Posted on 01/03/2007 11:04:31 AM PST by newgeezer
The Month of Apple Bugs project kicked off Monday by posting a zero-day vulnerability in Apple's QuickTime media player. It also posted an exploit that could be used by attackers to compromise, hijack, or infect computers running either Windows or Mac OS X.
The Month of Apple Bugs (MoAB), which will announce a new security vulnerability in Apple's operating system or other Mac OS X software each day in January, is a follow-on to November's "Month of Kernel Bugs" campaign, and is co-hosted by that project's poster, a hacker who goes by the initials "LMH," and a partner, Kevin Finisterre, a researcher who has posted numerous Mac vulnerabilities and analyses on his own site.
The debut vulnerability is in QuickTime 7's parsing of RTSP (RealTime Streaming Protocol); the protocol is used to transmit streaming audio, video, and 3-D animation over the Web. Users duped into clicking on an overlong rtsp:// link could find their PCs or Macs compromised. It also may be possible to automatically trigger an attack simply by enticing users to a malicious Web site.
"Exploitation of this issue is trivial," said LMH in the vulnerability's write-up on the MoAB Web site. The associated exploit code has been tested on Mac OS X running on Intel-based systems, and works against QuickTime 7.1.3, the current version of the player, LMH and Finisterre said.
Other security researchers rang alarms Tuesday. Danish vulnerability tracker Secunia, for example, pegged the bug as "highly critical," the second-from-the-top threat in its five-step score, and Symantec alerted customers of its DeepSight threat network of the vulnerability.
An Apple spokesman declined to confirm the vulnerability, or, if it was legitimate, when the flaw might be fixed. In an e-mail, he said that "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We always welcome feedback on how to improve security on the Mac."
LMH, who didn't immediately reply to several questions sent via e-mail, said on the MoAB site that Apple's Mac OS X operating system was chosen as the target for the month of vulnerabilities because "we like to play with OS X, we enjoy hate e-mail, and it's not as crowded as (random software vendor), yet. Thus, it's really comfortable for research and there's so much to be worked out."
He also said that Apple -- and other vendors whose Mac OS X applications might be the focus of a bug posted during the month's run -- would not be notified in most cases before the information went live, and dismissed that practice. "The point is releasing them without vendor notification. The problem with so-called 'responsible disclosure' is that for some people, it means keeping others on hold for insane amounts of time, even when the fix should be trivial. And the reward (automated responses and euphemism-heavy advisories) doesn't pay off in the end."
LMH, Finisterre, and commercial security vendors recommended that users cripple QuickTime's ability to process rtsp:// links. In Windows, launch QuickTime, select Edit|Preferences|QuickTime Preferences, click the File Types tab, expand Streaming, and clear the box marked "RTSP stream descriptor." In Mac OS X, select System Preferences|QuickTime|Advanced|MIME Settings|Streaming|Streaming Movies and clear the "RTSP stream descriptor" box.
Apple's QuickTime was last in the news during December, when a bug in the player was exploited by fraudsters on MySpace. That vulnerability remains unpatched.
LMH expects to see more QuickTime attacks now that his newest flaw has gone public. He said, "It's a matter of time to see this getting abused in the wild."
Are you trying to cover that you are the same person?
Or are you trying to say GE and I agree 100%...just read his responses to SM IN THIS THEAD!!! He clearly took issue with a couple items I posted.
Once again..there you go miss information.
I had no idea what he was even talking about, look at the thread, he said in defense of Russian hackers that I shouldn't criticize them, went on lying over and over about some other Russian hacker that supposedly wrote software for DoD networks as if that should excuse the actual Russian hackers. Of course it was all I lie, the guy was actually American, which he later (amazingly) actually admitted to, but of course he accepts no responsibility for it, continues to lie further and even attempt to blame LOL.
As I've been trying to remember that bet...I really can't remember if it was you'd leave if I stated that about IE...so I did. Or if it was also tied to me finding an out of the box MAC exploit. I do remember the oob Mac exploit bet being offerred to either you or Miss Information and either you took the bet and did leave or Miss Information took the bet and lost but chose not to leave. (or possibly one of the handful of Mac lovers on FR took the bet).
I honestly can't remember how it all went down...it was many moons ago. But if you have a link, I'd appreciate the link to clear up any confusion (at least in my mind).
Laughing at his endless lies too hard to even type. All in all it's an incredible web of deceit, but what you might expect from an admittedly Godless man.
Hey that's unfair to godless men everywhere! They aren't as bad as Miss Information.
antiRepublican is what I call him, because that is what he desrves especially after creating that vanity thread "Democrats ahead of Republicans on OSS". I had him pegged from that day on.
I wonder if we can find his DU account? I've done that before to posters on FR that were really just disruptors. They tend to post the same comments on both boards.
Careful you're carrying water for someone who makes his career on Freerepublic doing just that. I had a disagreement over the difference between updates, and patches and was called a liar *and am to this day* over it..
BTW,
Youre also carring water for someone who was suspended for personally attacking my family because I was posting on FR Linux threads..
I'm not defending GE. I'm defending the points made in this thread that happen to by in sync with what he's saying. There's a difference. It appears Shadow, Miss Information, and you take this all to personal. I'm trying to keep it on the facts/opinions. And hoping to avoid the personal attacks, but I do call a spade a spade when it's obvious what it is. Based mainly on what I've seen in this thread Miss Information has confirmed that he allowed a lie to go on for months which can be assumed it provided miss information to many lurkers and Freepers who were just browsing the thread(s). such behavior is appauling. If GE or anyone does similar things I'd be all over it. Especially if they continued to try and defend such behavior. Continued lying as a way to win a point is wrong and should be shunned by all. Setting up a strawman or floating a false point is one thing but carrying on a lie for months is just WRONG! And the fact that those that defend Miss Information won't admit it reveals a lot.
Get the story straight, you and Shadow were creating threads that linked to foreign websites claiming that all Windows 2000 support had ended. When I pointed out it was bunk, you claimed no more "updates" were available, when in fact Microsoft's site defines "updates" to include security patches. So you were obviously wrong, yet you still deny it. The thread you really got cooked on you had the moderator delete, but there's others out there with you still claiming all support had ended.
For example, let's say he created an elaborate lie where he hacked a couple news sites and posted articles about how Mac has a security hole that allows all free control of the Mac without any user intervention. Just to get a new response out of the Mac faithful. Then proceed to use that response when ever security issue with windows came up and the Mac guys say buy a Mac and you won't have any security issues.
You'd be all over that calling him a liar (and you'd be justified to do so).
N3WBi3 has been cooked a few times, but at least he admits it or he leaves the thread without trying to defend his failed position. Miss Information will never admit he's wrong.
But I didn't realize he got a mod to delete a thread to hide his embarassment. What was the issue? I wonder if I posted in that one.
Newver mind I see what the topic was...win2k support ending.
I think I remember that one. But if it was the typical thread where they can't stay on topic. This thread has already left the realm of Mac OS security issues, so it's probably time to let it die.
You're still missing the context. That was after enduring GE's abusive nature and claims of expertise. Is it a bad thing to test abusive (has been banned before), self-proclaimed experts?
Example, If I tell you TCP stands for "Total Control Protocol" you'd quickly correct me because you clearly know the true meaning of TCP.
And such was the level of knowledge that GE intimated that he had. At the time, I gave it about 50/50 that he would call me on it immediately, and I would have congratulated him on a good catch. But he dug his own hole from there.
In battle, do you believe in deceiving the enemy so that he will hang himself with is own blind bravado? It is a debate tactic. Not a nice one for sure, but with his abuse he deserved it. You saw his ad hominem rants and libel against fellow FReepers, and you claim not to want this to be personal?
Yes, I was fed up with his constant paranoia and thread hijacking, but he was constantly ruining threads. Go back to Linux threads during the time of his ban, and notice how civil they were, even notice how people were commenting how civil they were without him. We actually had discussion at those times and polite disagreement, not constant paranoid rants and libel towards anyone who didn't think Linux was evil incarnate.
Go back and read the many negative comments I've made against Richard Stallman. It is clear to any sane person that I do not like him, do not like his overall agenda of ridding the world of most proprietary software, do not like his efforts to control hardware, and especially do not like him having an extreme philosophical approach to software. Then read GE's libel towards me, calling me a devout follower of Stallman and a supporter of his leftist agenda.
Now do you see where this is coming from? Just search for any thread with Linux in the title and watch the abuses GE is known for, the abuses he was banned for. Then you will understand why I did it.
Still not completely buying it. You can always choose to ignore him. Or if it is as bad as you say, get him a perma-ban. But evidently you chose a poor path (lying for months on end). If he took the bait so quickly as you claim you couldn've/should've called him out much sooner and ended the lie.
I bet the truth lies someone in between both of your's and ge's description; however, since you admitted to lying I've got to give him more benefit of the doubt over your description. Seriously if it was Hal9000 saying something I'd have to give it more weight as he's pretty consistent. But you'll go anywhere to prove a point which isn't even related to the topic just so you can avoid being proven wrong. Your credibility with me and probably many on this board is next to zero.
We've tried. It's hard when he injects lies into a Linux conversation, possibly misleading lurkers who don't know the facts. Just putting down his lies is becoming a full time job.
Did you like the Lyons article, where I specifically, concretely listed the "inaccuracies and misrepresentations" in that smear campaign of an article? GE of course rushed to defend him. When caught, he reverted to personal attack as usual. GE lives on smear campaigns against Linux at everybody's expense. The sad thing is, in my defense of Linux, I don't really personally prefer Linux for most situations (which is where I wildly differ from many Linux proponents here).
Did you know we have a GE scorecard? One of the FReepers keeps it. It contains the about seven standards rants you'll see in any GE thread hijacking, and it's usually posted (mostly filled) when GE shows up.
Or if it is as bad as you say, get him a perma-ban.
Admin's choice, not mine. Given the temp ban, they know he's here and what he's doing. Besides, lies are best countered with fact, not by censoring them.
If he took the bait so quickly as you claim you couldn've/should've called him out much sooner and ended the lie.
Probably, but baiting him whenever he came in to hijack a thread was too fun, the payoff building each time. I guess one thing that kept it going for so long is that I would never get a reasoned response to it, just the usual paranoid rant. Any attempt at rational discussion by GE would have taken all the fun out of it, so I surely would have ended it sooner had he been capable of such.
since you admitted to lying I've got to give him more benefit of the doubt over your description
Therein lies a problem -- I admitted. See what you get for doing the right thing? GE doesn't admit, and I've given you the examples showing he prefers instead to engage in libel, ad hominem and misdirection when faced with facts in opposition to his claims.
You seem to credit him for not coming clean. Quite biased and unfair IMHO.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.