Posted on 07/08/2002 8:31:27 PM PDT by HAL9000
Apple has been using an automated system to update users' computers on Mac OS X since the software was first released over a year ago. According to the Bug Traq Security list, Mac OS X's implementation of the Software Update is vulnerable to attack.According to the list, HTTP is used with no authentication when running the Software Update application. "Using well known techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to trick a user into installing a malicious program posing as an update from Apple," according to the site.
Apparently an exploit for this vulnerability has been released to the public for what Bug Traq says is "testing purposes." The exploit is being distributed as a Mac OS X package, which includes DNS and ARP spoofing software. the package also includes the cgi scripts, and apache configuration files required to impersonate the Apple Software Update Server.
There was no mention of the Mac OS 9 implementation of Software Update.
An Apple spokesperson contacted this evening about this report said, "Apple takes all security notifications seriously and is actively investigating this report."
There are ways to do this, unfortunately the software is illegal in the United States.
The exploit is being distributed as a Mac OS X package, which includes DNS and ARP spoofing software.
With untrustworthy DNS and ARP, you're essentially clueless about the identity of anyone. DNS maps host names to IP numbers, ARP maps ethernet card IDs to IP numbers. A digital certificate doesn't do any good without a strong means of protecting it.
This is exactly the way that Microsoft does it, ie. with digital authentication.
I never trusted the software update program so I have mine set to manual and never use it. I direct download from Apple. Of course some hacker could spoof the main apple.com but there is a much smaller chance of that happening.
Regardless apple should of used digital authentication from the beginning like Microsoft.
This could reek havoc on a local LAN. Mac world is coming up and like always, every one is going to be checking for updates during the show.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.