Worm Claimed For Apple OS X

SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."

worm in apple?

Hey, there's a worm in my apple...

Re:worm in apple?

... which is much better than half a worm!

Re:worm in apple?

when God (Gates) specifically asked you NOT to eat the Apple (Inc), you should have listened :)

Re:worm in apple?

Does that make Jobs the Snake? That does explain why he slithers.

That's not true...

That's impossible!

Re:That's not true...

That's impossible!

It's possible, but:

• It doesn't exist in the wild; this is because of OS X's stunning security features
• This vulnerability was probably placed into the system by Jobs himself. If there were no vulnerabilities in OS X people would realize Jobs was supernatural, so he has to put one in there from time to time.
• This vulnerability is probably the last vulnerability in OS X. Once Apple fixes this there'll be no more
• Way, way more vulnerabilities are found in Windows and Windows products; this is because of OS X's breathtaking security features
• This is probably a bug in BSD or Mach code, or one of the recent Intel chip bugs, or a Microsoft employee infiltrated the Cupertino campus. It's not Apple's fault.
• Microsoft spends its entire R&D budget looking for these elusive Apple holes just as a way of discrediting Apple. If the real number of Microsoft and Linux vulnerabilities were actually disclosed there would be no comparison.
• Apple puts the occasional vulnerability in its system because they know that Microsoft blindly copies anything Apple does. If Apple puts one bug into their system they know Microsoft will put 10 bugs in theirs.
• Microsoft worms spread spambots and steal credit card information, Apple worms are just a misguided attempt of a loyal Apple fan to spread the good vibes and let the community know he cares. With Mac OS X only your unquestioning loyalty is contagious.

Such a breathtaking OS on a rock solid foundation with over 1 million configurations. Say hello to OS X Panda. Starting at $99. Small sentence. Reinvented.

Actually...

The only people I always see spouting such crap are the people who claim to hate Apple fanboys. I've never seen an Apple fanboy make absurd claims like yours. This is like a fucking self-fullfilling prophecy. Every damn article about Apple is run over by stupid Anti-Apple trolls who write hundreds of comments laughing about imaginary Apple fanboys and the imaginary stupid things they say. [crazyapplerumors.com]

Here's an idea: Shut up, and let those who are interested in the article discuss it. Thanks.

*ahem*

As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm.

If by fully testing you mean "auctioning it to the highest bidder" then yea.

temporary work-around

Disable mDNSResponder:

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

Re:temporary work-around

Very good. That might disable the security hole, if what has been disclosed so far is 100% accurate. If not, well, all you lose is Bonjour (useful for discovering iChat and iTunes connections on your local subnet).

also quite useless

IMO the really funny thing is that this joker decided to use a Bonjour vulnerability to work on, when everything I've heard indicates a major reworking of the Bonjour code in Leopard anyway.

Isn't this kinda like working out a vulnerability in AppleTalk a month before they stopped using it?

Re:also quite useless

Many of the major Windows worms and so forth target vulnerabilities which have already been fixed (and the fixes pushed out) months before. Not only will many not upgrade to Leopard, if the OS X userbase is similar to the Windows userbase (I'm not sure if it is, but still), many will simply not click the button to install the updates, and leave themselves vulnerable.

I question the ethics, and my legality

First of all, if he's found a real vulnerability, he reports it. I don't care if it's Apple or Linux or even Windows. "Waiting until I finish it" is a disgusting excuse. Will he sell it to the bad guys? Is this free publicity for some jerk? I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.

Re:I question the ethics, and my legality

Good idea. However, a serious discussion on /. is unlikely.

Re:I question the ethics, and my legality

I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.

I agree. We should also question the ethics of Theo de Raadt. After all, this guy published an exploit for OpenSSH. Who does this guy think he is? Hell, he should have given the problem to the developers of OpenSSH to fix it, not be out there releasing exploits and stuff.

Re:I question the ethics, and my legality

I'm sure you're trying to be sarcastic, but it would DEFINITELY be a good idea to include everyone from your random teenage mom's basement hacker to Theo de Raadt in the discussion. Just because someone has done great things for the community it doesn't mean he's going about addressing exploits in the best way.

Re:I question the ethics, and my legality

Sounds like a great plan. Make it compulsory to report vulnerabilities eh? Maybe even ban the selling of vulnerabilities. Kinda makes you wonder why any third party would bother looking for them.

Re:I question the ethics, and my legality

From my point of view, the original argument never said anything about making vulnerability reporting compulsory, but that concealing a vulnerability is morally reprehensible, and claiming to keep a vulnerability secret until an exploit is finished is a disgusting excuse.

Re:I question the ethics, and my legality

And that's the problem. You want to look at it in simple terms instead of considering the whole issue.

Apple and other software vendors have chosen a development model that maximizes their ability to hide defects in their software. If people are morally obliged to report any of the defects they independently find in the software then the vendor has no incentive to ensure the defects are found before the product hits the market. To put it another way, time to market is much more important to them than making a product free of defects. The only thing that motivates them to ensure their products are defect free is malware. As such, creation of malware actually *helps* to make the vendor take more responsibility for the defects in their product.

 

Re:I question the ethics, and my legality

If what he's doing isn't illegal now, maybe it should be.

Maybe it shouldn't be. There are hundreds of /. threads filled up with complaints about the US government and legal system. Our rights are constantly eroded by attempts to 'legislate morality'. Repeat with me: just because something is unethical or immoral does NOT mean it needs to be illegal. Ethics and morals are nothing more than opinions, and they vary greatly from person to person.

Neglecting to report a vulnerability is not remotely criminal, no matter how much you disagree with his motivation.

Re:I question the ethics, and my legality

Because Congress is well known for its mature and insightful discussion of computer and network security issues.

Tipping the scales?

The fact that the breaking news on slashdot is "someone found the third way to attack a mac machine" is a compelling argument to purchase a mac over a PC. Unless someone can explain to me how this is the seed of an impending snowball of mac-targeted malware.

Re:Tipping the scales?

Yes, exactly. Three proofs of concept vs. thousands, maybe millions, of vulnerabilities in the wild.

The author claims, "While it is nothing special compared to Windows based Malware it does prove a point -- Apple Computers are just as susceptible to Malware as Windows based ones." Oh, bullshit. The fact that this particular security vulnerability exists does not mean that OS X is just as much a wide-open target as Windows is.

In the "Classic" MacOS days, there was a fair amount of Mac malware -- never as much as in the PC world, of course, but plenty of it running around. Since OS X became the standard, this hasn't happened. The "vulnerability through popularity" argument just doesn't hold up to this fact.

Windows affected?

exactly what vulnerability in mDNSResponder is it exploiting? Since mDNSResponder also runs on windows if you install bonjour for Windows, does that mean it can possibly be affected too?

Controversy?

Is there controversy over the fact that someone is making, testing, improving, and preparing a worm that could be used to infect systems, or controversy because Macs can be infected by this worm?

Can this travel via "broader network segment"?

While InfoSec Sellout states that the worm only seeks out other systems on the same network for infection, they point out that it is not going to take much extra work for the worm to attack a much broader network segment.

It's my understanding that the daemon in question works only on the LAN and is part of Bonjour/Rendezvous/Zeroconf/Avahi.... if this is the case, assuming a decent firewall, aren't you only vulnerable within your own local network?

Re:Can this travel via "broader network segment"?

Sure, get infected on the school's lab LAN. Bring your iBook oops MacBook to the coffee shop and get everyone else there. They all go home and infect their room-mate's machines. Who go to a different lab and it gets loose on the LAN there.

Most laptops aren't isolated to a single LAN these days; they move around. If there really is a flaw in mDNSResponder, then such a worm does have a chance to propagate. Especially if it is subtle and doesn't crash or overload machines, or do insane amounts of network I/O, or any of the other things that cause people to think something's wrong.

Okay... let me get this straight...

Serious question here:

Somebody writes a worm for OSX that works across a specific test network (of which we have no clue as to settings, layout, patch levels, etc etc), and it's really, really, really big news. Media orgs around the planet sound the klaxon, and (nearly) everyone gets all hyper-ventilated. Claims of "OSX is just as vulnerable!!!1111!!" will fly off the pages.

Meanwhile, the next near-periodic iteration of MSFT-specific malware in-the-wild will get not so much as a grunt outside of security circles (such as SANS ISC and F-Secure's blog as ferinstances). It will likely subvert 40x as many victims in its first hour, and the media won't say so much as 'boo' about it.

Perspective (at least outside of security and some geek circles)? Never heard of it.

/P

Re:Okay... let me get this straight...

I don't know of a single Mac user or vendor who has ever claimed that OS X is *COMPLETELY* invulnerable to viruses/etc, only that there hasn't been a demonstrable, malicious, in-the-wild true OS X virus released YET, which is true.

Major difference. In fact, every Mac user I know expects a "true" virus or two to show up for OS X sooner or later, but what of it? So the ratio will go from a bazillion to zero to a bazillion to one or two.

Apple has roughly a 2.5% worldwide market share--wake me when they have anywhere close to 2.5% as many viruses as Windows and I'll start being overly concerned.

Re:Okay... let me get this straight...

I don't see any suggestions this be buried, only that it be kept in perspective. (Which, I'll grant, is impossible.)

Is mDNS even routable?

I was under the impression that mDNS was not routable (and specifically designed not to be routed). If that is true, doesn't that restrict this to propagating to computers on the same subnet? This could effect a business, or a computer lab (say at a university), but this fact should prevent it from spreading around the internet at large (as various Windows worms have).

It's a bug, it's a problem, but it's no Blaster by a long shot.

Re:Is mDNS even routable?

Bundle it with a Windows worm. Exploit Macs on the same subnet as Windows boxes. Then the infected Macs scan for vulnerable Windows boxes and spread the infection. Every vector is useful in an attacker's bad of tricks.

Re:Is mDNS even routable?

Multicast packets are routable, if the upstream routers support dealing with multicast packets correctly.

mDNS/bonjour/zeroconf detects if a packet has crossed a router by setting the originating TTL to 255. If a multicast packet crosses a router, the TTL is supposed to be decremented, and zeroconf is supposed to ignore the packet as it is no longer considered local. Many suppositions there, as implementations vary.

Worse, starting with a TTL of 255 means that the packets will be able to go anywhere on the internet where multicast packets can get routed. Better protected carriers will drop multicast packets with TTLs greater than 64 or 128, specifically to limit mDNS/zeroconf traffic while allowing reasonable traffic to flow. Most ISPs don't have the technical competence to deal with multicast, so they just block it, which will limit any spread of an mDNS worm.

However, just because mDNS/zeroconf will ignore packets with TTL less that 255, doesn't mean that a buffer overflow bug isn't being treated by the protocol stack. Take a wait and see attitude on this disclosure, as it appears to be an extortion attempt rather than something from legitimate sources.

the AC

Local network only - depends on mDNS

So, not quite like the Internet-spanning, DDOS-producing Windows worms we've come to know and hate. I'm not too surprised the vulnerability was in MDNSResponder, though. Someone I work with found a few problems in the code when running it on Linux.

Market share?

I havent really looked at the market share percentages of OSes recently, has Apple really grown large enough for Virus makers to start targeting Apple?

Who's paying him?

I'm guessing Matasano Security is paying him for this vulnerability.

They're the ones who challenged Joanna Rutkowska about her bluepill (see the "Hi Joanna" quote on the blog), and have had contact with infosec sellout in the past.

3 known exploits....

200,783 to go...

Root Account Disabled...

Isn't the root account disabled by default on OS X systems? I wonder how the worn handles that... Just curious. I have never **cough cough** enabled the root account on my Macs.... Most likely, it will go after any account with admin rights? Steve

Re:Root Account Disabled...

No, just because you can't log into the account doesn't mean it doesn't exist. Type "sudo sh" and enter your password - presto, you're running a shell as root. Exploit any service running as superuser and you can do the same thing.

Have mDNSresponder run without root privileges

If this is a real concern, there is a workaround to have mDNSResponder run without root privileges. Part of the claim is that they can deliver root payloads - this is likely because mDNSResponder runs as the root user and they might be using a buffer overflow exploit [NOTE: I have not analyzed the mDNSResponder code - this is a guess.]

% sudo launchctl unload /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist
% sudo chown nobody:wheel /usr/sbin/mDNSResponder
% sudo chmod 4750 /usr/sbin/mDNSResponder
% sudo launchctl load /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

If someone wants an explanation of what the above commands accomplish, please read further.
1. launchctl is used to unload and load the mDNSResponder daemon.
2. We change the owner of the mDNSResponder to nobody and ensure that wheel is the group. The group is used to ensure that members of the wheel group may launch mDNSResponder and not other users of the system (with the exception of root and anything else running as nobody.)
3. We change the permissions of the mDNSResponder program to be setuid nobody. This means that mDNSResponder will run as nobody and only be able to affect files owned by that account or by files it may happen to have write privileges against.

BS alarm

Where on earth will those dweebs find 1500 Macs on the same subnet to test this on?

Right.

1500 Test stations?

Apart from the claim by infosec sellout sounding less than adult - he says the payload was "weaponised" - and his claim that Apple will somehow not fix the "root cause" of the vulnerability if he gives it to them now - extortion anyone? mDNSResponder is Open Source - I seriously question how some independent reearcher can have, as he claims, a test base of 1500 systems. A big company with $1million to throw around might have that, or a university, but I seriously doubt he has the place or resources to afford a test base of this size unless he is using a local university or school, and judging by his spelling and grammar, he is either not English native or he is a teenager, or both. That says nothing about the veracity (truth) of his claim but it is somewhat juvenile, the whole thing.

Blog posting strange

This guy seems to be spending more time posting on his blog and reacting to the fireworks rather than getting his bug reporting done. Even if this is a proven malware app, the poster acts more like a script-kiddie and less like a researcher.

Funny name...

Rape.osx?

"Hi, I'm an apple..urrgh"
"unf unf unf"

Well it would be an interesting ad I guess.

as predicted

i got involved in a little bet about where the first major virus or worm will be on mac os x.

mines was on mDNS. $500 in the bank biatches.

Not funny or good

If this is the start of a run of viruses attacking macs, it's not funny or good for pc users. It shows an increasing skill in virus writers that indicates that in the future, every machine (even linux boxes) will need security and anti-virus software. And if the virus writers get good enough, that software won't be much of a comfort

Dear Apple Inc

Seriously, sit down with this guy. Put a suitcase full of large bills on the table, and tell him it's his if he can prove it works. And then, give the guy some incentive to continue to disclose his so-called "root causes". He is CLEARLY a total whore for cash, which means he is easily bought. You have pockets deep enough, you just sold a bojillion iphones, so buy this guy. If he's full of crap, make the fact that you wanted his "root cause" and he couldnt show you it publicly known, then he gets shamed into STFU and stops spreading FUD. If he does show the root cause, then great, put him on retainer and continue to have a fantastic OS. I know jobs likes to do things all secretive and on his own terms, but this is a public perception issue, it needs to be handled in the public eye. Get on the private jet and go see this guy in person, use the RDF to mess with him and get this shit cleared up. Microsoft got into the situation they're in now by ignoring things like this and pulling the secretive garbage, you don't wanna go down that road, otherwise this crap will get out of hand.

I went to his site

And I'm sorry to say the bell curve flattens even more to the left side.

How did this make the front page?

I felt this was worthy of its own post instead of being buried in the comments section. Everyone DIGG this so that the world can see how crazy some of these Apple Fanboys are.

EVERYONE LIKE ME! I AM TEH COOLEST! I AM TEH... BULLSHITTER!

Meh!

qz

From what I know...

mDNSResponder is related to the Bonjour service, or at least the Bonjour for Windows service.

If you have Adobe Version Cue CS3 then the Bonjour for Windows service is automatically installed, as it is used in that particular program and required for some of the functionality.

Is this "undisclosed vulnerability" in the Windows version as well? if so, a lot of production companies that use Version Cue may be in trouble as well.

Wow

3 hypothetical worms in seven years. At this rate, I may have to switch to Linux next century!

This just in

Researchers say that safes are not completely immune to attack. Some off-the-shelf "safes" can be cracked in less than 5 minutes! They advise that a cardboard box is a more cost-effective way to store valuables, as "people will get in anyway".

A Disguised Sales Pitch?

And does this company have security software they want to sell to OSX users? Pardon my skepticism, but for every announcement like this that I read, it seems that someone is riding the coattails with a security solution for the worm or virus or trojan just "discovered".

Covered in shit?

I frequently hear the old chestnut that the only reason Macs aren't infested with malware is their lack of market share. Whether true or not, it's a funny argument, especially if the person using it is defending their choice of Windows.

"I'm not going to use Mac because while it may be clean now, I could get covered in shit at any time!"

"But you're already covered in shit".

"Errr... yes. But I'm sorta used to it..."

10.4.10

10.4.10 isn`t on the affected systems list.

Re:10.4.10

wasn't this patched in may ? http://docs.info.apple.com/article.html?artnum=305 530 [apple.com]

mDNSResponder
CVE-ID: CVE-2007-2386
Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9
A remote attacker may be able to cause a denial of service or arbitrary code execution
Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue.

mDNSResponder is OSS, not?

If it is, this might be patches relatively soon (allthough it might take a while before Apple approves and deploys the fix). It might also mean that more systems could be affected by this vulnerability. I know FreeBSD uses mDNSResponder (the laptop I'm typing this on is actively using it right now).

Anyone knows if this might provide a way to write a FreeBSD worm?

I love...

... worms that have to ask permission to do their thing.

"Are you sure you want to install this virus"?

The first virus for Mac OS X has been discovered

Oh no, not again!

Apple vs. Windows

I'd still pick Mac OS X over ANY version of Windawg.

Worm for OS X

FYI, root is disabled by default on OS X.

Hey, be nice now!

It's not a flaw; it's a feature. Remember, things are a little different in the Apple world ;)

Re:rape.osx is fitting

not to mention misspelled "raep'

It doesn't

Doesn't mean you can't build them. Just means none are released in the wild, true to this date.

Re:Apple Coded

mDNSResponder is open source.

Re:rape.osx is fitting

One down, 140,000 to go until he catches up. Good thing mDNS doesn't work on the open Internet, though.

Re:rape.osx is fitting

This could be a big problem on some university campuses, however. Mine, for example, has a huge flat-topology network that was deployed in the '80s (maybe before) and has been upgraded piecemeal without anyone really knowing how the whole thing fits together anymore. When I plug my laptop in, I get around 10KB/s of background traffic sent to the broadcast address hitting me. Running tcpdump shows that most of this is iTunes DAAP. Does this exploit also run on Windows? Apple bundle MDNSResponder with iTunes on Windows, so if that's where the exploit is then it could also be a problem there. It might also be a problem on other *NIX systems that bundle it, since Apple have released it under an Apache 2.0 license (cue all the 'Apple just takes from Open Source and never gives anything back' trolls).

Re:pfft

The Windows camp has nothing to gloat about as long as I'm getting a hundred spam messages a day from compromised Windows machines.

Re:Apple Coded

Who modded this insightful?

Re:But I don't understand...

What's with the flames? Wow, one LAN virus so far. The fact is that any OS will have flaws, but some are inherently more secure than others. Mac OS and Linux are *designed* more securely that Windows. That's not to say that they can't be broken, but the fact remains that the are more secure. It is pathetic to have to use 3rd party addons to give an OS some semblance of security.

Take ActiveX as one of the main examples: it enables you to do some tricks easily because you can run executable code from a browser, but the security for it sucks (as evidenced by the number of patches/security updates that were always being released for it a few years ago). A proper developer would try to design a system that was first of all secure, and then build the cool features from that solid base, rather than design a system that lets you do whatever you want, then try to tack on security as an afterthought. It's sickening how much MS is getting away with. I'm not saying that you're wrong to bash mac fanboi's (I like Macs, have done since I used them as a kid in the 80s, but most of the fanbois have only been around since the iMac/iPod I guess), but I have no doubt that OSX is more secure than Windows - how could it not be? Maybe a silly attitude since I don't know much about BSD, or what Apple changed to make the OS more user friendly (maybe they added in something equivalent to ActiveX that gives nice fancy features but poor security?), but I find it hard to believe that any recent OS could be worse than the mess that is Windows. And I hope there never will be..

Re:Surprise, sur-bloody-prise

Sigh.

The code for mDNSResponder is open source [apple.com] already (under an Apache 2.0 license).

Enjoy [apple.com].

Closed source software like Sendmail and PHP?

The "Internet Worm" targeted Sendmail. Which has proceeded to become notorious for security holes.

The biggest UNIX webserver security holes are due to PHP.

The biggest problem is not "closed" vs "open" source. It's design. Is the API secure (that is, if the implementation is perfect, would the resulting system be perfectly secure)? Does the API fail "open" or "closed"? Is there a mechanism to request trusted access from *outside* the trusted domain? If so, is that enabled by default?

If the answers are "yes", "closed", "no", and "no" then you may have built a secure system.

Surprise, surprise, there's a lot of open source software that isn't secure by that standard, including the much-lauded Firefox. Now don't get me wrong, the surface area Firefox's XPI and the XPI install mechanism exposes to attack is like the radar signature of a stealth fighter, where Internet Explorer's "insecurity" zones and ActiveX give it the radar signature of a flock of 747s, but it's not necessary for either exposure to exist at all.

Open Source doesn't create secure systems. It's a hell of a mitigating factor, yes, but the real source of long-lasting security holes (and we don't know if this is one or not, because the soi-disant "researcher" responsible isn't being open about the vulnerability he's found) is insecure design and a preference for patching particular attack vectors rather than fixing the insecure design. And that isn't limited to closed source systems.