe' files. I've done this on every Mac I've used, since I started using them, as I always saw it as a potential security risk (and a potential annoyance - I don't want my files opened immediatly sometimes). In my mind, automatically doing almost anything like opening downloaded files without asking is bad.

So just live without automatic file opening for the time being, and you're safe.

Protect yourself in one click

[toupsie (88295)]

Mac OS X users can protect themselves simply by removing the check mark from the "Open safe files after downloading" option in Safari's preferences under the General tab. I have tested this and it works. This is quite a nasty little exploit so I suggest making the change ASAP.

Re:Protect yourself in one click

[hackstraw (262471)]

This is quite a nasty little exploit so I suggest making the change ASAP.

I did this years ago.

Can someone remind me what is the point of a browser allowing "driveby downloads" and automatically launching the content of the download?

Safari has a nice download manager that lists the most recent downloads, and by simply double clicking on the one you trust and want to view is up to you.

This is at least over a 1 year old issue: http://www.net-security.org/vuln.php?id=3461 [net-security.org]

Is it too much to ask for normal users to double click on a file to launch it? This is what we used to do, and still do with email, ftp, removable media, networked drives, everything. What is the point of a driveby download and launch?

Seems to work with any browser

[name_already_taken (540581)]

I just tried the test with Firefox, and it doesn't appear to matter which browser you use. If you open the file after it downloads, the calculator app appears.

The only difference is that the default behavior in Safari is to automatically open downloaded files of certain trusted types.

Who wouldn't try clicking on a movie icon? I would think that most people would.

Mac users: welcome to 2001

[Kohath (38547)]

MS Windows users have had this for 5 years. Congrats to Apple for finally catching up to us.

This is just like a .jpg.exe

[Gopal.V (532678)]

The vulnerability is caused due to an error in the processing of file association meta data (stored in the "__MACOSX" folder) in ZIP archives. This can be exploited to trick users into executing a malicious shell script renamed to a safe file extension stored in a ZIP archive.

Considering that Mac OSes have never believed in file extensions and have always read file meta-data to determine action, this ranks equal with a browser executing .jpg.exe files when you click on the seemingly innocent nude-zeta-jones.jpg.exe [theregister.co.uk]...

disabling the "Open *safe* files after downloading" option in Safari

So the guys in apple who had the __MACOSX part to zip files didn't communicate that to the Safari folks. Communication gaps happen, but this is gross oversight in a company which claims to sell their software for a premium because it is cool (and well-tested UNIX background).

Shell vulnerabilities seem to be the entry point usually, seeing the firefox shell:// that was recently discovered... Integration comes with its own sweet price.

System should be safe

[Fahrvergnuugen (700293)]

Someone correct me if I'm wrong, but this exploit can only affect items that the user has rights to. If a script were written to make changes to the system, OSX should prompt you for your password, right?

Re:System should be safe

[Peganthyrus (713645)]

this exploit can only affect items that the user has rights to

Like ~/Documents/ where you're encouraged to store pretty much everything you make with your machine.
Or ~/Pictures/ where iPhoto keeps everything it loads up.
Or ~/Music/ where iTunes puts all your music.
Or wherever the hell iMovie keeps what you build with it - probably either ~/Movies/ or ~/Documents/
Or wherever the hell GarageBand keeps its work.

Sure, the machine still boots. But if a script does rm -rf ~*.* you're kinda fucked. Why is it that Slashdotters always say 'oh, this exploit just affects userland, no big deal'?

Interesting

[jayhawk88 (160512)]

But I missed the part in the article where this can all be blamed on Microsoft, can someone please help me out?

Yep, this is a genuinely bad bug

[frankie (91710)]

Quick point of order: the bug doesn't execute automatically if you turned off the "Open Safe Downloads" preference. However, it's still really Really REALLY bad.

Explanation: Apple recognizes a particular folder within a zip archive as resource forks. This way you can correctly upload/download old-style apps and/or OSX metadata. The latter feature is where the problem occurs.

If you take a shell script, rename it to a "safe" file extension (such as mov, jpg, etc), then change its metadata (aka the "Open With..." setting) to Terminal.app instead of the expected default application, you now have a shell script that looks like an ordinary media file.

If you then use OSX built-in BOMarchive command, you have a zipped shell script that looks like a "safe" download.

End result: arbitrary shell script execution (under OSX default settings) upon visiting a malicious URL.

Conclusion: remote metadata should not be trusted. This bug would not occur if downloaded files could only belong to their default app.

Why isn't Secunia Being Flamed Here

[Compulawyer (318018)]

Why isn't Secunia being flamed here for releasing details of an exploit before Apple has had a chance to patch it? Are there not enough details for someone to create their own version? I may be wrong, but I did not notice one mention of any fact that indicates that Apple was notified of the problem and/or given an opportunity to fix the problem. I am used to seeing such information releases eing labeled as "irresponsible" but I have not seen any discussion of this aspect of the story yet.

My credit card was "compromised" while using Safar

[bobdotorg (598873)]

My credit card has been repeatedly comprimised while using Safari.

Most recently, a $300 charge appeared on my statement after visiting this page. [apple.com]

Re:Safe default settings

[corvair2k1 (658439)]

I remember quite distinctly the horror I felt when I first got my mac and discovered that it automatically opened safe files... At least around 10.4.2 or so, this was default behavior. And this option has carried on with me to 10.4.5, but is disabled today.

Re:Odd...

[rylin (688457)]

http://aspell.sourceforge.net/ [sourceforge.net]

Re:how bad is it really?

[nkarman (933397)]

No, it does NOT ask for an admin password, however you need to be logged in as a privledged user (administrator) for it to work. A standard user clicking the test link does not execute calculator, an admin user does. All the more reason to not do your everyday work in an administrative account. My test was Safari 2.0.3/OSX 10.4.5. Now if the code tried to do something more system wide through the terminal window it opened, it would probably require a su or sudo authentication. Opening a program or executing some simple code is enough to cause some problems though.

Re:OS X 10.4.5

[krbvroc1 (725200)]

As my long slender finger eagerly depressed the mouse button, I waited with anticipation for the tell tale glow that my computer was performing as I trusted it would. I could hear the sturdy heads of the hard disk chatter as my user data was happily sent to digital heaven. It was not until later that day when I again turned to my computer for comfort that I realize the significance of was had transpired earlier.