Ancient Flaws May Leave Mac OS X Vulnerable 388
mdeb writes "ZDNet Australia is running a story that claims Mac OS X 'contains unpatched security flaws of a type that were fixed on alternative operating systems more than a decade ago.' As an example, in August of last year, Apple patched the 'dsidentity' bug, which could easily have been exploited to grant a non-privileged user with admin rights the capability to create and remove 'root' user accounts."
Stop the Presses (Score:3, Funny)
Re:Stop the Presses (Score:5, Funny)
It protects you from everything up to the Triassic period. After that, you're on your own. These were ancient flaws, vulerable to ancient threats. Don't boot up in a museum of natural history or you're toast.
Well, yes! (Score:3, Funny)
You see, you hold a crucifix straight up and down for Vampires; cock it 45 degrees so it sort of looks like the Apple logo, and you'll keep Gates away! But, there's a problem with Balmer, you also need the Firefox logo to ward him off. Sometimes, you need Nerdy, the MS Slayer. She's, yes, it's a woman, the chosen one. I can't say anymore now.
Re:Stop the Presses (Score:4, Insightful)
"Name one exploit in the wild for the Mac."
I don't have to name one today, it's the unnamed one that's going to hit you in the next day/week/month/year that you don't know about that is the problem. Even Windows users have no idea what unrealized exploits are waiting to be discovered in thier systems. But they are smart enough not to deny that there are any.
Re:Stop the Presses (Score:5, Informative)
On Jan 10 (2006), Apple, after having 2 and 3 months respectively to fix them, finally released a patch (7.0.4) that closed major holes in QuickTime, that allows
However as with many Apple patches and updates, it hadn't been properly tested, resulting in the forums being flooded with complaints about lost functionality (DVDs stopped playing and such). Apple quickly withdrew the patch, with little notice - as if the patch never existed.
Of course eEye, the security firm that had reported the vulnerabilities to Apple months before, had now already posted rather detailed [eeye.com] advisories which included precise exploit details.
So ask yourself: Are you a Mac user (and thus have QuickTime because it's an integrated part of the OS used for OS 9 legacy emulation [long story]) or a Windows user that has installed Apple QuickTime by choice? Have you checked for patches for QuickTime in the last 2 weeks, or seen any kind of public advisory, like you normally do when Microsoft or just about any other large software maker releases a patch? If you answered yes to number one, but no to number two, congratulations. You a giant target for a zero-day exploit thanks to Apple and the Jobs reality distortion field.
Re:Stop the Presses (Score:4, Insightful)
Should these flaws be there? No, I might well want to share my Mac (especially in an academic setting) and a user gaining control over the root account IS a problem. So these things should be fixed. But I don't think this is quite the huge deal the article is trying to present it as.
Should Mac users been more security aware? Perhaps, keeping your Mac up to date with patches, thinking before installing things (do I trust this?) are to be advised no matter what platform you're using (Windows, Linux or Mac OS X). Anti-Virus is worthwhile so that Mac doesn't become a hiding place for infections (that could affect other platforms reading those files) and will provide the mechanism for protection if/when a Mac OS X virus is released. Clamav seems like a reasonable choice right now.
Re:Stop the Presses (Score:3, Interesting)
You can disallow access to the shell (via "terminal.app") for "normal" users (Mac OS X won't allow root login by default anyway) but that's an "extra step" so most users won't do it (fair enough).
Yes it does see ironic that this guy wanted to create a news story rather than submit "fixes" to the Darwin project
Steve Gibson... (Score:5, Funny)
Re:Steve Gibson... (Score:5, Informative)
I wouldn't hold your breath on that one, he doesn't deal with Macs at all. I know, I asked.
Well, it was one of his employees, anyway. I was wondering how the built-in OS X firewall compared to other available products and asked why GRC didn't do any OS X stuff. Here's the reply:
Also, since Gibson Research only produces software for the
IBM-compatible personal computing platform, we are sometimes asked
why we don't write software for the Mac. The answer is:
(1) We don't know anything about the Mac. We're a small PC software
development shop and we've become leading experts with the PC. But
the PC and the Mac are SO DIFFERENT that knowing one tells us nothing
about the other.
(2) Being small, we must be careful to expend our resources where
they will yield the greatest return. With more then 90% of the
personal computer market dominated by IBM-compatible machines running
MS-DOS underneath the Microsoft Windows graphical operating
environment, that's where we much focus our efforts.
(3) Steve is an insane perfectionist who insists upon authoring all
of our software in assembly language. Assembly language is tied
directly to the processor chip in the computer, thus none of our
software CAN be moved from the PC to the Mac. It's completely tied
to the Intel processor platform. But because of reasons (1) and (2)
above, we're doing just fine, and Steve's slavish devotion to the
highest performance, tight and lean code helps make our products even
more unique and attractive to PC users.
This may not be related very well to your remark (yes, I recognized the jab at GRC) and overall OT but I thought the Slashdot crowd might find it somewhat interesting.
Re:Steve Gibson... (Score:3, Insightful)
If there's a special pit in hell for evil programmers, then it will probably involve writing GUI code in assembler.
If that's even partially true, then this guy is a jackass. Assembler? That's great (maybe, assuming he can out-optimize a good compiler), but for which chip? Does he have to re-write "all of our software" every time AMD or Intel release a new CPU, or does he just let his customers run the
Re:Steve Gibson... (Score:5, Funny)
Your only protection against this is Steve Gibson's patented new "Snake Oil!" technology which uses a combination of Stealth PicoWankoProbulators and Network Monkeyspanks to defeat all known "Socket" based attacks. Why Apple chose to include such dangerous technology in every release of OS X is a mystery, but only by paying Steve Gibson a large amount of money can you ever hope to protect yourself against it.
Re:Steve Gibson... (Score:2)
Re:Steve Gibson... (Score:2)
That most of them have a back garden?
I thought OS X... (Score:5, Insightful)
You really should try... (Score:5, Informative)
Of course, you might have actually read that part and part of your subconscious dismissed it as false. Reminds me of this post [slashdot.org] from yesterday.
Uh huh... (Score:5, Insightful)
Re:Uh huh... (Score:2)
It wasn't too long ago that we derided microsoft for calling virtually *every* security vulnerability "theoretical". I find it interesting that Apple apologists are so quick to resort to the same microsoftian tactics.
Perhaps the difference... (Score:3, Insightful)
So, yes, the real world has proven that same type of potential exploit in the two platforms can legitimately be viewed as a serious problem in Windows (because damage can and does occur) but theoretical in Mac OS (because damage has not occurred).
Re:Perhaps the difference... (Score:2)
Re:Perhaps the difference... (Score:3, Informative)
Here's the deal:
This is the 'architecture' argument used so often here. For any attack to result from a vulnerability, there must usually be complementary bugs in authentication and access, and the user must explicitly enable the services that are vu
Yeah, okay... (Score:5, Funny)
Only in the Southern Hemisphere. Up here, trolls rotate counterclockwise.
Huh??? (Score:2, Informative)
Duh. any user with admin rights can create and remove user accounts.
What's more diabolical is that you can do this without entering the admin password. That's not a bug either but maybe an unwise choice. (sorry but I ain't saying how till they patch it.)
Re:Huh??? (Score:5, Informative)
Re:Huh??? (Score:2)
Re:Huh??? (Score:4, Funny)
Re:Huh??? (Score:2, Informative)
char *envStr = nil; //dum dee dum dum!
envStr = getenv("USER");
if ( (envStr != nil) && UserIsMemberOfGroup( inDSRef, inDSNodeRef, envStr, "admin" ) )
{
return true;
}
Re:Huh??? (Score:2)
Re:Huh??? (Score:2)
The dsidentity vulnerability [suresec.org] mentioned in the article suggests that dsidentity uses the "USER" environmental variable to determine whether or not the current user is a member of the admin group. So, presumably, a non-admin user could set the USER variable to the name of someone who is an admin and then dsidentity would allow the non-admin to add/remove user accounts.
I'm not a Mac expert, so
How eas
Thank Goodness! (Score:3, Funny)
OSX is a security nightmare (Score:5, Funny)
Re:OSX is a security nightmare (Score:2, Funny)
Re:OSX is a security nightmare (Score:5, Funny)
Self-serving press release story (Score:5, Insightful)
Re:Self-serving press release story (Score:2, Interesting)
That Apple should use more software auditing tools to scan for errors?
Hmm... went to the web page and I don't see any 'tools', just auditing/consulting services.
Anyways, would it be a bad thing if Apple used more automated toosl to check for problems?
Re:Self-serving press release story (Score:2)
Re:Self-serving press release story (Score:5, Funny)
Yeah, good point.
Hehe...
The "only" reason Max OS is safe? (Score:5, Insightful)
The author shows his true colors in the following statement:
Anytime someone claims that the only reason A is safer than B is that B is used more often, alarm bells should go off. It's never the only reason.
We went through the same thing with Linux vs. Windows, Firefox vs. IE, I've seen people make the claim about Opera vs. Firefox, it was said about Mac vs. Windows long before OSX, etc.
If you think about it, the popularity-as-sole-reason argument boils down to claiming that security by obscurity is enough.
Re:The "only" reason Max OS is safe? (Score:5, Insightful)
There's a difference. Firefox and Linux and Apache were fairly secure from the very start so as they increased in marketshare the viruses and attacks and exploits didn't increase significantly. However IE and Windows and IIS were fairly insecure from the very start but even so they weren't exploited very much until they had reached a fairly large marketshare. You were pretty safe surfing the web with IE3 and even to a lesser extent IE4 (at least initially) despite being insecure pieces of crud.
Now what I find most amusing about these "OS X is insecure" stories are the people with their heads in the sand saying "it's not true". They point to the lack of exploits and lack of viruses as proof but that's not proof that OS X doesn't have security holes, just that so far as we know they haven't been exploited yet. Take for example the dsidentity bug which IIRC was a setuid binary with this code...
I kid you not. That's the quality of code in OS X. Now any seasoned security veteran at this point would be rolling around on the floor laughing. Apparently that's what the OS X developers did when they were informed of this bug. Because remember that OS X is not a brand-new rewritten-from-the-ground-up OS; it has an extremely long history dating back to the 80s. It began as AT&T UNIX, warped into BSD by students (*shudder*), was partially rewritten to avoid AT&T lawsuits, was further mangled by NeXt!1!1one!, then got a code infusion from FreeBSD, and has been further hacked by Apple since it's "birth" in 2000. There's code in there that is possibly older than you are. I was at a security conference recently where one of the presenters ran through a dozen bone-headed security mistakes in Tiger including kernel overflows of all things. The entire audience was laughing themselves silly.
Now don't get me wrong. OS X is still significantly better than Windows. They've done a lot of very sensible things such as not running with admin privileges, decent (not perfect) permissions, services disabled by default, built-in personal firewall, etc. Those are all good. But it's not enough. How the hell did getenv("USER") slip into a setuid binary? Why is there a kernel overflow; can't Apple afford one copy of Rational? Where is the virus scanner; even if all it looks for are UNIX-common attacks like the known Apache and Samba exploits. You guys are too complacent. OS X is not all that secure; impoverished marketshare and the subsequent lack of attention from criminals is hiding this truth from you.
So given that OS X is insecure and does have exploitable code it's only the fact that nobody has seriously attacked it yet that gives it this aura of impenetrability. I fully agree with the statement made by the security professional in the article. If OS X was better written then I would disagree with the security professional's opinion but my own experience and knowledge says that he is right and you are wrong.
Re:The "only" reason Max OS is safe? (Score:3, Informative)
The funny thing about students is that they think they're brilliant at coding but that's just the arrogance of youth. Even the ones who "enjoy coding" are medicore at best and can produce some of the most wretc
Ancient? (Score:5, Funny)
Re:Ancient? (Score:5, Funny)
Rosetta will remedy all that.
Windows. The new alternative. (Score:5, Funny)
That's the first time I've heard operating systems other than OSX described as "alternative".
--Rob
Sour grapes (Score:3, Insightful)
Also, from TFA:
"In my experience -- which is also the experience of some of my peers -- Apple has been very slow to respond to reported security vulnerabilities. It expects security researchers to wait indefinitely to release the vulnerabilities and offers no incentive for them to do so," said Archibald.
So he's trying to make a living on discovering security holes and getting paid not to make them public? I'm okay with this practice, I suppose, but I get the feeling that he's trying to up the ante by generating some bad press for Apple. The whole things seems awful contrived.
Re:Sour grapes (Score:2)
There is no such thing as "bad press" when it concerns notifying the public of various vulnerabilities and the relative latency involved in getting them patched. At least if it were Linux, kernel developers would immediately rise up to the challenge, resulting in a code a
Re:Sour grapes (Score:2)
No, he's right, personal experience (Score:5, Interesting)
It was an extremely serious vulnerability because it was so easy to exploit and Apple really dragged their feet on that, and on other similar cases.
The guy is spot on with that comment. Apple is really slow in responding to possible exploits.
Requires User to Authenticat (Score:5, Funny)
Re:Requires User to Authenticat (Score:5, Funny)
Also known as the number of days you'll be spending as a virgin.
Re:Requires User to Authenticat (Score:4, Funny)
Re:Requires User to Authenticat (Score:2)
Re:Requires User to Authenticat (Score:3, Funny)
Re:Requires User to Authenticat (Score:2)
Save me Jeebus! (Score:5, Insightful)
I think the article makes a good point and one that Apple needs to address. I've long had the impression that Apple does not do enough security auditing, especially of some of their inherited code and that some of their new software has not been as security minded as it could be. I've not heard any of the grumbling the author has about security researchers being treated poorly or response times being particularly slow, but he may be closer to such things than I.
That said, from the article it is unclear if any of the discovered bugs are remotely exploitable. The one concrete example given is just a local privilege escalation, which is not really all that serious. I do wish that Apple would pay more attention to security and I hope they have a team of elite hackers with their ears on IRC and their hours spent trying to hack boxes. I'm not sure that they do though. My suspicion is a lot of the security comes from the fact that many of the employees are old school UNIX guys that take it more seriously than management. This is, however, unlikely to really bite Apple given the giant target that is Windows where local privilege escalations like the one described here are so common no one reports on them and I don't think MS even bothers to fix them.
Re:Save me Jeebus! (Score:3, Informative)
This one sentence makes clear your lack of experience. A "local" priv escalation makes ANY remote hole r00t explotable. It's serious, maybe more than most "remote" exploits!
As somebody who's spent days (hopefully) digging rootkits out of hacked systems, I can assure you that while remote holes are important, local priv exp holes are every bit as serious.
For example, a system I admin was exploited by a
Re:Article is unclear to me too... (Score:2)
If that's the case, then what's the problem? If you have that kind of console access, any system can be cracked in short order. Even that means putting in a new boot cd, power cycling, and running vi
Classic FUD- mark story troll (Score:2, Funny)
Are there probably exploits possible. Yes of course. But Apple's security record has been very very good.
This is absolute hogwash.
Spywear? (Score:3, Funny)
Re:Spywear? (Score:2)
Re:Classic FUD- mark story troll (Score:2)
Re:Classic FUD- mark story troll (Score:2, Insightful)
Just because someone says something you don't like does not make it hogwash.
I'm switching! (Score:5, Funny)
There are bigger problems with OSX (Score:5, Informative)
http://www.scarydevil.com/~peter/io/osx-security.
http://www.scarydevil.com/~peter/io/apple.html [scarydevil.com]
http://www.scarydevil.com/~peter/io/apple2.html [scarydevil.com]
Thankfully even these are not as easily exploited as Microsoft's poisoned gumbo of IE, Outlook, ActiveX, and Security Zones... but Apple really needs to take a good look at the way they approach the Internet, and quit being so trusting.
On those "too smug" Mac users (Score:3, Insightful)
Author is right, and wrong (Score:5, Insightful)
He's right that Apple is very secretive and sometime extremely slow to address security vulnerabilities. He's wrong that Apple not speaking to him means it isn't interested. Apple just learnt the lesson early that being too open to the press (on any topic) is make yourself a victim of their fickle moods.
He's right that there might be large holes in Apple's OS from earlier NeXT days, but he's sure as fuck wrong when he says it applies to both PPC and Intel architectures. Any crack that relies on memory in the stack being overwritten will not be cross platform.
He's right that there are open vulnerabilities. He's wrong and simply trolling (probably for profit, the fucker) when he doesn't mention that none of them are remote.
Re:Author is right, and wrong (Score:5, Insightful)
The exploit won't be cross platform, but the vulnerability sure can be.
Re:Author is right, and wrong (Score:3, Interesting)
actually with proper coding a Universal binary, the exploit could be cross platform.
although, it would be a pain in the ass to create a script to generate the proper NOP sled and shellcode that would work on both architectures.
Since it appears that the vulnerabilities he's describing require user intervention, I guess a universal binary could be used. hmmmm....
it would be interesting if Rosetta had vulnerabilities where it would allow pr
Not surprising (Score:2)
Ancient Flaws (Score:5, Funny)
Guess my definition of Ancient isn't the same as the posters.
Re:Ancient Flaws (Score:2, Funny)
No kidding. And I also thought that flaws were those things they stand on in Boston.
Re:Ancient Flaws (Score:2)
They did!
Don't you remember the beginning of The 5th Element? [dvdaust.com]
Most irritating part of this article (Score:4, Informative)
So like, I was writing a paper on my Mac... (Score:5, Funny)
They were really good accounts too. And then I had to recreate them and I had to do it fast, and they weren't as good...
I refuse to read the article. (Score:2)
a prediction. (Score:2, Interesting)
An observation I made in a post a few months ago was that since 2001 Apple has released 5 different releases of OSX, 4 of witch were paid upgrades (approx. $600 if you were staying current all along). They have patched literally thousands of bugs and security holes and continue to do so at a pretty steady rate. We don't hear about it, (In my opini
Re:a prediction. (Score:4, Informative)
I'm currently running Panther (and Jaguar on one Mac), and I'm skipping Tiger unless something comes up that requires Tiger that I actually care about. I got Jaguar, used, for $50, and Panther came on my Mac minis, so I'm good until Leopard comes along.
It wasn't until Firefox hit around 10% we started to see hackers paying attention and start exploiting the MS alternative product.
And when precisely did this happen. When "hackers" exploited Firefox, I mean. Real, live, in-the-wild you-better-watch-out exploits?
Apple's always been a minor player, and back in the '80s and early '90s they had a corresponding share of exploits in the classic no-security Windows-like Mac OS. Being 5% back then didn't keep them from being exploited, being easily exploitable made them exploited.
They have patched literally thousands of bugs and security holes and continue to do so at a pretty steady rate. We don't hear about it
If we didn't hear about it, how do you know about it? Do you have GOLD JULY BOOJUM clearance?
Uhh... what? (Score:4, Interesting)
Why... how awful. Or the user could have gone to the command line and typed 'sudo foo' and run anything as root that he wanted, including creating and deleting users or whatever else he wants to do, if he has admin rights.
You could at least have chosen an example that wasn't totally useless on 99.9% of Macs. (Those which allow admins to sudo. Most people aren't dumb enough to explicitly grant admin privs to people they don't want to run as root, either because they know they know what it means and choose not to or because they don't and they don't just randomly check every check-box that comes along.)
-fred
Top ten reasons why OS X has no viruses yet (Score:5, Funny)
10) Ten million+ active boxes still "too small a number" to target.
9) Worlds virus writers all work at Valve; have no idea what the hell OS X is.
8) OS X originally scheduled to have virus this year; pushed back till Q2 next year to add Intel support and a Universal Binary.
7) Russian Mafia all actually use Macs, tell underlings to keep macs virus free so they don't have to run virus scanners.
6) Forget buffer overflows; real mechanism viruses use to spread is actually second mouse button.
5) No viruses released for sale on ITMS yet.
4) Actually viruses everywhere but Jobs Reality Distorition Field keeps Mac users thinking they are not there.
3) XCode secretly detects and transforms viruses into RSS readers instead at compile time; explains glut on Macs.
2) Virus writers accientally drug virus into one of several hundred "Untitled Folders" on Desktop, now have no idea where it is.
1) Mac owners just too damn pretty for God to let them get viruses.
Are "security experts" extortionists? (Score:2)
Why do "security experts" like this come across like blackmailers and extortionists? Maybe it's the language he chose to use... It almost appears like he thinks that software manufacturers should pay up whenever there is
Has OS X Mach strayed too far from the tree? (Score:4, Interesting)
Re:Has OS X Mach strayed too far from the tree? (Score:3, Informative)
Munir Kotadia's history... (Score:3, Interesting)
I'll grab some examples later, but it's no coincidence that this story is almost pure speculation.
Admin rights not required, summary wrong as usual. (Score:3, Informative)
Re:Inconceivable! (Score:3, Funny)
Re:Inconceivable! (Score:3, Funny)
"You keep using that word. I do not think it means what you think it means."
I ain't got a fucking clue what you guys are talking about, but hey! When in Rome.
Re:I don't care, it's a small niche product anyway (Score:4, Funny)
Re:I don't care, it's a small niche product anyway (Score:2)
Re:First maybe? (Score:2)
You want to talk about ancient vulnerabilities affecting people today, look at Windows' WMF. Hell, XP is still having people run in admin accounts in the year 2006.
Re:First maybe? (Score:2, Insightful)
That's a pretty big statement. There are mainframe OS'es used in banks and the like that have not been rebooted in a decade+ - how has it been determined that OS X is that stable?
Secure? People involved in things like OpenBSD and VMS might be surprised to read such a thing. Let alone Wang's XTS-300 STOP ( http://www.radium.ncsc.mil/tpep/epl/epl-by-class. html [ncsc.mil]) or many many other operating systems. But hey, don't let a blanket statement be ruined by little things l
Re:First maybe? (Score:2)
Re:In one minuets... (Score:3, Funny)
Re: (Score:2)
Re:Big f-in deal (Score:5, Interesting)
Re:Big f-in deal (Score:2)
And people here wonder why /. is considered a silly source of information...
Re:Big f-in deal (Score:2)
Re:Old code (Score:3, Insightful)
CmdrTaco! Please add a "-1, Crap joke" moderation option.
Re:BSD Based... (Score:2)
Re:It sounds simpler than I'm sure it is... (Score:2, Insightful)
Plug an unprotected windows machine into most DSL networks, and you might survive 10 minutes before becoming infected(admittedly this was pre-OEM XP SP2). I've had customers plug in their brand new computer, and before they could even start running the OEM recovery disc creation software (always do this before connecting a network, people!) they were infected, and in turn spaming/spreading their infection.
And that is on an "unprotected" system. O
Re:It sounds simpler than I'm sure it is... (Score:2)
Re:It sounds simpler than I'm sure it is... (Score:3, Interesting)
As someone who admins a number of gateways and firewalls in different netblocks, I can assure you that there are a number of nasty codestreams out there... I set up one Default XP box outside a firewall as a demonstration, and within 15 minutes, it had already been compromised and joined to a botnet. After isolating it, wiping the drive and reinstalling the OS, installing a firewall and reconnecting it, the attempts at re-compromise on that IP address we
Re:Whaaaat? (Score:2)
Ok