Slashdot Mirror
Apple Patch Released, But Is It Enough?
entenman writes "Apple Computer's security update train rumbled into the station with fixes for a whopping 43 Mac OS X and QuickTime vulnerabilities. The Security Update patches 31 flaws in the Mac OS X, most of them serious enough to cause 'arbitrary code execution attacks.'" Unfortunately, InfoWorldMike writes "InfoWorld.com reports that Independent researcher Tom Ferris said there were still holes in Safari, QuickTime, and iTunes that he reported to Apple but were not patched in the latest release on Thursday. Ferris told InfoWorld he is considering releasing the details of the unpatched holes on May 14 on his Web site. He also says he has found new holes in OS X affecting TIFF format files and BOMArchiver, an application used to compress files. He did not provide details about the flaws or proof of their existence."
and there is debate about whether Apple's shift to the same Intel architecture used by Microsoft Windows will change the security posture of Mac systems.
Let's settle this debate.
No.
Changing CPU architectures will have absolutely effect on security.
Switching to Intel will make it easier for game developers to port their code, which will lead to more games available for the Mac. This, combined with the ability to dual-boot to Windows and eventually the ability to run Windows apps through virtualization, makes the Mac platform more appealing to consumers, which will probably lead to an increase in Apple's market share. This could lead to more malware creators taking an interest in the Mac platform, which would lead to more security holes in Mac OS X being exploited (which is not the same as more security holes existing).
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
I.E Im a giant penis and I would rather expose vulnerabilites that could potentially damage systems rather than wait for the coders at Apple to make sure everything is accounted for and put into a patch that wont effect other things that I didnt forsee.
Its one thing to find holes and tell Apple and people you did, and send the info to Apple. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.
"Slashdot, where telling the truth is overrated but lying is insightful."
What purpose would publishing the details on his site serve, other than as a kind of security vulnerability "first post!" type of thing?
In theory, it's possible that black-hats have already discovered the flaw, and will exploit it without telling anyone. If they've already figured it out, then releasing details to the public won't make the situation significantly worse. However, public embarassment will prompt the company to release a fix more quickly.
I'm not saying I agree with this theory.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
from the updater notes: " When Safari's "Open `safe' files after downloading" option is enabled, archives will be automatically expanded. If the archive contains a symbolic link, the target symlink may be moved to the user's desktop and launched."
OK, second time this "Open 'safe' files is a lie. WHY THE HELL IS THAT OPTION STILL THERE?" I never trusted that open from the moment I first saw the checkbox. I guess that's why they put "safe" in quotes. Buy our "free" product for only $9.95!
Whoever modded you down "Troll" has obviously not heard of sarcasm.
Anyway. The difference between Mac OS X and XP can be summarized thus:
Every time a potential breach of OS X security is discovered, it's front-page headline news on Slashdot.
If a new actual virus or worm comes along for Windows, making it ever more sure that you still can't even put a new Windows box online to download patches until after the patches you need are already installed... it's business as usual.
Windows users concerned about they penis size go on chanting "B B B But that's only because the Mac is less popular, so nobody bothers to write malware for it. Wait until the Mac gets more popular, then you'll be in a world of hurt!!!1!"
Whatever. The Mac is probably never going to see double-digit market share, and even if it does, it's still vastly more secure than Windows is, and you all know it. So there's no need to worry about such a scenario ever happening.
So I use Macs.
If the market dominance of Windows has anything to do with Macs being relatively free of haX0r attention, then I just gotta say to all you stubborn Windows users out there:
Hey man, thanks for taking one for the team.
Information wants to be anthropomorphized.
Considering that there has not been one real, severe, in-the-wild, massively spread, substantial, damage-causing virus in the five year history of Mac OS X, I would say yes, the boys and girls in Cupertino are doing just fine. Thank you very much for all your hard work, and all naysaying columnists and pundits can go screw.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Ferris told InfoWorld he is considering releasing the details of the unpatched holes on May 14 on his Web site.
Apple will then just have to take him to court like they do with everybody else, won't they?
The way I see it, they probably intend on patching the other problems, but they decided to get a decent amount done, and then release the update. Much like how Microsoft's once-a-month releases could give some time for the vulnerabilities to be taken advantage of (I recall that release cycle, I'm not sure if they are still done anymore though), if they waited for all patches to be done in this case, it may have prolonged the wait by quite a bit longer.
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
I think you underestimate the importance of assembly language when coding exploits. There are plenty of crackers out there who know x86 ASM. There are *far* fewer who know PPC ASM.
I think you overestimate the effort required to learn PPC once you know x86. The first assembly language you learn is difficult, especially if it is x86, but for subsequent ones it is far less difficult. After many years of x86 I wrote my first serious PPC code, it beat Apple's MrC compiler quite easily.
"That seems like they are expecting an awful lot from Apple "
Well, Apple *is* advertising their security in their latest ads, so they should have no problems meeting these expectations.
-- "I never gave these stories much credence." - HAL 9000
Perhaps he chose to post AC because anything that goes against groupthink is inevitably modded down? Typically as Troll (Slashdot definition: I disagree with your opinion) or Flamebait (Slashdot definition: I disagree with your opinion)
Slashdot - where whining about luck is the new way to make the world you want.
So 100,000 birds in the hand are worth 20 in the bush?
I mean, note the word "potential". There are thousands of vulnerabilities that have been exploited on Windows, and like 20 potential on Macs, and that's equal? The day you'll trade me 100,000 dollars for a chance at 20 bucks is the day I'll toss my Apple in the trash.
> Its one thing to find holes and tell Apple and people you did, and send the info to Apple. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.
;-)
What do you mean? That he doesn't have the right to disclose what he found? Does his constitutional rights make you sick? Well then I think that YOU are the one with a problem. You should be thanking him for warning Apple. I know many who would have kept it secret and written all kinds of worms just to make fun of fanboys like you, and I guess that's what you're really asking for with your complaints.
Here goes my karma...
Please someone, give me a web address that will install spy/crudware without my consent automaticly, show me how, with no user intervention, an unpatched box can be hacked to hell by spamers to use in botnets in under 2 minutes...show me this or shut the fuck up!
I understand that OSX isnt perfectly secure, it has its bugs, so does BSD as a whole, but the holes get FIXED and not denied for months untill the hole is used to destry hundreds of thousands of PCs.
15 years? Child. Yes in all probability you have been "hacked, rooted, afflicted with spyware, or even infected by a single virus". You just haven't noticed.
It most certainly is possible. I won't go as far as the grandparent, but close. I've never been -harmfully- afflicted by being hacked, rooted, or infected with a virus or spyware. I've almost never run into any of those at all - but once every couple of years something crops up.
I've (very) occasionally caught a virus present on the machine before it was ever executed or did any harm. I've (very) rarely wound up with spyware - but nothing major, and nothing that couldn't either be uninstalled via its own well-behaved uninstaller or removed easily via something like adaware.
Why? Because I don't run or install software if common sense says the source might be shady. The one or two spyware incidents I've had were with semi-legit software - it probably told me in a Eula all about the nasty reporting it wanted to do, and I clicked through - that, as spyware goes, was relatively benign.
Now my old roommate's machine, with the same basic setup, was another story. It was amazing she could move the mouse with all the crap going on in the background from various malware. Different computing use habits, I suppose.
Oh, come on. Even the mighty OpenBSD has had vulnerabilities. It's a little unrealistic to expect every piece of software (or even just the stuff distributed with an OS) to be perfectly secure and bug-free.
Or maybe having an open-source license excuses them from your standards?
Plus, posting exploit information before sending a nice email to the developer is just irresponsible. How would that benefit anyone other than script kiddies?
Uh huh, so lets phrase that a different way... you mention that you caught viruses on the machine before they could execute. Unless you manually check all the instructions before they reach the CPU then this indicates pretty clearly you'd be running virus checking software. You also mention the need to use adaware from time to time.
So to get this straight, you run an operating system that has so many security problems that you need to run at least two other programs just to make sure that you aren't infected by anything. At least one of those programs is an intensive application that has to scan every potentially harmful file before it can be used.
Despite having effectively ended up with a less powerful computer with less memory, and still having to very carefully modify your behaviour while using your computer because of the OS vendors poor security practices you're still defending their operating system (and effectively their reputation). Bizarre.
And people say Apple and Linux fans are zealots.
I agree that people repeat that "security by obscurity doesn't work" without really understanding the concept. I mean, what is a password but an obscured piece of information? Still, the origin of the phrase is attacking the idea that an obscured algorithm will protect you; you have to assume that an attacker will capture one of your en/de-cryption devices, and learn the algorithm.
;)
That being said, I disagree with your assertion that 20 dictionary attacks a day is 20 times more likely to get into an SSH server than 0 dictionary attacks. If your passwords are any good, they won't get in either way.
Yes, your "obscure" port protects you from the dumber automated scripts. That could buy you a little time if a genuine vulnerability shows up in the sshd. But it's only a matter of time before the stupid scripts scan for sshd on other ports.
Then you'll have to switch to port knocking
Eloi, Eloi, lema sabachtani?
www.fogbound.net
Heh, we have yet to encounter even a port scan on our obscure SSH port, let alone any kind of attack, so it's safe to say that script kiddies don't want to spend the time scanning all 65,000 ports on every computer when they can get a similar yield by only harvesting those computers that answer on port 22.
True, especially since it's easier to defend against broad, repeated scans (assuming they don't have a good way of doing it from distributed hosts).
Still, I'd argue your defense isn't as much one of obscurity as it is one of heterogeneity. If everyone ran sshd on a different port, the attack vectors would be different.
t's also probably safe to assume that if someone has the intelligence to change the port that SSH is listening on that they are also clever enough to keep it up to date and securely configured.
I wasn't suggesting that you weren't keeping your sshd up to date. I was thinking more along the lines of a 0-day exploit kind of situation. The first attack scripts will go for the easy targets.
Which kind of brings me full circle. Obscurity, in this case, is more a means to heterogeneity. One powerful way of being secure is just being a little more difficult a target than the next guy. Burglars will go to the house without a dog (or without an alarm system). Sure, a determined burglar will still be able to get into a protected house, but why bother? As the marketing folks say, they'll go for the low hanging fruit.
That is, unless the fruit you're protecting is really, really juicy.
OK, I've mangled enough metaphors to traumatize an entire English Department, so I'd best stop here.
Unfortunately the soft pink human underbelly of your network is the most glaring weak point for attackers targetting your systems, and we can't really firewall their voice-boxes and fingers if we expect to keep doing business.
I often think security would be so easy if we just didn't have those darn users...
Eloi, Eloi, lema sabachtani?
www.fogbound.net
I think it's also important to keep in mind whether people are talking about "theoretical" security, or "practical" security. Theorists are concerned with being impenitrable by nature, with as few secrets on your part as possible -- the assumption being that the spread of information is inevitable. In this view, obscurity is only a short-term, O(1), solution.
Of course, we all know there's a big difference between theory and practice... I agree that obscurity is a valuable tool in the arsenal, but it's only a bandaid compared to the theory side of things... obscurity may protect you against the common script kiddie nuisance, but you need theory to protect you against the professional cracker, which is the real danger to whatever you're trying to protect.
From that perspective, one could argue it's better to let the script kiddies bang on your system to ensure it's secure. If they do get through, the worst you get is a spambot or some other relatively obvious, but minor, mess to clean up, and you know you've got a hole to fix. But if you left that unknown hole sitting around, when the real cracker comes, he's going after your corporate business plans and new prototypes, and he's probably not going to be as obvious about it... which leaves you in for a surprise when your competitors beat you to market with a cheap copy of what you've been working on, costing you far more than the script kiddie cleanup ever would. Just a thought.