Slashdot Mirror
Yet Another Mac OS X Protocol Handler Exploit
Rosyna writes "Apple just can't get any breaks lately. First the help protocol handler exploit (which has been fixed), then the telnet handler exploit, and now an exploit for any arbitrary protocol handler: make your own, then exploit it. You can auto mount a volume in Mac OS X via the disk, afp, or ftp handlers (and probably others). Paranoid Android will help prevent exploitation until Apple fixes the problem." The hole here is that when a volume with an application on it is mounted, Apple registers the application's specified protocol handlers, without additional user action. Another option is to disable those handlers that allow volume mounting, but playing that game, obviously, isn't a guaranteed win in the long run.
What'd they do, hire the security team away from Microsoft?
First, there is al this talk of switching to linux.
And now even the virus writers are starting to pay attention to something else besides windows.
Finally the end is near.
Goodbye Billy...
On the other hand, I do use Mac OS X.
D'Oh...
I love my Apple computers and I adore OS X.
That said, I'm immensley releived the floodgates to OS X exploitation have finally been thrown open.
Allow me to explain.
Too long Apple users have gloated (senselessley) that OS X is somehow more secure than Windows. This collective delusion has lulled everyone into a false sense of security. Being one of the few who bothers to "secure" his OS X installation, I am often jeered at for being paranoid - uneccesarily so, according to my detractors.
But the truth is that no software sytem is perfect. This is the wake-up call Apple and its users to realise they need to watch out too. I relish this because taking action *now* too purge OS X of its deficiencies will prevent the pitiful scene common to Windows users. I don't want OS X exploited on a daily basis as happens with Windows. I want OS X to be secure!
There will be much displeasure in the short-term, but that which does not kill us only makes us stronger.
Seriously though, once Linux becomes a real choice for average desktop users we'll be seeing Linux exploits as well.
Stop the world; I need to get off.
Fire up MisFox again and update the help protocol helper to /System/Library/CoreServices/Help Viewer.app
If you disagree then it must be overrated, redundant or trolling.
This issue was discovered on the MacNN forum, when they were discussing the previous exploit. The accepted workaround was downloading one of the utilities to change the protocol helpers, but the user kampl refused to have any non-Apple "security fix" on his system (He never acknowledged that the utilities were not sucurity fixes at all, just tools to change user preferences). His solution was to delete the HelpViewer app from his system. One bright member of the forum pointed out that that isn't enough, you could probably just stick the HelpViewer on the .dmg image and LaunchServices would find it there. Another poster realized this might work for any application if you bind it to a bogus protocol in the Info.plist file, so there is no need for HelpViewer at all. A third poster had a sample exploit coded in no time. Apple was promptly notified, so we can expect another fix soon (hopefully).
To continue using Safari safely, just uncheck 'Open 'safe' files after downloading.' - which prevents the automagic mounting of disk images you download.
Doesn't stop images being mounted using disk:// as a protocol. i.e. disk://malware.somwhere.com/own3d.dmg
No one should be using that option.
It's on by default so game over. Not needed for this or new similar exploits to work anyway.
I'd clap, but this is the internet.
This is really the same exploit, with the same solution.
1) Disable automount of downloaded files in Safari.
2) Install the security update
3) Disable telnet: disk: and disks: protocols
That's it. No web page can exploit this arbitrary protocol problem if you do step 1 above. Step 2 fixes the help: issue, and step 3 fixes all other known issues.
Why does this warrant 4 stories in 4 days? Are all the Windows weenies just that thrilled that there is an exploit on OSX?
- Vincit qui patitur.
Can't you see that everyone is buying station wagons?
Ive written a sample exploit that delivers and executes its payload without user intervention and operates by registering its own URL scheme handler. Until Paranoid Android, there was no way of protecting against this attack, which freaked me out enough to write Paranoid Android.:)
If you click the sample exploit link below, heres what will happen:
Because this sample exploit registers its own URL scheme, none of the methods people had been using involving disabling certain scripts, moving Help.app or changing the 'help' URL scheme would protect against it. At this time, only Paranoid Android provides protection from it.
benign sample exploit -->innocousPage.html
Portions of this sample exploit are based heavily on a prior sample exploit at insecure.ws Conclusions
Until Apple fixes this vulnerability, you should install Paranoid Android and surf safely.
Copyright Jason Harris, 2004, All Rights Reserved
I'm using 10.3.3 and when I click on the sample exploit URI, nothing happens -- nothing. I've tried this thing 10+ times, scoured my HD for "owned.txt" and can find nothing. Of course, I installed the RCDefaultApp PreferencePane a couple of days ago and had already followed the suggestions posted by John Gruber on http://daringfireball.net but since Paranoid Android is the ONLY thing that can protect against this exploit, I'm at a loss as to explain why my machines aren't affected.Reading up on the feature that causes the problem, it looks like something in normal situations to be very useful. Rather than simply disabling this functionality, it would certainly seem better to find a solution the security issue. Maybe one would be to require admin permission before activating the URL helper, with a warning of what it would do?
I had thought about requiring applications to be signed, and non-signed applications requiring extra permission, but since this issue is likey to arise from unsigned applications that the user would accept anyhow, would we just be gaining a false sense of security?
I would be curious to read your ideas.
Jumpstart the tartan drive.
No, that's not it at all. They're saying is that if you visit a properly-constructed web page, that page can cause your computer to execute arbitrary code without any further intervention on your part. You just go to the URL, and a few seconds later you've been owned.
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
Its not just that simple, believe me.
Hmmm...Never. I have had Safari automount more disk images than I can count. Some of them have a EULA auto pop-up but never have I seen one run the installer automatically. If that were to happen, we would have seen a trojan on OSX a lot sooner.
seSales, Point of Sale software for OS X.
Can't this one escalate even further?
Can't trojans that get onto Macs turn into bona-fide worms, distributing themselves via Address Book and HTML e-mail that does the 'disk://' download?
But what they're saying is that if I mount a Trojan Horse disk image, it will do bad things to my computer. Explain to me how this is worse than a Trojan horse program? It's possible to write a trojan horse for any platform. Only download software from places you trust.
.sig for example. Click the .sig, and run the attacker's code.
A trojan program is one thing.
These exploits will, with one single click on a link somewhere in a browser, download an attacker's code and then run that code automatically.
There's a big difference between being sent an app or downloading it, then running it in a separate action, and "click this link to see a photo of my cat" then within seconds have an attacker's code wiping all files you have permission to run.
As is, a default OSX install is vulnerable to a malicious link in someone's slashdot
There are a number of workarounds at the moment:
1. The best is Paranoid Android linked to in the article itself. PA itself uses the APE kernel extension from Unsanity, however, and some people have reported problems with this.
2. Another method is to use Internet Exploere, MisFox or MoreInternet to set the following protocol helpers which can mount volumes, to point to an innocuous application, such as Chess.
fpt:
afp:
disk:
disks:
3. In a public environment where there are some automatcially mounted network shares such as in a university, school or company, you would also have to take into account protocols such as:
nfs:
webdav:
smb:
cifs:
but these are less likey to be used in conjunction with this vulnerability as it would be more difficult to get one of these users to simultaneously go to a webpage that exploits this.
"Under the spreading chestnut tree, I sold you and you sold me."
I'm not a mindless Apple apologist. This current set of URI handler vulnerabilities is horrendous and I'm pissed. Thankfully this is the exception rather than the rule... at least to date.
While Paranoid Android 1.1 is better than nothing, it allows some exploits to slip through. Basically, it allows ftp links to mount in the Finder. Once this is done, the Finder will register any URL handlers present. That can include URL handlers that Paranoid Android trusts.
All of this is even after the 5-24 security update is installed, of course.
Apple really need to do something about Launch Services. I think the best bet would be to mark newly discovered URL schemes as untrusted. When the user tries to run an untrusted scheme for the first time, warn them about it.
Both the statement and the reasoning are wrong. Security is a property of the whole system, not something you can implement at one level and then forget about it. The existence of all the stuff that Apple adds on top of a UNIX-like base system (the user interface, Netinfo, fancy file abstractions, NeXTStep libraries, HFS+, Quartz, OS 9 emulation, Macintosh package system, etc.) mean that you can trust OS X much less than a traditional UNIX system.
I do not have any better solution, but as the sky is overcast today I'm gonna complain about yours anyhow.
You are not alone in suggesting that the user should confirm what should happen in a dialog/pop-up/what-not. The problems are
a) There are too many clueless users out there, who have no idea of what they are doing.
b) Even if you are full of clues and the geekiest guru of the town, there will be moments when a dialog simply cannot give enough information on what can safely be done.
In an ideal system you (geek or your grandma) should never have to worry about understanding what is going on and judging whether it is safe or not.
But, as said before, that does not mean I have any suggestion on how to handle this particular problem in any better way. Sorry...
Yeah, and that brings the total number up to two or three exploits. Let's all just switch back to Windows--it's obviously a superior, more secure operating system!
Nice freakin' headline.
[disclaimer:not affiliated with obdev, just a satisfied user]
.dmg Little Snitch popped up wanting to know if this should be allowed.
Anyone surfing without an application sensitive firewall should catch a clue.
The first time Mozilla tried to mount a sample exploit
Granted, your run of the mill user would likely click through allowing the mount, but they would probably do the same with Paranoid Android, and LS covers all applications trying to establish external connections, a real plus in todays wired world.
Some days it's just not worth
chewing through my restraints.
Funny, how these assumptions happen.
/System? You can get that off of a CD in half an hour. It's the documents, pictures, movies, and music that you have that are difficult to replace, and owning your user account is enough for a virus to destroy them.
I'm a Mac owner. I've owned nothing but Apple computers, first an Apple IIGS then a series of Macs. I love them, and I think Apple is great. But that doesn't prevent me from facing reality.
The fact is, it doesn't matter if "only" your user account is compromised, and root remains secure. What can a trojan possibly do to your computer that you don't want it to do? It can delete files, spy on you, and proxy spam or other malicious network connections. It can do all of this with "only" your user account. You don't have to be root to proxy anything. You don't have to be root to run a keylogger or run a heuristic that greps for credit card numbers. You don't have to be root to trash all of the files in your home directory, which should be the only ones you care about. Who cares if the trojan can't trash the stuff in
The unix permissions model is great on multiuser systems, but on a home desktop it really just doesn't help that much. It's nice, but it fails to protect that which I care most about.
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
Ok, my configuration:
Mac OS/X 10.2.8, with all services turned off and the firewall turned on, denying everything, and all Directory Access protocols turned off (what can I say, I'm a little paranoid). I also have a hardware firewall between my laptop and my cable modem. Belt and suspenders, right?
I don't use Safari because it doesn't seem to be too stable on my machine for some reason (gypsy curse?). If I install it, it crashes on some of the sites I visit (I think this is a Java issue of some kind). So I deleted it.
For a browser, I generally use Mozilla 1.6, although I like to play with Firefox and Camino, too. I'll probably switch to Firefox permanantly when they get past the 1.0 hurdle. In my browsers, I have killed most of the plugin handlers except for the obvious ones, like mp3 and so on. Plus, I'm sadistic about popup windows and cookies.
OK, enough introduction.
I tried the vulnerability links on the site, and they didn't work on my system. The first link produced an error message claiming a "type 2" error, then a popup which said that the protocol in use was not a registered protocol. The second link didn't produce an error, but it did produce the registered protocol warning. Neither link resulted in a file being saved to my machine, or indeed any other visible effect.
Note that the website did mention that users of Jaguar might not be vulnerable, and that there was anecdocal evidence for this. So, let me add my anecdote to the collection of anecdotes already present, and say that if you're running a similar setup to mine, you might be alright.
-Phil
Farewell! It's been a fine buncha years!
An important point is that this family of exploits is not the result of any programming errors. It is the result of everything working precisely as it was intended to, but there being unforeseen uses for the design as originally specified.