Slashdot Mirror
Mac OS X Security Competition Ends in 30 Minutes
ninja_assault_kitten writes "ZDnet is running an article on how a Swedish Mac OS X enthusiast held a competition to prove how good security was on his new fully patched Mac Mini was. Unfortunately, 30 minutes after the competition began, a hacker known as 'gwerdna' had broken in and defaced the website, thus winning the contest.
According to gwerdna, 'Mac OS X is easy pickings for bug finders. That said, it doesn't have the market share to really interest most serious bug finders.'." It's also worth noting a piece that says all the security news is much ado about nothing, in practical terms. The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack.
Or at least restrict by host at the firewall. On OS X, remember to turn on ipfw's statefulness.
It is cowardly, and a betrayal of whatever it means to be a Jew, to act as a white man
-James Baldwin
What was this fool trying to prove? He allowed direct SSH access to the machine! Of course someone is going to hack it! Once you're inside the system, it becomes incredibly easy to find configuration mistakes, and exploit holes in priviledged programs. Remember, this system runs much of the same software as Linux and FreeBSD. Much of that software hasn't been properly audited and locked down. Why? Because this is a desktop machine.
Mac OS X security primarily stems from not doing anything stupid by default. Which means that there are no remote services enabled, the system tries to be intelligent about handling executable files (like most Unixes), and super-user functionality is handled by Sudo. But that's not a bullet-proof vest. There's nothing in the system that makes it automagically secure against all attacks. So if you want security, don't turn on those remote services, and don't give out SSH accounts!
Javascript + Nintendo DSi = DSiCade
I'm not really sure why this competition happened in the first place. If you were a Mac OS X enthusiast wanting to show the "amazing" security of your OS, why would you leave the first major door wide open?
And who gains from this publicity? It would seem like sponsoring a hacking competition that took MORE than 30 minutes (seemingly the goal of such an event) would be good for Apple, but then why leave the system more vulnerable at the start of the contest? And if it was really sponsored by an anti-Apple group posing as an pro-Apple group, why have the hacker claim that Macs are essentially "small pickin's"?
It just doesn't make sense...
Yes, there are local privilege escalation vulnerabilities; likely some that are "unpublished". But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction.
Whilst I agree that this is not the same as a remote exploit, do not underestimate the seriousness of local privilege escalation.
For instance, an unpatched local privilege escalation, used in conjuction with the vulnerability discussed in this article could result in a rooted machine - simply from visiting a hostile website (or even a website you visit regularly, that runs IIS and has been hacked itself)
I don't believe (as some pundits seem to) that Mac OS is a Microsoft style security disaster only awaiting the attention of hackers to happen - but I do believe that Mac owners are going to have to start paying a little more attention to security matters then they currently are.
My pics.
Or in this case, the ability of the system administrator to open up the box...
SSH is off by default, the admin had to turn it on.
Hackers don't generally have shell accounts -the admin had to set them up.
So if you take steps to make the Mac Mini less secure, then advertise you've done so, it gets hacked. Expect all major tech outlets to cover this new and amazing Mac vulnerability (you think I'm joking?).
true, though a timeshare box on a college campus is somewhere you would easily see such a setup. remember though, this is (supposed to be) a *nix we're talking about. local user accounts should not be able to inflict such damage due to better seperation of priviliedges that exist in this world.
I think you are missing the really obvious point here - the fact that granting shell access over SSH leads to a non-administrative user gaining root access in 30 MINUTES makes the OS entirely unsuitable in a server environment.
True, a Mac Mini isn't typically going to be used as a server, but if Apple decides to make some kind of Intel based server, this kind of thing is a HUGE problem.
Why does the word "astroturf" slowly creep into my waking mind as I read more and more about this bogus contest.
Information wants to be anthropomorphized.
without ssh, how exactly would you propose enabling access to it?
Restrict the ip addresses of the computers that can access the ssh connection. Ah, you'll say, then all the attacker has to do is get access to the computer that is on the allowed ip address list. True, but let's say you are a company with the web server www.verigon.com. That's a nice public target running apache, mysql, php, etc. All the things a good lamp server should run. That's going to be the public target.
If I want to ssh in, I first have to connect to a different box. The thing here is that this ssh box (I'll just call it that to save typing) doesn't have to run anything but the os and ssh, thus lowering the number of software packages that can open a vulnerability. Remember, every daemon you run, every piece of software you install, every service that's enabled is another potential whole. The second part to this is that the ssh box is not a big target. It's dns name may be something like comp-1.it.verigon.com or ideally its name isn't even registered in dns. Either way, the bullseye is going to be on www.verigon.com for the casual cracker. Only someone who is specifically interested in my company is going to try to find a way in. The script kiddies will just see that ssh doesn't respond and go on to the next webserver.
remember though, this is (supposed to be) a *nix we're talking about. local user accounts should not be able to inflict such damage due to better seperation of priviliedges that exist in this world.
But you need to remember that OS X is not designed for remote, multi-user usage. The features are there, but mostly for adminstrative purposes. The machine is first and foremost a Desktop machine that is intended to keep good guys in and bad guys out.
Also keep in mind that it is incredibly difficult to properly configure a Unix system to be completely secure against users with shell accounts. Such security requires a complete system lockdown, complex partitioning, reassignment of services to non-root accounts, jailing of priviledged services (or equivalent), and several other procedures that I sincerely doubt that this guy performed. (In fact, the article confirmed that he could have locked the system down further, but didn't.)
By handing out shell accounts, he might as well have been handing out the root password to his system.
Javascript + Nintendo DSi = DSiCade
Excuse me, but if your OS can be rooted in 30 minutes from a local account, you have no business calling it secure. UNIX is supposed to have multiple local accounts and still be secure with them all running. If you close down every network port on a machine and say "come get me now", that's really not saying much. I, for one, would really like to know how he managed to get root from a local account, so I can verify I don't have the same problem on my server, which really does have ssh access to more than one person.
The safest computer that you can get is one that is not connected to the wall. Then again, it will not be very usefull.
Turning off functionality because of security is not acceptable. It the OS offers certain features, they should be secure, otherwise, they are flawed. Stop apologizing for Apple computer and its defects.
Cheers,
Adolfo
So SSH was on and accessible?
My ISP, Panix, will gladly sell you a shell account. You can SSH into it, or telnet, if you don't care. And yet, they're not rooted every 30 minutes. Or, ever.
If giving someone SSH access is 30 minutes away from giving them root, that's not secure.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
That excuse was bullshit when it was used to defend Windows boxes
That excuse would work for Windows if Windows didn't ship with remote vulnerabilities built-in. Unfortunately, it does. Regularly. Without fail.
When someone can prove that OS X has the same problems (which is pretty difficult with zero open ports, and 2 degrees of separation between attachments and executable code) then I'll jump on the "OS X isn't secure" bandwagon. But for now, it remains far more secure than Windows which can be so easily exploited thanks to the number of services it exposes to the Internet by default, and the ease with which executable files can be disguised as legitimate documents.
Javascript + Nintendo DSi = DSiCade
Then he should put his gpg public key at
http://test.doit.wisc.edu/ and sign and publish on slashdot an invitation to hack this machine to prove that he's the owner of this machine.
k2r
"Would HAVE", not "would OF".
So SSH was on and accessible? Dumb move. Like saying "I dare you to steal my jewelry from my bedroom -- oh, and my house is unlocked with the windows open."
There have been SELinux security competitions that gave out SSH access as root and the boxes remained quite safe. There do exist standards of security which make your standards look remarkable poor and forgiving. Good security does exist, and pretending that it doesn't does not make you any more secure.
Jediiah.
Craft Beer Programming T-shirts
I believe that Mac OS X Server has sshd running by default -- if you think of how it's intended to be used, this is not just a feature, but possibly quite necessary. Setting up a rack of headless servers could be quite a PITA if they didn't have ssh running by default -- you'd have to connect to them over the serial port and turn it on for each machine (or create a custom HD image where it was enabled and load it to each machine).
I think there are probably some also remote-administration services running by default on Server, but don't quote me on that. I know for sure that ssh is not running on regular, consumer MacOS, however. (I just set up a new G5 a few days ago and I had to turn it on manually.)
I think it's also worth pointing out that based on my understanding of the article in question here (the second link in the summary doesn't point to what I think it originally did), ssh wasn't just running on the machine, attackers were allowed to log-in as a non-root user. So really what happened wasn't a cracking in the strict sense, but privilege escalation. Still bad -- and I'm rather annoyed that "gwerdna" or whatever his name was didn't tell us what this great "unpublished and unreported vulnerability" was that he used, but I don't think that it means that any box is compromisable simply by virtue of running sshd.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Considering that the picture of the machine posted on the web site (which now seems to be unavailable) showed it sitting on a shelf next to Windows programming books, I'm guessing that his "blind faith" is in something other than Apple, and his motiviation was to generate the misleading buzz that ZDNet and Cnet are facilitating.