Mac OSX Security Ping!
If you want on or off the Mac Ping List, Freepmail me.
Posted on 03/27/2010 11:48:17 AM PDT by for-q-clinton
DESPITE THE RABID CLAIMS of Apple fan boys that its software is more secure than anything else on the market, Jobs' Mob products were the first to be trashed again at a Pwn2Own hacking competition.
In fact flaws in the Iphone OS and zero-day vulnerabilities in Apple's Safari 4 web browser made a mockery of Apple's advertising.
Flaws were also found in Mozilla Firefox and Internet Explorer 8 but apparently hackers had some trouble getting around exploitation mitigations in Windows 7, although eventually they did.
Vincenzo Iozzo and Raif Weinmann were the first to successfully hack a mobile device, exploiting a flaw in the Iphone Safari browser to run SMS messages to a remote web server.
Researcher Charlie Miller, principal security analyst at Independent Security Evaluators, quickly exploited a vulnerability in the desktop version of Safari running on Mac OS X. He won $10,000 for the exploit, which was one of 20 zero-day bugs that Apple fanbois deny exist in OS X.
Miller's exploit opened up a remote shell, which he accessed and was able to run any malicious code he wanted. We guess it just worked!
Miller has said in the past that he is unhappy with Jobs' Mob's secure software development processes. While he will be telling them that the flaw that won the competition for him, he will be sitting on the other 19. Perhaps it will act as an incentive for Apple to get off its lazy arse and develop a security policy with some meaning rather than screwing around with punters while at the same time insisting they are safe.
Miller said discovering the 20 zero-day vulnerabilities took him only three weeks using three computers, so who knows what he would have found if he had kept looking.
Microsoft's Internet Exploder 8 eventually got turned over and Peter Vreugdenhil managed to get past its insecurity mitigation technologies. The flaw can be exploited if a user browses to a malicious website.
Fireferret was also successfully exploited by bypassing ASLR and DEP.
UK-based MWR Infosecurity targeted a memory vulnerability. It started a calculator on a laptop running Windows 7.
The most secure web browser out there was Google's Chrome 4 running on Windows 7.
No one bothered to take down Google's Nexus One, a RIM Blackberry Bold 9700 or a Nokia E72 device running Nokia's Symbian OS.
Must have been that graphic right below your post that had my mind translate NSA to NASA.
He’s smarter than your average 5th grader.
Maybe it's because you have a higher IQ than most of the people at NASA and NSA?
: )
Touche. I was asking for that. But I can’t lie about the facts and I do worth with people from NSA all the time in my line of work.
It’s time for me to take a break. Worth = work.
That is partly true.
In my interaction with them while I worked at cisco, I found them to be very capable people, who thought about security in very non-conventional ways.
They told us, for example, that our first VoIP phone set had a mic and a cradle for the handset that made it a “nearly ideal” whole-room bug with a little tweeking of the code. They weren’t content to simply intercept phone calls - they were able to download their own code to the device and turn it into a very nice bug for a room.
Then they told us that they could tell what code and data was running in a router - a device that is contained within a completely shielded aluminum box (for FCC certification, don’t you know) by remotely “listening” to emissions from the bus.
I’ve not yet seen that sort of sophistication in the “private sector” of hacking.
As someone who quit the tech industry over (in part) the white-wash that is “security,” I’ll offer this observation:
The single biggest impediment to real security are users.
Real security requires constant vigilance and (to use a somewhat ‘extreme’ description of behavior) paranoia. In the online world, yes, there are people who “out to get you.” All the time, every day, on every platform, for all manner of reasons.
When we in the computer hardware/software/networking industries try to impose some “mandated” security, all we get is a ration of crap from users.
I’ll give you an example: automatically enforced password changes. This is so simple to implement, yet yields such a big payback, you’d have to wonder “Why aren’t automatic password changes enforced all over corporate systems?” Well, because the users howl when you force them to change passwords. They come up with all manner of silly reasons why they can’t remember a new password.
Of course, any hacker worth their salt knows that the easiest line of attack on a multi-user system (and on laptops with passwords) is you try the name of the users: spouse, kid, pet dog, mother, father, etc. IN a guess chain of about 5 passwords, you’re into at least a third of accounts.
Let’s take browser security as another example, but switch our focus to development groups: Java was created by Sun’s engineers to be pretty secure. In the original design of Java, they put a LOT of effort into security.
But instead of working with Sun to make Java the standard client-side scripting language in browsers, Netscape created what is today called “JavaScript” (never mind the “Java” part of “JavaScript” - it resembles Java in only superficial ways). Java is a lot more secure than JavaScript.
Look at MS’s stubborn adherence to “active content” - the idea that you can receive a email message or surf to a web page and the message or page can cause things to execute on your computer. This is a security hole so big you can drive a M1 Abrams through it. MSFT has added one slap-dash change on top of other slap-dash changes in this idea - when the most secure thing to do would be eliminate it entirely. MSFT wants to keep their “active content” as a sales feature, and many users now want active content because it means you can have pretty dumb users. Consider the Windows Update script and how powerful it is. You can have your users just surf to the proper URL and the user’s computer is then updated. No training necessary, the scripting does everything. The solution to this would be to require users to bridge the gap between content downloading and execution. People don’t want to do it.
Lastly, let’s talk about programmers/engineers. They’re HARDLY blameless here for their slothful attitude towards security. What is the predominate programming language today? C and its successor, C++.
Having people write large, critical applications in C is like giving kids amped up on Jolt cola a handgun with which to play their shoot-em-up video games.
Having people write large, critical applications with C++ is like giving them a couple of pounds of high quality Peruvian Marching Dust and a squad automatic weapons. The results are predictable.
Could programmers create secure s/w in C/C++? Sure - with a GREAT deal of attention to detail. A faster way of getting programmers to think about security and reliability by enforcement would be to have them start writing software in Ada or a similarly strongly-typed language, or some programming environment that encourages or imposes constraint-based programming. Ah, but having the compiler or environment “enforce” good, consistent tight programming practice gets all manner of belllyaching from programmers - so we don’t do it until it is an application where people will almost certainly die from programming mistakes.
As you said, we can’t achieve a “completely secure system” - but the gap between where we are and a “reasonably secure system” is huge - and largely one of choice that we’d rather be standing on this side of the canyon with those who want to pillage and plunder because it is more convenient.
The last few attempts at placing viruses on my daughter's laptop via the internet came through iTunes.
THEY could make it so that remote takeover of your operating system was impossible.
However, that would mean THEY couldn’t take remote control of your operating system.
That is the quandary.
My good computer was made into a paperweight by Windows updates.
It’s funny you mention that. I swear the chicoms have a mic bug on my lenovo thinkpad. When I put on my headphones I can hear the feedback of the onboard mic through the headphones. My airplane noise cancelling headphones don’t work because the white noise is fed back through the built in mic. And it even does it when I even have the built in mic disabled. I truly do wonder if they have another inline mic set to capture room sound and they can control it if needed.
I know some people will place a cut mic jack in their PCs to prevent any snooping but I think my thinkpad will still capture sound if that is done. If I wanted to waste the money I’d crack it open and do some internal diagnostics. You know that would be a pretty big news story to find out if my lenovo thinkpad had a mic bug in it.
If you want on or off the Mac Ping List, Freepmail me.
Yawn. They are ever so hopeful. Rigged tests usually get the result you’re looking for.
after 28 years of never using any virus software, or being hacked, am I now supposed to worry?
using Macs to run our business, with no IT expenses, since 1982 (this li’l uneducated mom of 4 being to “go-to” girl), is it now time to get “skeered”?
Lifetime Mac user. No virus software ever. The only problem I ever had was a MS Word macro virus. Get back to me when something actually makes it out into the wild on Apple computers and causes the same kind of problems that have been endemic on MS products from day one. I don’t care about any underlying reason.
How was it rigged?
Where are the details on the exploit? Did anything other than Safari get corrupted on the Mac?
What I was wondering.
Re: Anti-virus... Do you have an estimate of how many Macs are currently active on the internet? I know it's over 30,000,000, and probably over 40,000,000; has it hit 50,000,000 yet?
Reason I ask is that sooner or later the number of Macs is going to cross a threshold -- you know, that elusive magic number -- where the virus writers get interested enough to start writing viruses for OS-X, and Macs will have to start running anti-virus software.
Given that a successful botnet only requires perhaps 50,000 machines, and a million machines is considered huge, and virtually NONE of the Mac users have any anti-virus protection, and they're all running with administrative-level privilege, and they're mostly non-technical types who are NOT behind company firewalls, just cheap consumer NATs... I mean, that is such a ripe garden for picking... A thousand botnets worth of totally unprotected machines...
It puzzles me that the virus writers are so blind as to not seize that opportunity. Not one has done so, in many years of OS-X being out there in sufficient numbers. Mind-boggling.
Well, hopefully now that Charlie Miller has shown how trivial it is to crack OS-X (that was the point of the article, I think), I expect to see the new wild viruses rolling out any minute now. A dozen or so successful public in-the-wild self-replicating viruses would go a long way toward strengthening the rather weak "lack of popularity" and "security by obscurity" arguments.
Meanwhile, I now have Win7 on all my Win7 boxes in place of XP, and like it a lot -- use it all day, day after day, no reboots -- very stable. But I discovered that I still need XP for compatibility with some older apps, so I cranked up Win7's "XP Mode", which works really well -- very seamless. But then I realized I had to install antivirus in the XP-Mode guest virtual machine in addition to the antivirus in the Win7 host machine. That's a little frustrating. Two copies of anti-virus on one Windows box, and none on my Mac or Linux or Unix machines.
You know, if I worked for an anti-virus company, I'd post a reward, say $10,000 and a free Mac, to the first virus writer who uses Charlie Miller's (or any other) exploits to create and release a viable self-replicating OS-X virus. Anonymously, of course. Just to stir the pot a little, drum up some business... ya know.
Anyway, if you happen to know the number of active Macs, I'd be interested. If you want you can just FReepmail me a link or something. Thanks!
We’ve said before, any computer can be exploited. The questions are how easy is it to package the exploit for mass effect, and how much damage you can do once you get in. But, alas, we’re still waiting for the in-the-wild viruses and worms taking down any decent number of Macs. They do tend to remain in the lab. Also still waiting for the Mac botnets.
And, no, don’t bring out the failed numbers argument. Successful viruses have been written to specifically target systems with a far lower installed base than OS X’s 30 million, more like in the thousands.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.