Post by: Paddy on March 28, 2008, 04:39:54 PM
This is a great article, though rather long-winded - and should be required reading for any Mac owner thrown into a tizzy by the likes of CanSecWest and sensationalist reports in the press. (meanwhile, there are rumors afloat that major Mac-hater George Ou at CNet has been laid off...)
Note: you may want to skip most of the comments at the end, as they devolve rather quickly into political sniping!
By the way - missing from most of the early stories I read is any emphasis that this appears to have been a Safari exploit, not an OS X hack. Also, the machines were in their default-out-of-the box configurations - and that means the Mac's firewall was OFF. (why Apple persists in leaving it this way in Leopard is a mystery to me - the explanations they provide are also rather lame) Vista's firewall is ON by default. Nobody managed to hack any of the OS' on the first day - apparently nobody even tried. Further, it was a hack that required social engineering - getting the user to go to the web site that (apparently) contained malware that Miller had previously set up and had been working on for over a year. Which is not to deny that there is something that needs fixing - there clearly is. Nor can we deny that as of an hour ago on Day 3, the other two machines (Vista and Ubuntu) were still standing.
Anyway, it's certainly brought out the trolls again.
And no, we shouldn't be smug - there is no such thing as a 100% secure system, but the ridiculous hysteria that develops and bitter arguments that break out whenever there is the slightest whiff of a Mac exploit/hack/virus gets very old, very quickly. The fact that there are no viruses in the wild for OS X after 7 years says a lot. It would be nice if the myth of security via obscurity was overturned once and for all...
Post by: Paddy on March 28, 2008, 10:34:11 PM
http://dvlabs.tippingpoint.com/blog/2008/0...day-and-wrap-up
Looks like Adobe has more than one problem to fix in Flash:
http://www.macworld.com/article/132749/2008/03/flashbug.html
Post by: krissel on March 29, 2008, 01:38:24 AM
More reading:
http://www.channelregister.co.uk/2008/03/28/mac_hack/
http://dvlabs.tippingpoint.com/blog/2008/0...er-with-picture
Post by: Paddy on March 29, 2008, 10:49:36 AM
QUOTE
Charlie Miller, who was the first security researcher to remotely exploit the iPhone, felled the Mac by tapping a security bug in Safari. The exploit involved getting an end user to click on a link, which opened up a port that he was then able to telnet into. Once connected, he was able to remotely run code of his choosing.
Interesting - since I'd commented that the default setting for Leopard's firewall is "OFF"! What would be interesting to know is if, when it is enabled, this hack could still be performed and under what conditions. Will the Mac allow that port to be opened under any conditions or if Safari is one of the applications with incoming connections allowed? There is no way to use the security settings to block ports - you need to do it in the Terminal and it's not something the average user will feel comfortable doing.
http://www.macworld.com/article/132558/200...onnect2504.html
At any rate - this does raise the question as to whether this is actually simply a Safari exploit or whether there is something that needs to be done to the OS X firewall. It certainly would have been interesting to see if this hack worked in Safari on the Vista machine as well - I'd be surprised if Charlie Miller doesn't give it a try.
Post by: Xairbusdriver on March 29, 2008, 04:44:43 PM
QUOTE
The exploit involved getting an end user to click on a link, which...
I still fail to see how this is a "Mac" or "Safari" 'exploit!' Surely almost anything can be done if you can get the user to do something for you. 
QUOTE
"Please open your Firewall and turn it OFF so we can hose your System for you. Once cleaned, you can turn the Firewall back ON. Thank you for your gullibility." 
There are always going to be enough fools to counter any 'fool proof' setup. 
Post by: Paddy on March 29, 2008, 05:50:22 PM
Also, from what I've read, the hack only involved clicking on the link - it didn't involve having to install anything (like a Trojan) so I don't think claiming that it's simply user stupidity, which therefore nullifies the seriousness of the security hole. Sure, lots of us run behind routers and this sort of thing wouldn't happen, but not everyone does, and with the way legitimate web sites are getting hacked these days, how can you be sure that the link you click on is safe if something like this is a possibility?
Anyway, I'm not concerned that this is a real-live-in-the-wild issue now - but Apple needs to fix it, and from all reports, are working on doing just that.
Post by: Xairbusdriver on March 29, 2008, 09:37:28 PM
) but I wonder if the 'user' of the machine was also operating with Root privileges? It would seem that then linking to a site with a know (Unix) script could easily open any ports desired without any further input from said user. 
But a user running as Root and leaving the Firewall OFF seems to be daring anyone to attack his machine, no matter what OS is in use.
Obviously, I need to learn more about what and how the Firewall from Apple works...
Post by: Paddy on March 29, 2008, 11:16:22 PM
Post by: Xairbusdriver on March 31, 2008, 05:04:37 PM
Anything that uses the Internet, I would assume but that could include any app that does automatic checks for updates, right? And who knows how many of the System functions use various ports?Seems like one should be able to specify what ports can be used rather than what apps/services since most would simply use the normal http (can't remember that one) or email port (25?). All the other ones should be reported to the user if needed right after the first OS install or an update. That's probably just way over-simplified and impractical...