Apple's in the eye of flaw finders

Apple's in the eye of flaw finders
Robert Lemos, SecurityFocus 2006-02-07

At the recent ShmooCon hacking conference, one security researcher found out the hard way that such venues can be hostile, when an unknown hacker took control of the researcher's computer, disabling the firewall and starting up a file server.

Colapse all | Post comment

Apple's in the eye of flaw finders 2006-02-07
Anonymous (1 replies)

Linux is secure on x86. Sure there are buffer overrun problems inherent in x86. However, its up to the coders to prevent this with "checks." Security on OS X via x86 IMHO is nothing for the average professional to currently worry about....

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Rick (1 replies)

Of course it's something to worry about. Security pros get paid to worry.

It takes one of three puzzle pieces out of the equation. Those three pieces are:

#1) find some dumb code someone in Redmond wrote so you can crash the stack;

#2) put in some cookie cutter shell code so you take over the...

[ more ] [ reply ]

Re: Re: Apple's in the eye of flaw finders 2006-02-09
Jay Beale (1 replies)

The other component of increased risk from moving OS X to Intel x86 is that so many people have spare x86 machines that they can do security research with. Between the stronger utility of an x86 Apple and the well-documented ability of people to get OS X running on non-Apple hardware, there are goi...

[ more ] [ reply ]

Re: Re: Re: Apple's in the eye of flaw finders 2006-02-09
Anonymous

I would focus on the ball pitched. The x86 PowerBook does not exist. So if this happened it happened on a G4 or G3 running OSX if this PowerBook had OSX installed.

The story is vague enough that we could assume lots of facts not yet in evidence. So far we have a story about an unattended Powe...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous (1 replies)

Whilst this is an excellent article with a large number of valid (if not new points) I wonder if there is good reason to use the reaserchers powerbook as an example of a flaw in this case. Since the powerbook was "locked down" and since there are no obvious answers as to how the laptop was hacked i...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Ralph

My thought as well... One hacked PowerBook doesn't spell doom for Mac OSX. If anything Apple has the wealth of Unix experience with vulnerabilities to draw on....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous (1 replies)

BS, if anything, this guy probably left his machine unattended, and someone enabled the root account and ssh. ...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-09
Anonymous

You do realize that what you're saying means there's a local root exploit on the loose for OSX, right? one can't just say 'Open Sesame' and root gets enabled.

And once you have a local root exploit, a desktop system is a lot easier to compromise....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Alexey Vesnin

Flaw digging was always a diagnosys and a way of living - not a profession. In all the good meanings of theese words. I think that every serious software/hardware developer company must have it's own independent team of flawfinders. Remembering the BAD practice like Cisco or Oracle, we can face a pr...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous (1 replies)

oh please....no names..? if the powerbook owner had really had such a take over, why keep quiet..? Pride or just the usual FUD of people trying to find holes in the Unix based OS that is OS X.?...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Rick

'Unix based' are the operative words here. NeXTSTEP was a GUI on top of Unix. Bring that clean architecture to Cupertino and what do you get?

Exactly: today it's 'Unix based' - it's NOT Unix. It's a lot of things - too many things all at once - but it's definitely NOT Unix....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous (1 replies)

A complete and useless piece of FUD... Laughable, really....

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Anonymous

When these guys start breaking out the shell code, I hope it's your box they hit first. What a moronic attitude. You probably don't even know how to bootstrap enable your root account - if you even know what a root account is....

[ more ] [ reply ]

Don't be foolish 2006-02-08
Anonymous (2 replies)

Very simply: Nothing is secure. To think that your platform is "secure" just because it does not have a history of compromises is like saying that guns can't kill people because you've never seen someone get shot. Lets ask a few important questions. What provisions does Apple have in place to res...

[ more ] [ reply ]

Re: Don't be foolish 2006-02-08
Anonymous

If you really knew what you were talking about you would know by now that Mac OS X is not a kludge of FreeBSD. Mac OS X incorporates programs and libraries from all the BSD flavors, including FreeBSD, OpenBSD and NetBSD. And they were not kludged, they were worked out during 4 years to get to 10.0 a...

[ more ] [ reply ]

Re: Don't be foolish 2006-02-08
Anonymous

I beg to differ from your claim that "nothing is secure". UNIX may be very difficult to secure, but that doesn't mean that a secure OS is impossible. See the EROS and COYOTOS projects, for two examples....

[ more ] [ reply ]

I had no problems at Shmoocon 2006-02-08
Anonymous (2 replies)

I attended Shmoocon, with a Powerbook. I did not make an extreme efforts to protect my box, although my normal routine includes running a firewall, keeping software up-to-date, requiring a password, and not leaving my computer out of my sight. I did not run into any problems from the event.

So ...

[ more ] [ reply ]

Re: I had no problems at Shmoocon 2006-02-08
Anonymous (3 replies)

Meaning exactly what? Is this the reasoning of a security pro? No. Can't be. It's the reasoning of someone who thought it would be cool to visit Schm00con. I mean 'wow'.

Your story is anecdotal and proves nothing. In fact it's downright moronic. You're saying that inasmuch as you didn't get hit t...

[ more ] [ reply ]

Re: Re: I had no problems at Shmoocon 2006-02-08
Anonymous

I think the point is that the story in the *article* is anecdotal. There's no details, no names, no description. While it's certainly necessary to discuss security problems in a scientific manner, the article above doesn't, and smells of a hidden agenda. That's why it's important to disclose full de...

[ more ] [ reply ]

move along 2006-02-09
Anonymous

I am the person that you are attacking. But I am not sure why. I did not say that someone did not get attacked, maybe he did. But who cares?

There is no information here. Which network was he connected to? What systems did he talk with? What services and programs does he run?

Without...

[ more ] [ reply ]

Re: Re: I had no problems at Shmoocon 2006-04-17
Anonymous

This whole story is proof of nothing. ...

[ more ] [ reply ]

Re: I had no problems at Shmoocon 2006-02-08
Anonymous (2 replies)

The security researcher in question maintains a fairly high profile, and thus may have been a bit more of an attractive target. I saw some details of the exploit, and found it quite clever.

OSX fan that I am, I know better than to believe that there is such a thing as a Totally Secure Machine, a...

[ more ] [ reply ]

Re: Re: I had no problems at Shmoocon 2006-02-09
Raven

Wow... Anonymous... and you saw some of the details...

Sure......

[ more ] [ reply ]

Re: Re: I had no problems at Shmoocon 2006-02-10
R_U_Trustified?

You might want to google Trustifier, for your own information, and then you can start believing....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Mike Andrews (1 replies)

Yes... when Mr. Lemos wrote, quoting Dan Kaminsky, "The reality is that security work does comes from a trial by fire," he said. "And Apple really has not had that experience. It had not had the experience from some 20 years that Unix had and that Linux has absorbed. It has not had the experience th...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-03-07
Anonymous

Apple has 2% of the market share. They have no track record because they haven't sold any computers yet.

...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous (2 replies)

How much do writers get paid by MS to write this crap? Or do they just publish it under their own name after MS writes it for them? Either way I want a piece of that pie!...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Anonymous

How are you going to eat pie when you have your head buried in the sand?...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-09
Anonymous

"SecurityFocus was acquired by Symantec Corporation in the fall of 2002, and Symantec has since incorporated the SecurityFocus commercial products DeepSight Threat Management System and Alert Services into its product line. Part of the purchase agreement was to keep SecurityFocus as an independent W...

[ more ] [ reply ]

do we want security through obscurity? 2006-02-08
assurbanipal (1 replies)

Everybody argues that security through obscurity doesn't provide additional protection. Yet this article seems to point to the contrary, i.e. the shift to a better known platform will "prove" dangerous because more people know how to fiddle with it. This is probably what happens, but reflects market...

[ more ] [ reply ]

Re: do we want security through obscurity? 2006-02-08
Penguinisto

Maybe, maybe not... I suspect that, unless more than one incident of this occurs, it could well have been someone peeking over the guy's shoulder while he logged into the laptop at a keynote.

As beautiful as paranoia can be to someone who secures things for a living, it must also stand to chance ...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Scott Barman (www.barman.ws) (2 replies)

This is a public challenge to Adam Shostack, chief technology officer for security firm Reflective who said "OS X running on x86 means that the skills that people have developed and a lot of the tools people have created for finding problems, analysing problems, and writing the code to take advantag...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Adam

I don't know that flaws in the processor mean nearly as much as the familiarity that many people have with x86 assembler. Feel free to read the longer explanation I've blogged at http://www.emergentchaos.com/archives/001928.html.

I think that the direct quotes, regarding tools and experience are...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-08
Anonymous

Wow! You got Shostack shaking in his boots now!

But as you're a self-proclaimed security professional, why do you have to ask Mr Shostack anything?

Sorry to hear about your wife. But this is a serious matter here - not as serious as some other things - and putting down one's placards for a mom...

[ more ] [ reply ]

Hired Gun 2006-02-08
Anonymous

One thing we all should remember: Robert Lemos is a hired gun.

He writes a lot for CNET where he's expected to FUD anything ant-Microsoft as much as he can. He's probably written countless sensationalistic articles already about MAJOR FLAWS in OS X when it's only a question as explained in fine f...

[ more ] [ reply ]

Long on FUD, short on fact 2006-02-08
Marty

I'm not saying a security exploit on Mac OS X will never be found, however, this article has no details about how the computer was "locked down" nor how the exploit may have happened (since the investigation turned up no evidence). The so-called researcher *guesses* that it may be an unknown exploit...

[ more ] [ reply ]

Forensices did not reveal any clues? 2006-02-08
Anonymous

Did the forensics not reveal ANY clues? The article doesn't give any clues either. Were any services available allowed through the firewall? Was automatic login enabled? Was the system rebooted? (Which would trivially allow access without FileVault enabled.) Without any more details, the article is ...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous

SecurityFocus is owned by Symantec. See macdailynews.com/index.php/weblog/comments/8512/

Vested interest?...

[ more ] [ reply ]

Ragnarok/Apocalypse is possible for Mac users - wake up. 2006-02-08
Rumplestiltskin

Mac Users - Apple has been my weapon of choice since 1985. I now work on all manner of network devices, firewalls and servers and my PBG4 12" is VERY useful in that job. It's what we play on at home and I run some security services on an Xserve.

I've been of the opinion long before I read it here...

[ more ] [ reply ]

Apple's in the eye of flaw finders (yes, and no) 2006-02-08
Debunker

This would have been a great warning to us Mac users, if it weren't all bunk. Yep, it never happened. Nice try. Which company do you work for? Symantec?...

[ more ] [ reply ]

"Intel", new fuel for the FUD 2006-02-08
rY.

> The company's move to Intel-based hardware for its next-generation

> of Macs also gives flaw finders familiar territory in which to look for bugs.

So, wait, what exactly does this story have to do with Intel Macs again? Did this "hack" exploit a weakness in the Intel architecture that Apple, ...

[ more ] [ reply ]

Did his POwerBook really get compromised? 2006-02-08
Anonymous (2 replies)

From reading this article, I wonder what evidence the security researcher has that the PowerBook was even hacked? According to the article, forensics were unable to turn up any evidence of how the hack was performed. Did they turn up any evidence at all, or is the only information vector the hacker'...

[ more ] [ reply ]

Re: Did his POwerBook really get compromised? 2006-02-09
Anonymous

That was my original thought as well. Usually, the only way a hacker can gain access to the computer is to be using the same computer or allowed to install software.

In another thought, Apple using Intel chips might be great for selling more computers but like in the Windows world, users will ...

[ more ] [ reply ]

Re: Did his POwerBook really get compromised? 2006-02-10
Anonymous (1 replies)

That's what I thought too. Is the only thing the hacker got was the researcher's friend's e-mail? A serious, self-respecting hacker with access to a security researcher's computer would certainly have done something a little more serious than harvest e-mail addresses. Maybe nothing malicious, but so...

[ more ] [ reply ]

Re: Re: Did his POwerBook really get compromised? 2006-02-10
Anonymous

Another thought regarding email harvesting. If the user was running office for Mac, that would allow more exploit access as Microshaft freely admits incorporating their highly acclaimed macro code into the bundled applications....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-08
Anonymous

Apple appears to have anywhere from 5 to as high as 15% of the user market. Not sales -- installed user base.

This is not <1% or a vanishingly small number of machines. These machines are in all manner of environments: harry homeowner with a dedicated DSL connection, susie at college with her t...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-09
A Nonny Moose

Without more information, it's nothing more than FUD. "Yeah, my PowerBook G4 was compromised, but I won't reveal my name or what happened or anything that was running on the system or anything like that. It was just compromised, ok?" This idiot might have just forgot what he did two days ago and ...

[ more ] [ reply ]

Apple's in the eye of Finder flaws 2006-02-09
AudioAquatic

As a home-user, I think OSX is too secure. I know what I'm doing and don't need or want password protection for every action. It's a nuisance. ...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-09
Anonymous

IF that guy knew ANYTHING about security then he'd have anticipated this and given away only fake information :-) ...

[ more ] [ reply ]

How to do what was described... 2006-02-09
Anonymous

Use a video camera to record the user of the computer logging in. Figure out their password. Log into their machine. Done.

Has nothing to do with Mac OS X....

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-09
sierradragon

A self-serving nonsense article, falsely implying high Mac vulnerabilty: e.g. "Apple 88 vulnerabilities, Microsoft 61 vulnerabilities." Reality is ZERO successful Mac virii/worms in ~7 years vs. HUNDREDS on MS platforms; DUH. Of course Macs need to stay vigilant because of course (IMO increasing) po...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-10
Anonymous (1 replies)

I was at shmoocon too. I noticed that 10.4.4 is kind of noisy in terms of sending packets once you boot up-- alot to .mac adresses (idisk, mail servers, etc.) I'd say probably 60% of attendees were running sniffers. If ANYTHING, this guy probably had a cached password was sniffed. (Saved passwords f...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-02-14
casad

Agreed..Common sense at last!...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-02-20
Anonymous

Why dont we just use a fingerprint scanner with encrypted Fingerprints table???

Why isnt this a standard by now?...

[ more ] [ reply ]

Apple's in the eye of flaw finders 2006-03-07
Anonymous (2 replies)

Why is it that whenever somebody hacks a MAC everyone cries fraud? You guys remind me of people who swore you couldn't cheat at online games like Halo. It was beating them over and over mostly for their refusal to accept the obvious....

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-03-28
Anonymous

If the hacker is smart, he/she will wait and share his secrets with his/her friends. Then pick any given day, and wham, jack as much stuff as possible. He or she already committed a blunder by revealing they hacked it, why not wait and hack a lot of people at the same time?

The notion of securi...

[ more ] [ reply ]

Re: Apple's in the eye of flaw finders 2006-03-28
Anonymous