Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mac OS Auto-Execution Vulnerability

Posted by pudge on from the mac-os-is-like-so-insecure-and-stuff dept.

iGawyn writes "As reported in this BugTraq post, Mac OS and Mac OS X (via Classic) are both subject to an auto-execution vulnerability. In short, the poster says that various web browsers can automatically download a disk image containing malicious code and run it without ever telling the user. vm_converter made a test page to demonstrate the vulnerability." Yes, this is a nice variation on a theme. The lesson is: don't ever have "CD-ROM AutoPlay" turned on in your QuickTime preferences.

3 of 20 comments (clear)

  1. Auto-Start problems by ilovemydualg4 · · Score: 3, Informative

    Do you remember the autostart worm? It affected all macs with auto start turned on, a LONG time ago. One of MacAddict's "The Disc" included it on it by accident as well.
    This stuff has been going on for ever

  2. mozzila seems to catch it by Hadlock · · Score: 2, Informative
    mozzila (0.9.8) seems to catch it no problem. displays the "downloading Exploit_HD_OSX.img.sit" window. "what should mozilla do with this file?"

    open using stuffit

    save this file to disk

    granted, the drive, once mounted, can auto fuck your drive, or the likes, but if you're bright enough to open a drive image that mysteriously appeared, well, i wouldn't say you deserved it, but consider it a lesson well learned ;)

    of course, the problem lies with the avg mac user, who won't think to use a non-bundled mac app, like mozilla, or chimera, even though chimera doesn't have download support quite yet.

    btw for those of you fearing to try out this security hack, it automounts the exploit_HD_OSX.img onto your drive, which auto opens, and then opens your trash (apple script). too bad the author didn't include a (non autoloading) script that turns off all these vulnerabilites that you could run :-/

    --
    moox. for a new generation.
  3. Autoplay by dr00g911 · · Score: 3, Informative

    For years now, smart Mac users have left Audio CD and CD-ROM autoplay off, because of a variety of worms that were propagated by those methods.

    There was a time back in '98 or so that just about every Zip or CD-R coming back from a service bureau was infected.

    Launching arbitrary code (fooling IE into thinking an .app is a .dmg) and autostart worms can be exploited in the same manner.

    Microsoft has known about this problem in OS X 10.0 for a while now (it's an IE problem in X, really, as IE is what autolaunches .DMG and .SMI images) the MacOS 10.1/IE 5.1 update supposedly alleviated the hole, FWIF.

    The article is speaking about a hole running with a Classic mode browser or running truly under OS 9 -- a variation on the same theme.

    If you're concerned about this:

    • Go to your software update panel and get current -- 9.2.2 and 10.1.3 for os 9/X, respectively
    • Get Stuffit Expander/Deluxe 6.5 from Aladdin
    • Under your Quicktime control panel (OS 9) or prefpane (OS X), turn Autostart off
    • Get yourself a copy of Norton Antivirus for Classic or X. It's wonderful about letting you know if something is virused or if a disk image has a payload when it's being expanded.

    Anyone who sends CD-Rs and Zips out and back in to their machine has no excuse for leaving autostart on, and Apple has no excuse for shipping the OS with those on by default, escpecially with the problems it has caused over the years.