Post by: gunug on September 19, 2007, 01:05:12 PM
http://uninformed.org/?v=8&a=4
QUOTE
The vulnerability featured in this paper is a flaw in Apple's wireless device driver. This flaw was discovered through ``beacon'' and ``probe response'' fuzzing. Beacons are the packets that wireless access points broadcast several times a second to announce their presence to the world. They are also the packets that your notebook computer uses in order to build a list of nearby access-points. Probe-responses are similar packets that are used when a notebook computer probes for access points that are not otherwise broadcasting.
The bug described in this paper was found by the author while performing fuzzing experiments against other machines. During this time, one of the Macbooks in the vicinity running OS X 10.4.6 crashed unexpectedly. This crash produced a file called panic.log in /Library/Logs. A panic.log file contains information to help debug a kernel panic or crash on OS X. This includes the output of all the registers, a stack trace and the load address of the offending module and the address of its dependent modules. This information provides a great starting place to help track down a driver problem. However, in its default form, there are several shortcomings. The most apparent shortcoming is that the stack trace does not include symbol information. As such, one sees addresses rather than function names. In order to begin to track down a problem, one needs to do some basic math to manually discover the names of the functions. Luckily, the loading offsets did not change much on the test machine when reproducing this issue.
The bug described in this paper was found by the author while performing fuzzing experiments against other machines. During this time, one of the Macbooks in the vicinity running OS X 10.4.6 crashed unexpectedly. This crash produced a file called panic.log in /Library/Logs. A panic.log file contains information to help debug a kernel panic or crash on OS X. This includes the output of all the registers, a stack trace and the load address of the offending module and the address of its dependent modules. This information provides a great starting place to help track down a driver problem. However, in its default form, there are several shortcomings. The most apparent shortcoming is that the stack trace does not include symbol information. As such, one sees addresses rather than function names. In order to begin to track down a problem, one needs to do some basic math to manually discover the names of the functions. Luckily, the loading offsets did not change much on the test machine when reproducing this issue.
I don't know that I'll ever understand all of that and the other stuff in the article but I suspect someone here will know whether it's b.s. or not!
I just saw the whole article was available as a PDF download at this page:
http://uninformed.org/index.cgi?v=8&a=4&t=pdf
Post by: sandbox on September 19, 2007, 01:20:24 PM
http://www.securityfocus.com/archive/1/479861
QUOTE
http://www.uninformed.org/?v=8
About Uninformed:
Uninformed is a non-commercial technical outlet for research in areas
pertaining to security technologies, reverse engineering, and low level
programming. The goal, as the name implies, is to act as a medium for
providing informative information to the uninformed. The research
presented in each edition is simply an example of the evolutionary
thought that affects all academic and professional disciplines.
- The Uninformed Staff
staff [at] uninformed.org
About Uninformed:
Uninformed is a non-commercial technical outlet for research in areas
pertaining to security technologies, reverse engineering, and low level
programming. The goal, as the name implies, is to act as a medium for
providing informative information to the uninformed. The research
presented in each edition is simply an example of the evolutionary
thought that affects all academic and professional disciplines.
- The Uninformed Staff
staff [at] uninformed.org
Post by: gunug on September 19, 2007, 02:02:28 PM
http://www.computerworld.com.au/index.php/...90;fp;4;fpid;16
Apparently he just came off of a Non-Disclosure Agreement about this subject!
Post by: sandbox on September 19, 2007, 05:30:55 PM
QUOTE
Apple patched the bug in September 21 without crediting Maynor for discovering the problem. Instead, Apple's engineers found the bug during an internal audit, the company said.
So why publish the Mac hack now?
Maynor said that he had been under a nondisclosure agreement, which had previously prevented him from publishing details of the hack. The security researcher wouldn't say who his NDA was with, but that agreement is no longer in force, allowing him to talk about the exploit. "I published it now because I can publish it now," he said.
So why publish the Mac hack now?
Maynor said that he had been under a nondisclosure agreement, which had previously prevented him from publishing details of the hack. The security researcher wouldn't say who his NDA was with, but that agreement is no longer in force, allowing him to talk about the exploit. "I published it now because I can publish it now," he said.
This is not something that gives one a lot of confidence. If your not the sort that subscribes to automatic updates or spends a lot of time studying the Mac Media you could in affect be vulnerable without knowing it for a very long time.
A year is far to long to keep this sort of information from the public.
Post by: swhitset on September 19, 2007, 06:09:16 PM
My point is that anybody using a mac or a PC needs to keep it updated and that that is where the responsibility lies. In fact, many times these software vulnerabilities are not even exploited until after the patch has been issued.... that is often how the malware authors find out about them. The bottom line is that on a mac, you should enable software update to, at the very least, notify you of any updates, and on Windows, in the case of most people... have automatic updates turned on.
Steve
Post by: sandbox on September 19, 2007, 11:10:29 PM
Post by: gunug on September 20, 2007, 09:53:47 AM
Post by: sandbox on September 20, 2007, 10:17:42 AM
Post by: swhitset on September 20, 2007, 12:36:35 PM
Let's see... I don't believe I ever said anything about giving Apple any credit for finding anything. Furthermore it seems from the article that the NDA terms have not been disclosed. Most importantly, your ASSUMPTION that it was an NDA with Apple is just that... an Assumption.
As far as the rest of what I wrote... I stand by it. Your focus, in my opinion is too narrow. The world has changed and malware is everywhere. It is no longer possible to simply go about your business ignorant to the many ways one can now get into trouble on the internet. I guess what I am saying is that you may be right.... but who cares. It is not (again in my opinion) the relevant issue.
Steve
Post by: gunug on September 20, 2007, 02:27:56 PM
Post by: swhitset on September 20, 2007, 02:38:40 PM
Steve
Post by: sandbox on September 20, 2007, 02:54:08 PM
QUOTE
This is not something that gives one a lot of confidence.
Steve's opening statement:
QUOTE
I am sorry, but anyone using a computer on the Internet that does not keep it updated is irresponsible. This is just as important for macs as it is for PC's. To suggest that having a specific knowledge of this particular exploit would somehow make a difference is a bit naive.
From this statement I assumed that you were expressing that people who think that this information could've been useful were a bit naïve.
From the article:
QUOTE
Apple patched the bug in September 21 without crediting Maynor for discovering the problem. Instead, Apple's engineers found the bug during an internal audit, the company said.
According to the article Apple engineers did not find the bug. Why would they say they did? Who would pay Maynor for his silence and then give Maynor's work-product to Apple so that they could make it their own?
QUOTE
On Tuesday, Maynor said that at the time of the Black Hat demonstration, he had found similar wireless bugs in a number of wireless cards, including Apple's AirPort and that he had been told to use the third-party card in the video because it was deemed "the least offensive to people."
Whose interest is protected here, certainly not the third parties. My money is on Apple with the NDA. As I suggested to Gunug, there is a slight possibility that this was a backdoor for global security purposes, but a long shot indeed.
QUOTE
I guess what I am saying is that you may be right.... but who cares. It is not (again in my opinion) the relevant issue.
If I were not concerned that this tactic could undermine consumer confidence I wouldn't have bothered to reply. It's relevant to me, my network, my NetBarrier firewalls, our public Wifi system on Treasure Island, and those who think that having information relayed to them in a timely manner is a responsible avenue to take.
I want to know, when my system is threatened by a flaw in the products I purchase. And I want to know that, because, as a responsible consumer I can take the necessary steps to avoid loss.
We all play in different sandboxes.
Post by: Xairbusdriver on September 20, 2007, 03:00:49 PM
If and when Apple gets its testing procedures up to speed, it will be much easier to convince everyone to simply let Software Update not only check for but install what it finds. As things stand now, their inability to verify compatibility has created a fairly large need for places like TS, MacFixIt, etc.
As far as the NDA goes, it is quite conceivable that many other companies are involved besides Apple (the hardware maker, a software security developer). Nor do I think Apples WIFI devices are the only ones that issue these 'broadcasts'. That's assuming I even know what the article is talking about!
OTOH, the way the quote talks about a "panic.log" file appears to me, to indicate a less than complete and thorough understanding of what OS X is capable of and does 24/7. I would assume that any Unix-based OS does the same thing. "Kernal Panics" are supposed to be recorded in the panic log, if possible. 
The fact that they are hard to read (no symbolic translations) is beside the point, those who can read them at least have something to start with. Frankly, they are much more useful than the pre-X messages that "Error -56187" has occurred!
Post by: swhitset on September 20, 2007, 03:02:44 PM
I really don't disagree with you, but I am simply a bit more of a pessimist than you I suppose. I am coming from the mindset that simply assumes these flaws exist, and that more will be found in the future. Since we really have no control over that aspect, the best we can do is keep updated. I do however, think it is best to keep the details of most exploits obscure in order to limit the extent of their exploitation.
Steve
Post by: swhitset on September 20, 2007, 03:08:08 PM
QUOTE(Xairbusdriver @ Sep 20 2007, 03:00 PM) <{POST_SNAPBACK}>
While I agree with your opinions that we should keep our software up-to-date, it is sometimes hard to generate any enthusiasm for doing so when Apple quite often breaks the compatibility of its own software with its OS updates. Many times the only fix to get iTunes/QuickTime/iWeb/etc. working again is to downgrade either the upgraded app or the OS.
I agree with this. I am not suggesting that every update needs to be installed, however, Apple and Microsoft both release "security updates" and these should always be installed regardless of the risk of breaking something.
Steve
Post by: sandbox on September 20, 2007, 05:14:58 PM
I realize that for example an Apple supplier and chip maker "Atheros", could have negotiated the NDA, and that this discovery did effect many computers other than Apple, that fact, not the details was published on the AP a year ago. What makes me queasy is, the full year NDA. I could understand withholding info until the Patch was made and then releasing the why and where-with-all so that we who use third party firewalls could use the info to adjust them, if need be, or not use WiFi if security is a priority. For the past few years I've been more reluctant to download Apple Security Fixes without first examining them and any ill effects. Automatic upgrades got me into trouble and I almost lost my whole drive and data since that last backup.
I set up computers for people who could never navigate around a bad update, Seniors mostly, who were convinced by me that Apple was the best product for their application. I couldn't allow anything automated to demand a technical answer either, like "do you want to upgrade your Firefox browser" twice a month. To allow automation would require me or someone with some basic knowledge of Macs and networks to continuously revisit them to fix their Mac. I do this as a courtesy for folks who want to communicate to their families and friends, not as a business, most of them couldn't afford it.
I know that computing should be the responsibility of the operator, but if that was the requirement there would be no such thing as IT departments or the millions of people who work 24/7 to keep people online or up and running. I have friends that have worked with office computers since the 80's that have no idea how to reboot. They depend on an Tech, and it would be my guess that most computer operators do as well.
Post by: swhitset on September 20, 2007, 05:39:46 PM
Again, I don't know exactly what to say. I have several family members for which I am their only real tech support. One of them is running windows... I have already done more than one format and reinstall due to spyware infestations. He is running antivirus, antispyware, he is behind a NAT router and has automatic updates turned on. You can only practice so much security. Proper user behavior is really the only effective solution. I guess I am back to that user responsibility thing.
Obviously there are always going to be a large percentage of computer users who just won't or can't protect themselves. What we do about that is a question that I can't answer.Steve
Post by: sandbox on September 20, 2007, 11:40:35 PM
Radio frequencies are allocated and controlled. Having had some very weird things happen to mine I know there are forces and technologies beyond my control. Some people call MacDill AFB to find out why their garage doors won't work. Besides all that we are in a highly regulated and closely monitored business where breaches in security could put us at odds with a half a dozen government agencies.
As you say it's only going to get worse and I agree, but one thing I've counted on is that Apple would keep security a top priority on their march to market success. With the shadowy methods of acquiring names, like Apple and iPhone, charging a nerd tax for early purchasers of the iPhone, making exclusivity deals with companies trying to privatize the internet, and now this hide the salami tactic, I'm beginning to feel the need to be skeptical around Apple and a bit uncomfortable singing their praises.
Post by: tacit on September 21, 2007, 10:09:52 AM
QUOTE(swhitset @ Sep 20 2007, 10:39 PM) <{POST_SNAPBACK}>
I hear what you are saying and I'm sympathetic. I don't know what the answer is, but I'm afraid things are going to get worse before /if they are to get better. People should not have to be IT professionals to get their email or surf the web safely.
I agree.
Unfortunately, there are two factors conspiring to keep the Internet unsafe. The first is the incredible amount of money that can be made by writing viruses; it's one of the leading moneymakers for organized crime, especially in Eastern Europe, where it has largely replaced the old-school organized crime activities like extortion rackets and prostitution.
The second is that ISPs permit it to happen. ISPs can identify virus-infected computers, botnets, spam sources, and so on, but they deliberately choose not to do anything about it. They feel that doing things like disconnecting virus-infected computers would cost too much money; they would need to pay full-time staffers to police these issues (most ISPs, even large ones, have one or two part-timers manning their abuse desks), and then they would have to pay for all the support calls from angry customers saying "My Internet access doesn't work. How come I can't see the Internet?" From the perspective of the ISP, they would be paying people money in order to decrease their revenue and increase their expenses.
QUOTE(swhitset @ Sep 20 2007, 10:39 PM) <{POST_SNAPBACK}>
Unfortunately, that seems to be where things are headed. I wish I had the details, but I saw an article the other day that referred to some security researcher who has been tracking the activities of a "bot net" and the incredible degree of control that the bot controller appeared to have. It was estimated that this bot net numbered at least 2 million computers and could be more than 50 million. The controller seemed to be testing his network and was demonstrating the ability to "turn on or off" any number of computers that he/she wished at will.
You're tlking about W32/Storm, the most widespread virus in existence.
W32/Storm, which is believed to be written by virus writers in Russia, is very, very good at spreading for several reasons. The virus writers keep changing it, sometimes several times a day, so that antivirus software is always out of date. The virus writers are very clever at finding ways to trick people into infecting themselves--at first, infected emails claimed to be electronic greeting cards, then they claimed to be a program that can keep the RIAA from telling that you are using peer-to-peer file sharing software, then they claimed to be NFL game tracking software, now the infection is claiming to be a program that allows the victim to play 1,000 vintage arcade games for free. They change the "hook" they use to trick people about once a week or so.
And ISPs know about W32/Storm infections but take no action. I have personally sent lists of dozens of infected computers to Road Runner and Comcast security, ad three weeks later the infected computers are still connected, still infected, and still spreading the virus. The ISPs could stop it, but they just plain don't care.
QUOTE(swhitset @ Sep 20 2007, 10:39 PM) <{POST_SNAPBACK}>
Again, I don't know exactly what to say. I have several family members for which I am their only real tech support. One of them is running windows... I have already done more than one format and reinstall due to spyware infestations. He is running antivirus, antispyware, he is behind a NAT router and has automatic updates turned on. You can only practice so much security.
Antivirus is worthless against Storm. The virus writers change it too often. On top of that, infected computers randomly rearrange parts of the virus code every 30 minutes, which confuses antivirus programs and makes the antivirus signatures worthless. Essentially, antivirus software any more is scarcely worth the cardboard box it comes in.
QUOTE(swhitset @ Sep 20 2007, 10:39 PM) <{POST_SNAPBACK}>
Proper user behavior is really the only effective solution.
I disagree. It is not reasonable to expect Mom and Pop America to become computer security experts. Nor is it reasonable to expect that computer users can never be tricked. What is reasonable, but so far has not been successful, is to expect ISPs to step up to the plate and take responsibility.
The traffic that is used to control virus-ifected computers, and the traffic generated by worms and vulnerability scanning software, is very, very easy to spot. A virus infected computer communicates with the virus writer, and that communication is pretty obvious. If you have 1,600 computers on your network that are all sending identical packets of information to a computer in Russia every 30 minutes, it does not take a rocket scientist to figure out what's going on!
The ISPs could shut these botnets down cold, if they wanted to. But doing so would mean spending money, and many ISPs, especially small and medium sized outfits, are losing money as it is.
So they do not take responsibility for the problem, they do not take action when they are informed of a problem, and the problem continues.
Post by: sandbox on September 21, 2007, 12:39:41 PM
QUOTE
Since the flaw requires a targeted machine to receive and process a wireless management frame, the attacker must be within range in order to transmit the frame3.1.
This flaw is only applicable to intel-Macs…MacBooks and Minis, apparently using the same chipset. My point was data extraction rather than data corruption, knowing that this botnet only infected MS applications.
My major concern is that Apple & affiliates would hide this information for an unreasonable amount of time from customers of their products.
As to the issue of Worms, well your right we are isolated from them at the moment, and with folks like tacit on the job, pointing out what he finds along the way, we may remain that way into the future.
W32/Storm: reader comment from tacit
http://business2-cnet.com.com/5208-10784_3...01&start=-1
QUOTE
Storm Worm
From Wikipedia, the free encyclopedia
The Storm Worm (dubbed so by Finnish company F-Secure) is a backdoor[1][2] Trojan horse that affects computers using Microsoft operating systems, identified as Small.dam,[3][4][5] discovered on January 17, 2007.[3] The worm is also known as:
* CME-711 (MITRE)
* Downloader-BAI (McAfee)
* Troj/Dorf-Fam (Sophos)
* Trojan-Downloader.Win32.Small.dam
* Trojan.DL.Tibs.Gen!Pac13[3]
* Trojan.Downloader-647
* Trojan.Peacomm (Symantec)
* TROJ_SMALL.EDW (Trend Micro)
* Win32/Nuwar (ESET)
* Win32/Nuwar.N@MM!CME-711 (Windows Live OneCare)
* W32/Zhelatin (F-Secure)
* Trojan.Peed, Trojan.Tibs (BitDefender)
The Storm Worm began infecting thousands of computers (mostly private) in Europe and the United States on Friday, January 19, 2007, using an e-mail message with a subject line about a recent weather disaster, "230 dead as storm batters Europe".[6] During the weekend there were six subsequent waves of the attack.[7] As of Monday, January 22, the Storm Worm accounted for 8% of all infections globally.[8]
From Wikipedia, the free encyclopedia
The Storm Worm (dubbed so by Finnish company F-Secure) is a backdoor[1][2] Trojan horse that affects computers using Microsoft operating systems, identified as Small.dam,[3][4][5] discovered on January 17, 2007.[3] The worm is also known as:
* CME-711 (MITRE)
* Downloader-BAI (McAfee)
* Troj/Dorf-Fam (Sophos)
* Trojan-Downloader.Win32.Small.dam
* Trojan.DL.Tibs.Gen!Pac13[3]
* Trojan.Downloader-647
* Trojan.Peacomm (Symantec)
* TROJ_SMALL.EDW (Trend Micro)
* Win32/Nuwar (ESET)
* Win32/Nuwar.N@MM!CME-711 (Windows Live OneCare)
* W32/Zhelatin (F-Secure)
* Trojan.Peed, Trojan.Tibs (BitDefender)
The Storm Worm began infecting thousands of computers (mostly private) in Europe and the United States on Friday, January 19, 2007, using an e-mail message with a subject line about a recent weather disaster, "230 dead as storm batters Europe".[6] During the weekend there were six subsequent waves of the attack.[7] As of Monday, January 22, the Storm Worm accounted for 8% of all infections globally.[8]
http://en.wikipedia.org/wiki/Storm_Worm
From my anti virus provider: Sophos has an IDE file for this worm, which seems to be dormant since may.
http://www.sophos.com/security/analyses/trojdorffam.html
QUOTE
Name Troj/Dorf-Fam
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
Protection
* Download virus identity (IDE) file
Protection available since 20 January 2007 00:38:16 (GMT)
Protection history
* Updated -23 May 2007 03:32:02 (GMT)
* Updated -9 April 2007 03:12:11 (GMT)
* Updated -23 January 2007 03:18:38 (GMT)
* Updated -21 January 2007 15:12:41 (GMT)
* Updated -21 January 2007 00:08:19 (GMT)
* Published -20 January 2007 00:38:16 (GMT)
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
Protection
* Download virus identity (IDE) file
Protection available since 20 January 2007 00:38:16 (GMT)
Protection history
* Updated -23 May 2007 03:32:02 (GMT)
* Updated -9 April 2007 03:12:11 (GMT)
* Updated -23 January 2007 03:18:38 (GMT)
* Updated -21 January 2007 15:12:41 (GMT)
* Updated -21 January 2007 00:08:19 (GMT)
* Published -20 January 2007 00:38:16 (GMT)
Sophos works, Simplicita and Sandvine were a good investment about 6 month ago.