Posted on 01/03/2007 11:04:31 AM PST by newgeezer
The Month of Apple Bugs project kicked off Monday by posting a zero-day vulnerability in Apple's QuickTime media player. It also posted an exploit that could be used by attackers to compromise, hijack, or infect computers running either Windows or Mac OS X.
The Month of Apple Bugs (MoAB), which will announce a new security vulnerability in Apple's operating system or other Mac OS X software each day in January, is a follow-on to November's "Month of Kernel Bugs" campaign, and is co-hosted by that project's poster, a hacker who goes by the initials "LMH," and a partner, Kevin Finisterre, a researcher who has posted numerous Mac vulnerabilities and analyses on his own site.
The debut vulnerability is in QuickTime 7's parsing of RTSP (RealTime Streaming Protocol); the protocol is used to transmit streaming audio, video, and 3-D animation over the Web. Users duped into clicking on an overlong rtsp:// link could find their PCs or Macs compromised. It also may be possible to automatically trigger an attack simply by enticing users to a malicious Web site.
"Exploitation of this issue is trivial," said LMH in the vulnerability's write-up on the MoAB Web site. The associated exploit code has been tested on Mac OS X running on Intel-based systems, and works against QuickTime 7.1.3, the current version of the player, LMH and Finisterre said.
Other security researchers rang alarms Tuesday. Danish vulnerability tracker Secunia, for example, pegged the bug as "highly critical," the second-from-the-top threat in its five-step score, and Symantec alerted customers of its DeepSight threat network of the vulnerability.
An Apple spokesman declined to confirm the vulnerability, or, if it was legitimate, when the flaw might be fixed. In an e-mail, he said that "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We always welcome feedback on how to improve security on the Mac."
LMH, who didn't immediately reply to several questions sent via e-mail, said on the MoAB site that Apple's Mac OS X operating system was chosen as the target for the month of vulnerabilities because "we like to play with OS X, we enjoy hate e-mail, and it's not as crowded as (random software vendor), yet. Thus, it's really comfortable for research and there's so much to be worked out."
He also said that Apple -- and other vendors whose Mac OS X applications might be the focus of a bug posted during the month's run -- would not be notified in most cases before the information went live, and dismissed that practice. "The point is releasing them without vendor notification. The problem with so-called 'responsible disclosure' is that for some people, it means keeping others on hold for insane amounts of time, even when the fix should be trivial. And the reward (automated responses and euphemism-heavy advisories) doesn't pay off in the end."
LMH, Finisterre, and commercial security vendors recommended that users cripple QuickTime's ability to process rtsp:// links. In Windows, launch QuickTime, select Edit|Preferences|QuickTime Preferences, click the File Types tab, expand Streaming, and clear the box marked "RTSP stream descriptor." In Mac OS X, select System Preferences|QuickTime|Advanced|MIME Settings|Streaming|Streaming Movies and clear the "RTSP stream descriptor" box.
Apple's QuickTime was last in the news during December, when a bug in the player was exploited by fraudsters on MySpace. That vulnerability remains unpatched.
LMH expects to see more QuickTime attacks now that his newest flaw has gone public. He said, "It's a matter of time to see this getting abused in the wild."
Looks fine in the preview. Oh well, he was obviously caught in another lie.
Gold Eagle Out.
"Intellectual Property" is a fiction and the term shouldn't be used. It helps perpetuate the confusion we see these days, where people don't know the difference between patent, copyright and trademark. The big difference here is that copyright doesn't require that the work be non-obvious, just original, so of course any original software can be copyrighted.The sentences qualifying the original sentence limit and explain his position.
Of course, you're the one lying, here's another one of your own quotes showing your disdain for "intellectual property"
I love your twisting and lying. It's so creative. Notice you said I have a disdain for "intellectual property" with the connotation that all of what is referred to as "IP" shouldn't exist. My statement you quoted so out of context:
"Intellectual Property" is a fiction and the term shouldn't be used
Now shall I yet again add the context you conveniently omit?
"Intellectual Property" is a fiction and the term shouldn't be used. It helps perpetuate the confusion we see these days, where people don't know the difference between patent, copyright and trademark. The big difference here is that copyright doesn't require that the work be non-obvious, just original, so of course any original software can be copyrighted."
The actual context is that I don't like the term "intellectual property" because copyright, patent and trademark (what gets lumped under "IP") all operate under vastly different laws. In fact, my post was about a mixup between copyright and patent by someone who used the term "IP."
and I already showed above where you are opposed to software patents
Now you quietly change your story, hoping I won't catch it. Not long ago I was supposedly opposed to all patents. Would you like to retract that lie now?
That's just one example of his disdain for intellectual property, he's been defending leftist whacko Richard Stallman's "copyleft" theories and arguing against software patents for years on here. His new claim he now suddenly supports software patents and doesn't attack copyright protections like DRM are absurd, are you somehow forgetting he has outright admitted to knowingly lying for months in defense of Russian hackers who illegally cracked Apple's OSX operating system? You are actually wanting to go on record and defend him for that, and claim he doesn't have an easily linkable history of disdain for IP and copyright?
Yes. In your attempts to distort the issue, you lied three times, and took a post from me grossly out of context to twist its meaning, which is another bit of dishonest, a lie if you will. 298 documents this.
since you have been insisting it could not have been a criminal offense for months
You still haven't shown any evidence that it could be.
You now claim you support software patents
Did you pull that from the same nether orifice you always talk out of?
"I said Stallman doesn't want patent laws overturned...he's only against software patents...There is no evidence that Stallman is against all patents...I do agree that software patents are harmful...Software patents make software development a minefield..."
That's absolutely true. You claimed that Stallman was against ALL patents. You couldn't back up that claim and continued lying. You later quietly started saying "software patents" instead of honestly retracting your lies.
You also had this to say about Apple OSX on that same thread: "Mac OS X is essentially a highly-polished turd."
As far as the user interface goes, which is the context you again omit, BSD is a turd. OS X puts a high polish on BSD that makes it easy to use.
298 documents your own lies, you were admitting to knowingly perpetrating for months in defense of Russian hackers.
You still haven't shown any evidence that it could be
Yes I have, as well as linked where you said it couldn't be, since you claimed only the hack was being distributed and not OSX itself, which has since been proven to be another one of your lies in defense of Russian hackers.
Did you pull that from the same nether orifice you always talk out of?
What's wrong, you finally figured out accusing me of sex with goats wasn't working, so you make another vile reference instead?
You claimed that Stallman was against ALL patents.
And despite your endless defenses of that whacko leftist, you still haven't disproven.
BSD is a turd.
We know you prefer Linux, the first time we ever met on this site was shortly after you showed up and created a vanity title to a thread claiming "Democrats ahead of Republicans on Open Source" since it showed Kerry and the DNC running Linux and Bush and the Republicans running Microsoft.
Generally speaking, pc people who use only a few reputable programs and don't download, never have virus problems either. The last virus I had on one of my pcs was about 10 years ago, and I got it from some software given to me for work.
Wow...you're a real MAC zealot if you spent all that time researching that and twisting your own logic to make it fit. Sure take bits and pieces all you want to weave your web of deceit.
The WHOLE point of the mac OSX unpatched is because one of the reasons windows gets exploited so much is because users don't update their computers. With a monoopoly in the OS market M$ has more stupid users than any small company. So there are people that run windows without any patches and then they complain when they get a virus (that they most likely installed when someone sent them "wack-a-mole"). If you try to run that same program on the mac the virus won't attach and that's the whole point of security by obscurity that the mac has.
So if tomorrow 100% of the computers were mac osX unpatched out of the box within 1 month I'm certain their would be viruses running in the wild for Mac.
So you cling to "in the wild" as if that proves anything. The fact is a lab exploit CAN be used in the wild but the problem is it would only find 1 Mac user out of every hundred computers (or so).
Wait if it wasn't a real threat why did they fix it? You can't have it both ways.
I agree windows has a horrible history of viruses. But the issue is that Mac is still enjoying the luxury of obscurity and their zealots seem to think that's it's foolproof.
Swordmaker claims he doesn't say it's foolproof however he then proceeds to tout no virus in the wild. So what's the point? He's just too far in Mac's bed to see outside of the bedsheets.
They are claming if you don't agree with their view of the world you are a liar. It's really pathetic as they try to call everyone a liar when so far we have only one admitted liar on this thread.
BTW: When clinton was in office they were going to linux and trying to get away from Microsoft as well. As passionate as he is for linux I bet he votes for the party most likely to use linux.
Can't you read? Do you not understand basic English?
Russell Harding pointed out that there was a possibility that it COULD be done... not that it was being done or had been done... so Apple made it so it couldn't be done.
Was it a threat? Only in the sense that any thing not thought of could be a potential threat in the future. Was it a vulnerability? Yes, if you don't trust the Administrator level users on your own Mac... but then if they have physical access and administrator permissions on your Mac they can do ANYTHING including activate Root if you haven't already locked it out with your own secret password. Was it ever exploited? NO.
It would NOT have been a threat to 99.9999% of Mac users.
More misrepresentations, lies, and ad hominem.
Saying that there are "no viruses in the wild" and saying that it "isn't foolproof" is not mutually exclusive. Both are true.
You're a joke and the sad thing is you don't even know it.
An hole allowing an exploit is BAD! You see when windows does that and patches it before anything is in the wild Windows gets a black eye. But when Mac does it...the answer is the handful of Mac users are protected because apple has fixed a security hole. However, since nothing was released in the wild this doesn't count as a security vulnerability.
Whatever. When you learn how to use logic and reason feel free to resopnd. Until then I'm done (for now).
*is just too funny coming from you.
- antiRepublican begining his attack on my claim that posters should quote Stick with the facts, they always win in the end., as he doesn't believe in honesty or accuracy and has already outright admitted he knowingly and purposefully lied for months in defense of illegal activities of Russian hackers.
- antiRepublican denying he hadn't just tried to claim the same advantages for Linux that Apple users enjoy even though he had just said you don't need as many people to manage Linux, or probably Mac on the post immediately above.
*Are you still bitter over being exposed as a fraud?
- antiRepublican attempting to claim I'm the actual fraud in his reply to my factual post that he had lied, admittedly now on purpose, for months, defending Russian hackers
- antiRepublican with his typical defenses of radical moonbat green party leftist Richard Stallman, "the father of free software" who claims his "ultimate goal is to make proprietary software obsolete.
*They did not distribute OS X, just found a way to put it on a non-Mac PC
- antiRepublican continuing his defense of the illegal copyright infringement conducted by the Russian hackers, again claiming as he had months ago that it couldn't be criminal since only the hack and not OSX itself was distributed, even though other Russians have been criminally charged for only distributing a hack and not the content itself years ago. Here he is again with the same lie from months ago, claiming you actually have to be distributing the copyrighted works themselves in excess of $1,000 value in a 180-day period to be eligible for criminal prosecution under the NET Act. The article didn't say they were distributing OS X itself.
*I didn't defend him, I don't even like him.
Another absurd lie, he was obviously just defending him in a post just above, not to mention it has been going on since he first showed up on this site, including some of his first comments ever made on this site such as where he created a ridiculous vanity title to a thread called Democrats ahead of Republicans on Open Source and proceeded to pimp Stallman and Linux at the DNC and even claiming Maybe Richard Stallman was right that in the future all software will be free. Another one of his first posts on this site was You are right in that I don't like Bush very much., fact is some of us have had this guy pegged from the beginning.
- another perfect example of the near worship status antiRepublican feels for Stallman and hackers/crackers.
*I had lied when I said he opposed them.
This is another one of his absurd lies, he accused me of being in some cult I had never even heard of, nothing surprising just more of his lies trying to smear me and Christians all at the same time. Here is his quote: Maybe he's one of those Phelps Westboro Baptist Church whackos
Obviously while he cannot even make up his own mind LOL he has been making endless excuses for the Russian hackers, even though he has denied was ever defending them here, here, here, here, here, here, here, etc etc, obviously you were the one lying, as expected already being an admitted liar.
This is one of the pathetic excuses has made to defend the lies he has admitted to knowingly and purposefully making that attempted to claim Our military is using open source software written by a Russian hacker to secure its networks. He never even mentioned what supposed tool he was referring to when he began his lies, and his hacker buddy N3WBI3 admitted even he wouldn't have know the origins of the tool either.
Another one of his slimeball excuses for lying for months in defense of the Russian hackers, as opposed to my rightful concern of hackers from Russia or anywhere who are pirating Apple's software.
More of his excuses for the Russian hackers, claiming they weren't contributing to pirating it and again aluding to his lie that it couldn't be criminal if OSX itself wasn't distributed with the hack.
antiRepublican claiming it was quote "fun" to quote "lying on purpose for months." When questioned immedaitely if lying on purpose for months was quote "fun" he responsed quote Yes, it was. So he admits not only that he lies, that it is "fun".
antiRepublican still defending Russian hackers, and still attempting to claim they couldn't possibly be criminal since OSX wasn't distributed, a common lie of his proven wrong later in the thread.
More obvious lies, since he has been defending them all along, going back over months when he first started lying that our DoD extensively used software written by Russian hackers, which he later admitted to being a lie he purposefully and knowingly commited.
*I, Golden Eagle, had sex with a goat,
Pefect proof of the level of scumbag we are dealing with, who makes such ridiculous vulgar claims from his obvious desperation in defending his lies.
Another obvious lie, slipstreaming Windows is perfectly legal, typically to include security patches, while cracking OSX so that it will run on non Apple equipment is obviously illegal if not criminal. These are the lines he continually tries to blur as he continues to lie in support of illegal hacking.
* But none of that applies criminally, since they are never claimed to have distributed OS X.
More lies that the hackers had to distribute OSX before they could be referred to as criminals, when I had already shown that it can in fact be criminal if the hackers don't distribute anything but the crack itself.
Another lie, even he admitted later that criminal penalties were inacted in 1909 or ~100 years ago..
More ridiculous excuses for the Russian hackers, claiming they couldn't have possibly known it was illegal to run OSX on Dell, which of course would be a lie by the mere fact they had to hack the product in the first place.
More defense of illegal hacking, as typical.
More defense of illegal hacking, claiming that Apple's cease and desist letter was quote "BS".
*Microsoft did "lift" BSD code.
Another lie, while antiRepublican has been endlessly defending Russian criminals who cracked IP from a US company, he is quick to accuse US companies of "lifting" code from a freeware project. His defense is that he doesn't agree with the connotation of theft that the word "lifted" carries. How typical, considering his contsant leftist anti-copyright defense of hacker theives.
*Being shown for the fool and fraud you are is really burning you up, isn't it?
Again falsely accusing me of being the fraud, this ridiculous post of his was made in direct response to my documented and proven claim he had for months been falsely claiming Russian hackers wrote software for our DoD which was a lie you admit you knew was a lie when you posted it.
*"Lifting" DOES equate to "stealing"
Here he is trying to backtrack from where he claimed quote I don't agree with the connotation of theft that the word "lifted" carries and for which he had already been busted with references to definitions at dictionary.com.
*How is it a defense to say they're subject to massive civil penalties, just not criminal?
More lies claiming he's not been defending hackers who cracked Apple's OSX operating system, when in fact it obviously goes back for months when he first started making lies he has since admitted to. He might as well be their lawyer, endlessly trying to get the criminal charges dropped, so he can then find some loophole in the civil case. At one point months ago, he even was bringing up the 180-day period to be eligible for criminal prosecution rule ROFLMAO.
Actually of course, this is antiRepublican lying again, trying to claim he has done a 180 in his convictions and is suddenly a proponent of copyright, intellectual property like software patents, protection mechanisms like DRM, when we all know that's a ridiculous lie. LOL at the obviousness of the absurdity.
Here's another example of antiRepublican basically accusing unsuspecting Christians of supporting Westboro on a recent thread again, one of his favorite smear attempts. This guy is a real slimeball, comes to a conservative site and then starts spouting all kinds of leftist BS and falsely accusing folks of being Christian cultists, while pushing his atheism and defending criminals endlessly.
http://www.freerepublic.com/focus/f-news/1762944/posts
*I, Golden Eagle, had sex with a goat, Pefect proof of the level of scumbag we are dealing with, who makes such ridiculous vulgar claims from his obvious desperation in defending his lies.
I asked, you didn't respond, but now I see you still didn't get the point. Maybe that's why you continue taking everything out of context. Go revisit that post and see if you can finally figure it out.
Here's a hint: I know you know how to hilight text, because you had to do it to copy that text.
And another with an endless list of proven ones who won't even own up to them. And another who claims to be neutral, but is in fact shown to be biased.
*Microsoft did "lift" BSD code. Another lie, while antiRepublican has been endlessly defending Russian criminals who cracked IP from a US company, he is quick to accuse US companies of "lifting" code from a freeware project.
You took that out of context, twisting it 180 degrees from its obvious meaning, were called on it by me and another, yet you spew it again. You are sick.
Are you just hoping to catch people who read only that post, but don't look further to find the truth? All anyone has to do is follow those links to find out that you are completely full of it.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.