Slashdot Mirror
Amit Singh's Challenge: Find a Decade-Old Bug
dreicodan writes "Well this has too many juicy Mac OS X nuggets in one bag! All details are on this page, but I'll summarise. Apparently Amit Singh discovered a 10+ year old serious bug in OS X. The bug started in Nextstep and is still in Panther (and apparently Tiger, too). Then Amit wrote a program to demo the bug, but also made the program capable of hiding what it does using some complicated Mach kernel voodo! He then threw a challenge open to OS X experts to figure out the bug. It turns out that a week and some 1000 downloads later, three brilliant hackers (Alexy Proskuryakov, Andrew Wellington, Graham Dennis) were able to solve the puzzle. Also looks like other than these guys, nobody got anywhere with the problem. Be ready for extremely gory details of how the program was written and how it was decoded. Its a thrilling read, and OS X hacking doesn't get any more hardcore than this! Hopefully Apple fixes this bug now at last."
http://www.kernelthread.com/mac/challenge/result/
concrete5: a cms made for marketing, but strong enough for geeks.
Thats a long time, almost meets M$ standards.
"God of Rock, thank you for this chance to kick ass. "
I think one of the reasons why only a few people submitted their analysis was because of how the contest was structured.
Singh said he was going to give the prize to the first person with a correct submission. Not the best submission, nor the most complete submission, or the most creative submission.
So I think people just gave up after the first couple of submissions were posted. He shouldn't have displayed the number of submissions that had been received.
Also, this challenge didn't hit Slashdot until after it was finished. I know I didnt' hear about it until after the first two submissions were submitted.
It was fun to track down though.
If a bug fails in an OS, and no one finds it, does it make a sound?
I watched C-beams glitter in the dark near the Tannhauser gate.
I agree. Either they didn't know it was there, or they didn't think it was important enough to fix right away.
But that's different from them not knowing how to fix something, which I'm sure they do.
Everything I need to know about copyrights I learned from Slashdot.
NS had a lot of old bugs due to its use of 4.2BSD. People would report it but hardly any would get fixed/patched/updated. So I would not be surprised if some of these bugs were not purged by OS X's use of a more up-to-date version of BSD and its subsequent kernel reorg.
Hopefully Apple fixes this bug now at last.
Man, What with blowing away their 2Q'05 earnings projections, I hope the first thing Apple does is address this bug that no one has paid any attention to in 10 years. That will make me as a Apple user and share holder happier than if they continue this "innovation" fad.
I only came here to do two things; kick some ass, and drink some beer...looks like we're almost out of beer.
I don't see anything in TFA to indicate that Apple knew about this bug before now- he just mentions that the bug has been present with no explanation as to how this was determined. Singh even spends a good bit of text explaining how the bug is triggered by ultra-low-level routines that are not normally used by anything above the BSD layer, so I'd say there's a good chance it has never even been encountered by anyone before, if OS X's own process creation code is sufficiently solid as to never generate the inconsistency panpipes does.
Given that the bug wouldn't be too hard to fix, and is a serious bug, I doubt that that is the case. On the contrary, while it is a bit annoying that this sort of oversight in the kernel design does exist, I think it speaks well for NeXT and Apple that they have not discovered it in all this time.
:-) can pop up. Now, the fact that OS X has a sort of Mach/BSD - Jekyll/Hyde sort of thing going on in the kernel means that you should expect it to be very tempting for many developers to haphazardly make system calls as they see fit. But if that had been the way development worked at NeXT, you can bet your pants that this bug would have been discovered at least a decade ago. (Mr. Singh doesn't say exactly how far this thing goes back, but I'm going to guess it has been in NEXTSTEP the entire time - about two decades.)
NEXTSTEP/OS X has an incredibly layered architecture, and those layers are quite well-stratified. That stratification is a great design asset - it makes it a lot easier to keep the whole mess organized, and reduces the number of boundary conditions where bugs (such as this kernel bug
-BUT-, the bug is still there. While I normally hate old bugs as much as anyone, especially ones that cause kernel panics, in this case I am sincerely and profundly impressed at the amount of discipline that must have been present in the development culture at NeXT. (We'll see about Apple - on the inside, Classic MacOS became quite possibly the most tangled kludge of an operating system ever produced in its last few incarnations, and I do get the impression that Apple is starting to take OS X down that path, too.)
The flaw used by panpipes has existed unnoticed for over a decade. If attackers were indeed actively looking for flaws all along, did they miss this one? If nobody was ever looking for any flaws, could there be more exploitable flaws lurking?
The rest of the article is good fun, but this passage is a brain fart. There are millions of lines of source code in any modern operating system. Exploits don't sprout overnight like mana from heaven. The most useful skill for divining exploits is to notice the existence of edge cases in how various subsystems interact with one another. There is also the important case where "chance favors the prepared mind". This is where something funny happens as a result of an honest mistake, then the "prepared mind" notices (and pursues) the chance event's darker implications.
Serious bugs that lurk for decades are hardly unknown. The ASN.1 bug springs to mind. It's hard to image a bug more widely deployed that escaped detection for such a long time. The question here is why, for such a long time, this simple flaw evaded interactions with dark energy. It's for precisely the same reason that experts rarely make the best testers. There are certain kinds of elementary programming mistakes that the "prepared mind" will habitually avoid. This distribution has a slim tail. If the minions of evil fail to stumble into any telltale clues after five years, chances are good it will remain hidden for a long time yet.
This is in fact the same mistake that Kurweil makes in predicting the imminent singularity: that intellectual power is a fully ordered function, based on the premise that a really smart person can achieve any interesting result that any person much less smart can achieve. To put this in perspective, consider the recently discovered AKS primality test. This is what AKS achieved by some clever tricks using concepts of undergraduate algebra and a 15-year old theorem.
http://www.flonnet.com/fl1917/19171290.htm
Undergraduate concepts in algebra exploited to achieve mathematical immortality. That ought to frame a tiny, unnoticed flaw in OS/X.
People in Capital One, Compound Therapeutics, Fossil, Goldman Sachs, IKEA, and SAAB were interested enough to download this, but no one from the Semantecs/Sophos/Secunas of this world found it worth their while to check it out??!!
I would certainly hope that they are paying attention to the use of dynamic code modification, code obfuscation, and red herrings. While these techniques are not new, none of the (Windows) malware seen so far were designed to be even half as proficient in these matters as panpipes. Further, Amit has stated that he could have made panpipes even more difficult to debug (but didn't).
Kudos to Amit for this highly educational exercise! He certainly seems to know his way about the innards of OS X (not to mention all the other OSes he runs on his 17"PB via VPC.)
(I bet he has some interesting insights about the evolution and workings of OSes from MS (he is running ALL the flavors of DOS and Windows that I know of.)
Apple should hire, even if they never hire another person for their OSX team, Amit Singh. It is truly rare that someone as gifted as this appears on the scene and then even has a passion for the intricacies of a kernel that does not garner much attention in the OSS scene.
Given that all the immense amount of detail that Amit has given on OSX as shown on kernelthread and in his upcoming book has been done in his spare time, could you imagine what he could achieve if this was his job. Granted, I'm no HR person, but I would think that Apple should be chafing at the bit to get him on board. I know that if it was up to me, I would offer him an almost blank cheque to write his own salary on.
He is the person who could get OSX into the enterprise.
Of course, if he did work for Apple, then his website would surely suffer, what with NDAs and such. Perhaps it's better that he doesn't work at Apple.