Apple Responds to MOAB

frdmfghtr writes "Apple has released what appears to be the first security update as a result of the "Month of Apple Bugs." While the Apple site doesn't explicitly say that the fix was a result of the MOAB, it does point to a sample Quicktime file that triggers the overflow flaw (well, sort of...it says the file is there but doesn't provide any links)."

Comments

MOAB?

[Southpaw018]

First thing I thought of was this.

Re:MOAB?

[nycsubway]

As did I. I think a "Massive Ordinance Air Blast" is a lot more interesting than an Apple bug fix too :)

Re:MOAB?

[Yuioup]

I still chuckle at the irony that Bush & Co were self-righteously proclaiming that Saddam secretly was developing WMD's and then all of a sudden they turn around and announce "Hey everybody! Check out our new weapon! It's the MOTHER of ALL BOMBS!!!"

MOAB == WMD.

Y

Re:MOAB?

[Penguinisto]

Could be worse... all this time I kept thinking that Apple somehow added Detroit Lockers and a new set of leaf springs to its Macs in response to Moab...

(Guess that's what I get for living in Utah and owning a Jeep...)

/P

Re:MOAB?

[Pojut]

Just popped in front and rear along with some 5.13 gearing in our '79 FJ-40 :-)

Re:MOAB?

[djh101010]

"Hey everybody! Check out our new weapon! It's the MOTHER of ALL BOMBS!!!"

MOAB == WMD.

Y Um, no. WMD has been defined, for quite some time, as chemical, nuclear, and biological weapons. But by all means, do carry on.

Re:MOAB?

[xoyoyo]

On the contrary the MOAB fits no common definition of WMD. It would cause extensive civilian casualties if dropped in a city, but so would the equivalent amount of explosive dropped as many separate bombs. So would a sufficient quantity of golf balls.

What it is is something not legislated against but still fairly unpleasant: a terror weapon designed to cow civilian populations. The MOAB is ineffective in its supposed role (that of a bunker buster) but it's extremely good at scaring the shit out of civilian populations it's dropped near. Its blast signature (big flash, big boom, mushroom cloud) is identical to a nuke.

The US airforce conducted a legal review of the Moab and decided (perhaps unsurprisingly) that it was okay to use it so long as civilians weren't deliberately targeted.

On the other hand, other US weapon systems such as cluster bombs, bunker buster nukes and white phosphorus based weapons flirt with the definition of WMD, not to mention the c.6,000 nuclear warheads...

Re:MOAB?

[Mister Whirly]

WMD or not it will still ruin your day if one drops on you.

I know my last thought at seeing one coming for me would be "Well thank god I'm not being killed by a WMD or it would sure be tragic!"

Re:MOAB?

[vbjay]

What chance does a little apple have against a MOAB?

Re:MOAB?

[Agram]

Well for all intents and purposes the Month of Apple Bugs was to Apple security claim pretty much what your MOAB is to those poor trees. Hate to break it to you ladies and gentlemen, but there is no such thing as bug-free/secure OS. Not Linux, not OS X, and definitely not Windows. The bottom line is that the system is only as secure as its user makes it. What in this case made Month of Apple Bugs so disrupting was not that Apple's OS is insecure (at least not any more than any other OS), but rather the fact that Apple's own hype has painted them in a corner, making this an inevitable "discovery" of something that has been known all along.

Doom B

[bryan1945]

Day of obvious Microsoft Bugs?

Sorry, couldn't resist.

Re:Doom B

[Anonymous Coward]

I actually read "Apple Responds to Microsoft", because, you know... Microsoft *IS* the Mother Of All Bugs.

Re:Doom B

[Anonymous Coward]

More like: Decade of obvious Microsoft Bugs.

So...Is The QT Flaw the Only Notable Bug?

[CheeseburgerBrown]

I haven't heard much coverage on the MOAB since the QuickTime revelation -- haven't they dug up any further baloney in the OS or its core of Jobsian iApps?

If the highlight of the month is the damn QuickTime thing, this has worked out to be a fairly dull bug hunt. The submitter should've at least linked up the MOAB reference with some supporting fun.

Also: is Steve Jobs technically a bug or a feature?

Re:So...Is The QT Flaw the Only Notable Bug?

[qwertphobia]

No, it's still going strong.
http://projects.info-pull.com/moab/
One could argue the significance of each bug, but I would say the quantity is not lacking. I was sure I would see a few days or a week, but it looks like there has been a total of 23 when I visited the site.

I'd have to say Steve Jobs is a core daemon :-)

Re:So...Is The QT Flaw the Only Notable Bug?

[solevita]

Also: is Steve Jobs technically a bug or a feature?

I'm told he's the irreplaceable core of Apple inc, so I guess he's neither a bug nor a feature; he's Apple's Internet Explorer.

Re:So...Is The QT Flaw the Only Notable Bug?

[sokoban]

No, this isn't the only bug, nor is it the most serious.

There are remote code execution and escalation of privileges bugs that are still yet to be fixed, but at least it appears that these bugs are being taken seriously and will hopefully be fixed.

There are all sorts of people trying to find bugs in Linux and Windows, but not nearly as many people are doing so for OS X. As a Mac user, I am glad someone is doing this now and finding these bugs and exposing them to the public and to Apple before there are exploits out in the wild.

Re:So...Is The QT Flaw the Only Notable Bug?

[OrangeCowHide]

They have VLC and OmniWeb in the list though. As these are not directly Apple bugs, I would have to lower the number to 21. I mean once you start allowing third party software in the list, you may as well start including every OSS application that contains bugs too.

#include <stdio.h>
#include <string.h>

int main (int argc, char **argv)
{
char buffer[10];

strcpy (buffer, argv[1]);
printf ("buffer - %s\n", buffer);

return 0;
}

I just built this on my mac, so I guess there's another buffer overflow bug for Apple.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

I haven't heard much coverage on the MOAB since the QuickTime revelation -- haven't they dug up any further baloney in the OS or its core of Jobsian iApps?

They've revealed a number of potentially exploitable bugs, although nothing to really worry about right away, and a number more third party bugs that have little or nothing to do with Apple.

If the highlight of the month is the damn QuickTime thing, this has worked out to be a fairly dull bug hunt.

The most interesting thing to come out of this so far is actually a third party bug in Colloquy, a popular IRC client. The bug itself is not all that novel, but the explanation of the bug that the MOAB team allegedly, originally posted showed them using the vulnerability to hack users on the popular #macdev on Freenode IRC. Basically, many people are claiming they posted a log of them not only behaving unethically, but illegally before even announcing the vunlerability. The explanation of the bug they now post no longer contains that log. For more information check out the article and the accompanying forums.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

They have VLC and OmniWeb in the list though. As these are not directly Apple bugs, I would have to lower the number to 21.

They also have Transmit, Rumpus, Colloquy, APE, and the PDF spec listed, none of which Apple wrote (although Apple did write an implementation of the last). To be generous, you'll have to drop the number to 17.

Re:So...Is The QT Flaw the Only Notable Bug?

[powerlord]

I'm told he's the irreplaceable core of Apple inc, so I guess he's neither a bug nor a feature; he's Apple's Internet Explorer.

So what you're saying is, you don't want to use him all the time, otherwise you'll end up in a world of hurt, but every now and then there is a site you just have to trot him out for?

Oh ... like ... say the MacWorld Keynote? :)

Re:So...Is The QT Flaw the Only Notable Bug?

[solevita]

I like it! But, I was also thinking that he suffers from exploitable (pancreatic) overflows.

Bye bye karma...

Re:So...Is The QT Flaw the Only Notable Bug?

[OrangeCowHide]

You're correct. I was just looking at the titles and was only able to identify the third party applications I have used. I just read the in-depth analysis of the PDF bug, and among the Apple viewers affected is xpdf, so I guess they are using OSS as a gauge.
Now, I should point out that I don't believe that if they spent the time on it they couldn't find 30/31 significant (or semi-significant) bugs in the primary OSX distribution. But they are cutting a few corners to meet their objectives.

Re:So...Is The QT Flaw the Only Notable Bug?

[Kadin2048]

Maybe he just needs a sandbox to play in?

Re:So...Is The QT Flaw the Only Notable Bug?

[Warlock7]

You might want to discount the QuickDraw bug to. I don't think that OS X uses QuickDraw at all, I believe that's fundamentally an OS 9 item, which is no longer a supported OS.

Note: The QuickDraw API is deprecated in Mac OS X v10.4. That means that Apple no longer plans to develop QuickDraw software or documentation. There is no better time than now to completely remove QuickDraw code from your application.

So, you might want to shorten the list again. You'd have to remove MOAB-23-01-2007 - the "Apple QuickDraw GetSrcBits32ARGB() Memory Corruption Vulnerability".

I suppose that you could leave it on the list, as this is an Apple bug, but to include a deprecated API call makes me wonder.

Re:So...Is The QT Flaw the Only Notable Bug?

[Warlock7]

Actually, you'd have to add the MOAB-14-01-2007 item "AppleTalk ATPsndrsp() Heap Buffer Overflow Vulnerability", as AppleTalk is deprecated too...

Most Open Transport calls have finally been deprecated in OS 10.4.

Re:So...Is The QT Flaw the Only Notable Bug?

[Trillan]

Now that's a news flash, huh? "Black hat hackers act like black hats!"

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

There are all sorts of people trying to find bugs in Linux and Windows, but not nearly as many people are doing so for OS X.

I'm not sure how true this is. Apple is doing audits for security internally, and a lot of security researchers have informally looked into OS X bugs with security implications as well. There are a lot of security people using OS X laptops these days (judging by their omnipresence at conventions the last few years), and they notice things and are interested and motivated.

As a Mac user, I am glad someone is doing this now and finding these bugs and exposing them to the public and to Apple before there are exploits out in the wild.

A lot of what this project is doing applies to very few users. Oddball, uncommon applications, deprecated features used for classic, etc. and for the rest their methods are wholly irresponsible. If I wanted to get a worm created for OS X, without getting my own hands dirty, I'd go about it much like this project. Find potentially wormable vulnerabilities and release them without prior notification to the vendor spaced out over time so that a regular QA/Dev cycle could not get them all unless it waited a whole month.

I'm all about promoting more security researchers to have a go at OS X. Apple should offer a bounty on bugs that could potentially be used for remote exploits. That doesn't make me any more ready put up with the kind of nonsense these researchers are pulling.

Re:So...Is The QT Flaw the Only Notable Bug?

[Anonymous Coward]

Do you think these people have a monopoly on finding bugs? Once OS X gets enough market share to be worthwhile to blackhats you're going to see a lot worse. If you think researchers releasing bugs to the public without waiting for the vendor to patch is bad then you really won't like it when someone discovers a vulnerability and uses it to create a worm themselves or sells it to someone else that will. This is only a taste of things to come.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

Do you think these people have a monopoly on finding bugs?

What people? Security researchers?

Once OS X gets enough market share to be worthwhile to blackhats you're going to see a lot worse.

OS X has enough market share and other features to motivate people to exploit it now, it just has not had enough to motivate people hard enough to get past the difficulties involved. There is also no guarantee that OS X's market share will increase or that it will become more attractive to hackers at a rate that is greater than it becoming more difficult to exploit.

If you think researchers releasing bugs to the public without waiting for the vendor to patch is bad then you really won't like it when someone discovers a vulnerability and uses it to create a worm themselves or sells it to someone else that will. This is only a taste of things to come.

Yeah, creating a zero-day worm is worse than just releasing the bugs in such a way as to make it more likely that someone else will create a worm. What is your point?

Re:So...Is The QT Flaw the Only Notable Bug?

[tim1724]

Yes, QuickDraw is deprecated. But it's still used by quite a bit of common software. (Such as MS Office, or nearly anything from Adobe.)

Re:So...Is The QT Flaw the Only Notable Bug?

[Anonymous Coward]

What people? Security researchers?

The people you're complaining about. The people running MoAB.

OS X has enough market share and other features to motivate people to exploit it now, it just has not had enough to motivate people hard enough to get past the difficulties involved. There is also no guarantee that OS X's market share will increase or that it will become more attractive to hackers at a rate that is greater than it becoming more difficult to exploit.

You're contradicting yourself, "they're motivated but they're not motivated enough". Ok.. that doesn't make sense. Any way you want to spin it, OS X doesn't have enough market share to be worth it. OS X may be more secure than insert-other-OS-here but it's still going to have bugs and there will be people there to exploit them. You better have contingency plan.

Yeah, creating a zero-day worm is worse than just releasing the bugs in such a way as to make it more likely that someone else will create a worm. What is your point?

I'm trying to figure out your point. You're complaining about something uncontrollable as if it matters. The important thing is how Apple responds to bugs not complaining about how 3rd parties disclose those bugs. It's offtopic and it seems like just another fanboy putting his own personal RDF spin on things. Your ad hominem attacks against MoAB have nothing to do with whether or not these vulnerabilities exist and how Apple handles fixing them. That's what's important.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

The people you're complaining about. The people running MoAB.

I described several groups of people looking for security holes in OS X and you ask me if I think the MOAB people have a monopoly on looking for security holes in OS X? I'm going to say, "no" and wonder what you're smoking.

You're contradicting yourself, "they're motivated but they're not motivated enough". Ok.. that doesn't make sense.

Are you motivated to get $1000? Are you motivated enough to pick it up off the sidewalk if you see it? Are you motivated enough to saw off both your legs with a hacksaw if someone will give $1000 to you?

With OS X there is motivation, but since the task is more difficult for a variety of reasons, people with motivation exploit something else that is not as hard.

Any way you want to spin it, OS X doesn't have enough market share to be worth it.

The additional market share that can be exploited on OS X by adding a zero day exploit to a multi-vector worm is greater than adding most windows exploit vectors. In addition, those machines are more likely to contain certain valuable data commodities and a great deal more notoriety and recognition is possible. Assuming that market share tells the entire story is misguided.

OS X may be more secure than insert-other-OS-here but it's still going to have bugs and there will be people there to exploit them.

Again, what is your point and what does this have to do with anything? How does this particular project help that situation?

I'm trying to figure out your point. You're complaining about something uncontrollable as if it matters.

My points are very simple. I'm not convinced that there is less security research into OS X than Linux and Windows. The MOAB project is being run in a very unprofessional and irresponsible way and is obviously not being conducted by researchers who should be trusted. Further, due to their methods, they are doing more harm to overall security than good.

The important thing is how Apple responds to bugs not complaining about how 3rd parties disclose those bugs. It's offtopic and it seems like just another fanboy putting his own personal RDF spin on things.

You think it's off topic to discuss the methods of a third party in a discussion about Apple's response to that third party? Have you ever thought that the way in which bugs are submitted and publicized has a lot to do with how Apple will respond to them? You're really reaching here.

Your ad hominem attacks against MoAB...

Do you even know what ad hominem attacks are? I discussed what the MOAB people were doing that was wrong, not who they are. Please go reread a book on the rhetorical method.

...have nothing to do with whether or not these vulnerabilities exist and how Apple handles fixing them.

Of course the vulnerabilities exist. That's not an issue. The point being discussed was how Apple has and should respond to disclosure that is designed to make them worse than they would be with a responsible disclosure method. Apple will fix them the same way they always do, they look at the problem, fix, it test, and roll it into the next patch. What other options do they have. Just because the MOAB people intentionally spread them out so this process will leave longer windows of vulnerability, there is not really anything else Apple can do, aside from criticize them for their methods.

Re:So...Is The QT Flaw the Only Notable Bug?

[nathanh]

They have VLC and OmniWeb in the list though

The bug was demonstrated with OmniWeb but the bug is actually in WebKit, which is written by Apple. From the details for the OmniWeb exploit:

"Note that it's actually breaking WebKit, although Safari seems unaffected by this particular issue. See "Exploitation conditions" for other information related to exploitation techniques."

I'd say that one is purely Apple's problem even though people are associating it with OmniWeb.

Re:So...Is The QT Flaw the Only Notable Bug?

[OrangeCowHide]

The bug was demonstrated with OmniWeb but the bug is actually in WebKit, which is written by Apple. From the details for the OmniWeb exploit:

"Note that it's actually breaking WebKit, although Safari seems unaffected by this particular issue. See "Exploitation conditions" for other information related to exploitation techniques." I'd say that one is purely Apple's problem even though people are associating it with OmniWeb.

okay, I looked at this bug now (again, they were clarifying it as a OmniWeb bug is why I listed it). It appears that the bug is entirely OmniWeb. This is based on the fact that the Safari does not demonstrate similar behavior. Ultimately, this manages to get an invalid format string into vfprintf. It is not uncommon for a library to allow you to use it incorrectly and basically say it is the caller's fault for giving bad parameters (which is what I see happening here). That doesn't make the library bad, most versions of libc will gladly let you call strcmp () with null arguments and try to dereference without checking first. Does that make the bug in libc or in the code that called it with invalid arguments.

I have done a lot of work in NSAPI and I admit I get irritated that the library is so full of functions that take buffers without sizes (just looking for a buffer overflow), but they are using the same argument. The buffer provided has to be no smaller than vaguely documented size. What is the point of this paragraph you ask? Essentially, that while I can argue that the I like my libraries to have bounds checking built into them, I accept the fact that the library user is responsible for using the library correctly.

Re:So...Is The QT Flaw the Only Notable Bug?

[jagilbertvt]

Of course they didn't release an update for the Windows version of QT.

Re:So...Is The QT Flaw the Only Notable Bug?

[Anonymous Coward]

A lot of what this project is doing applies to very few users. Oddball, uncommon applications, deprecated features used for classic, etc. and for the rest their methods are wholly irresponsible.

I described several groups of people looking for security holes in OS X and you ask me if I think the MOAB people have a monopoly on looking for security holes in OS X? I'm going to say, "no" and wonder what you're smoking.

This is where you specifically mentioned MoAB and this is what I'm calling you out on. You obviously don't get it. You bitch about people being immature WHEN IT HAS NO BEARING ON THIS DISCUSSION. Except you'd rather whine about MoAB disclosing bugs instead of facing the real problem, BUGGY SOFTWARE.

The MOAB project is being run in a very unprofessional and irresponsible way and is obviously not being conducted by researchers who should be trusted. Further, due to their methods, they are doing more harm to overall security than good.

So what? Your personal opinion about how MoAB is being run doesn't enter in to it. So you're biased against public disclosure without giving vendors time to patch. Why does anyone care what you think?

Do you even know what ad hominem attacks are? I discussed what the MOAB people were doing that was wrong, not who they are. Please go reread a book on the rhetorical method.

If you're implying that because MoAB releases vulnerabilities publicly that their research is tainted or invalid then yes it's ad hominem.

Of course the vulnerabilities exist. That's not an issue.

Exactly. So, STFU whining about MoAB and how bugs are disclosed. Bugs happen, doesn't matter how or why, you can't control it, deal with it. Apple needs to be more open about bugs instead of hiding them and pretending they never existed once they're fixed.

Re:So...Is The QT Flaw the Only Notable Bug?

[Warlock7]

Hopefully they'll follow the direction of the ADC (Apple Developers Connection) and remove any reference to those deprecated function calls.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

This is where you specifically mentioned MoAB and this is what I'm calling you out on.

So you asked a question I had already answered to "call me out." That is empty rhetoric. Please actually stick to the points at hand. If you have a statement make it. If you have a real question ask it.

You obviously don't get it.

If "it" is your point, no, I don't. Why don't you state it in plain English instead of asking rhetorical questions?

You bitch about people being immature WHEN IT HAS NO BEARING ON THIS DISCUSSION.

Maybe if you're going to use so many caps, it should be in regard to something I actually did say. I never used the term "immature" anywhere in my comments. I called the researchers irresponsible, which they are. That was a large part of the point of this thread. Saying it as no bearing on the discussion is being obtuse. You asked me what the points I was making were, and now you claim a different point, one I never made, has no bearing on this discussion? Well, you're right, but you are the on who brought it up, not me.

Except you'd rather whine about MoAB disclosing bugs instead of facing the real problem, BUGGY SOFTWARE.

Gee, there are bugs in software huh? And the MOAB project is going to fix that? Get real. Have you ever done commercial software development?

Your personal opinion about how MoAB is being run doesn't enter in to it.

I was responding to statements about whether they were an overall positive or negative influence on security. How they conduct themselves and the actions they take is the only way to determine that genius.

So you're biased against public disclosure without giving vendors time to patch.

Can you see the irony of this statement? I state that a method is irresponsible and you label me "biased against it." You should get a job with Fox news.

Why does anyone care what you think?

Because I'm intelligent, informed, and experienced. Maybe you've noticed how many people agree with that based upon that fact that half my comments in this article are modded to +5.

If you're implying that because MoAB releases vulnerabilities publicly that their research is tainted or invalid then yes it's ad hominem.

But I never did imply that. I said they are likely decreasing overall security. The bugs they find are obviously real. That doesn't mean the project has a net positive influence.

So, STFU whining about MoAB and how bugs are disclosed. Bugs happen, doesn't matter how or why, you can't control it, deal with it.

I see, so the point to which I responded was irrelevant. Umm, kinda defeats the purpose of making it in the first place. If you're the same Anonymous coward, just admit you were wrong. If you're a different one, you're off topic or an idiot.

Apple needs to be more open about bugs instead of hiding them and pretending they never existed once they're fixed.

Apple does need to be more open about bugs and they sometimes don't seem to provide feedback to bug reporters fast enough, although other times they are very quick to respond. That, however, has no bearing on the discussion at hand, where we were talking about the MOAB people's influence on security, not Apple's.

Re:So...Is The QT Flaw the Only Notable Bug?

[LittleGuy]

Of course they didn't release an update for the Windows version of QT.

They say the update is through Apple Software Update, and to reinstall QT if you didn't put it on originally.

Funny, when I do ask it to update, I get an offer for iTunes 7.0.2. No patch.

Re:So...Is The QT Flaw the Only Notable Bug?

[Anonymous Coward]

So you asked a question I had already answered to "call me out." That is empty rhetoric. Please actually stick to the points at hand. If you have a statement make it. If you have a real question ask it.

No, I asked you if you think MoAB is the only group that can release bugs. You did not previously answer that. It is not rhetoric. Please back away from the straw man.

If "it" is your point, no, I don't. Why don't you state it in plain English instead of asking rhetorical questions?

Again just because you fail at reading comprehension doesn't mean it's rhetoric. I should have known you can't turn off the RDF long enough for reason to get through.

Maybe if you're going to use so many caps, it should be in regard to something I actually did say.

That's what quotes are for. I use caps for emphasis like everyone else. I'm not sure why you pulled that out of your ass. I guess that's the best you can come up with.

Gee, there are bugs in software huh? And the MOAB project is going to fix that? Get real. Have you ever done commercial software development?

Please quote where I said MoAB was ever going to fix bugs? You berate me and claim I put words in your mouth and spout rhetoric yet.. here you are doing exactly that. Weird.

I was responding to statements about whether they were an overall positive or negative influence on security. How they conduct themselves and the actions they take is the only way to determine that genius.

You weren't responding to those statements every time you whined about MoAB. You've done it in several posts. Not all of them are on-topic and all but 1 is definitely redundant.

Because I'm intelligent, informed, and experienced. Maybe you've noticed how many people agree with that based upon that fact that half my comments in this article are modded to +5.

Haha, karma whore. Ok I jumped ahead and I'm going to have to cut it short. I can't stop laughing. Looking at your profile I see it is confirmed. You'll do anything for a little recognition won't you? What a sad life you lead. You'll say and twist anything to never admit you're wrong. Pretty pathetic. Each response you make gets more vague and off-topic. You're just another Mac apologist sucking Jobs dick for a pat on the back. I was also a mod that modded your ass back down but I felt like calling you out for being an empty headed brandwhore since nobody else has the balls to do it. It was rather funny how you actually made a post to complain about being modded down. "Wahhh mod abuse! Why can't I parrot rumors and gossip to shine a negative light on MoAB!" Don't act like everyone thinks you're king shit because you got a couple of +5 mods.

To sum it up, you complain about MoAB to bring the attention away from Mac's shitty security. You'll do anything to twist it so that you can feel safe and protected. You're a fool and getting other fools to mod you up doesn't change that.

You're just a whiny cunt with nothing to add to the discussion. Boo hoo people are releasing bugs instead of sucking vendor cock and waiting several months for them to actually fix bugs. Boo hoo life isn't fair. Deal with it.

Re:So...Is The QT Flaw the Only Notable Bug?

[99BottlesOfBeerInMyF]

No, I asked you if you think MoAB is the only group that can release bugs. You did not previously answer that. It is not rhetoric. Please back away from the straw man.

In response to a comment about who was finding bugs in OS X I wrote, "Apple is doing audits for security internally, and a lot of security researchers have informally looked into OS X bugs with security implications as well. There are a lot of security people using OS X laptops these days (judging by their omnipresence at conventions the last few years), and they notice things and are interested and motivated." Then you asked, "Do you think these people have a monopoly on finding bugs?" and claimed by "these people" you meant the MOAB people. One of the nice things about this whole forum thing is it is all there to read and your claims about what was said are easily disproved. Your statement was rhetorical or you simply can't read properly.

Again just because you fail at reading comprehension doesn't mean it's rhetoric.

Way to avoid a request for you to state your point clearly. See above.

Please quote where I said MoAB was ever going to fix bugs?

We were discussing how MOAB could improve security. If MOAB does not result in bugs being fixed, how exactly is it helping?

You know I don't know why I'm even bothering to answer your stupidity. There are plenty of people here with a clue, or who can at least respond to what was written instead of spouting nonsense and trying to make crap up. If you're a troll, good job and go to hell. If not, go take your meds. I'm not even going to finish reading your post. Ta-ta.

ummm

[Kyro]

from the linked apple release: " A QTL file that triggers this issue has been published on the Month of Apple Bugs web site (MOAB-01-01-2007). This update addresses the issue by performing additional validation of RTSP URLs."

is that not explicit enough??

Re:ummm

[DLG]

Yeah, it is hard to accuse Apple of dodging the project by explicitly highlighting their 'contribution'. I wonder what the author wanted to see.

"Oh Noez, W3 WUZ PWNED by the MO@B Kr3w!!!!"

Really pretty respectful to simply describe the bug, and describe the exploit that is specifically focussed on that bug, pointing the the source of it.

I think that MOAB did focus attention on some real issues although they had to stretch out some issues to multiple days (several DMG file structure errors which essentially were DOS at worst (a corrupt file shouldn't cause crashes it is true, but that can be one day worth of bugs since the fix is essentially 'validate file more effectively before loading it')

As far as the questions about things like diskutil restoring permissions on files that have lost their SUID bits due to being modified, thats a solid issue, although diskutil is run by administrative account from what I recall, and really points back to the question of how do you avoid having someone with an account on a machine they have in their home or office from getting root access, and then not doing stupid things to their machine. Basicly the same can be said about any system that allows someone root access. There is no OS that can stop SU from fraking things up as far as I know.

Anyway, I think the real truth is that there are no great showstoppers. Omniweb closed their security flaw the day it was released (and wondered why they couldn't have been contacted prior to the publicity. Any argument that 'Apple ignores bug reports' sort of goes to hell when talking about third party software issued). Even worse was day two's focus on VLC a project that has less relevance on Apple's OS than it does in the Linux world. I think they should have focused on things Apple needed to fix, rather than things that break on Apples, just like they break everywhere, without Apple having much to do with it at all, nor any real influence on the developers. I mean technically you could put any Window security issue into the Apple MOAB since Windows apps run on Macs these days. Is that helpful? Not really.

So I would say that Apple has shown a willingness to respond to a bug report, I have not really seen them creating negative press against the MOAB folks, and there hasn't really been a showstopper that was strong enough to get mainstream press.

Re:ummm

[frdmfghtr]

Yeah, it is hard to accuse Apple of dodging the project by explicitly highlighting their 'contribution'. I wonder what the author wanted to see.

I expected to see an acknowledgment along the lines of "Thanks to the MOAB team for alerting Apple of this flaw in Quicktime." For all we know, Apple already knew about it and fixed it without any help from the MOAB effort. Even Microsoft acknowledges outside efforts that uncover flaws in Microsoft products.

Re:ummm

[99BottlesOfBeerInMyF]

I expected to see an acknowledgment along the lines of "Thanks to the MOAB team for alerting Apple of this flaw in Quicktime." For all we know, Apple already knew about it and fixed it without any help from the MOAB effort. Even Microsoft acknowledges outside efforts that uncover flaws in Microsoft products.

Apple acknowledges contributions from users who report bugs to them. Just read any of their security patches and about half the items are attributed to a bug reporter outside the company. The question is, did the MOAB really report this bug to Apple as they strongly implied? We know they did not report the bug to the OmniGroup team, since their CEO went on record saying they found out about it from someone who say the MOAB site.

If I were Apple I wouldn't give these guys credit at all, seeing as they are behaving unethically and irresponsibly. Giving them press just encourages others to behave like this.

Re:ummm

[DLG]

I don't know that people posting exploits on a public site, and making press releases about it is the same as reporting bugs to a developer. I mean I am sure there are many people who have posted messages about exploiting bugs in some way in many forums, but mostly they aren't technically reporting those bugs to the developer. In the case of MOAB they explicitly have stated they were NOT reporting the bugs to the Apple, but were doing it a different way to force Apple to respond differently than their normal process. Now you accuse Apple of not treating this with their normal process.

Perhaps your expectations are the part that needs patching.

Re:ummm

[RAMMS EIN]

Well, on the web we have this thing called hyperlinks. The great thing about hyperlinks is that the allow you to quickly go to the place they point to, rather than having to look through a pile of sites to find the one that matches the one referred to in the text you were reading.

Of course, that all falls on the floor if you don't actually _use_ hyperlinks. So no, just mentioning the source in plain text is not enough.

Re:ummm

[frdmfghtr]

Well, another security fix was released today, and Apple did acknowledge LMH for reporting it:

http://docs.info.apple.com/article.html?artnum=305 031

Cue the Iraqi Information Minister....

[bmajik]

I speak the truth! There are No Bugs In The Macintosh! Those whom you have heard saying there are bugs? Where are they now? They are not in the Macintosh. They are roasting in the stomach of the Jobs.

Even if there were Bugs in the Mac OS, the infidels would not find them. We would know about them first and Fix them forthwright. They will never defeat us for 1000 generations.

We welcome the discovery of bugs in the Macintosh! We have set a trap for them and when they fall into it, we will be victorious, Jobs willing! We will ensnare them with the traps we have set and will cast them out of the kernel and back to where they came from!

Re:Cue the Iraqi Information Minister....

[Anonymous Coward]

I speak the truth! There are No Bugs In The Macintosh! Those whom you have heard saying there are bugs? Where are they now? They are not in the Macintosh. They are roasting in the stomach of the Jobs.

Even if there were Bugs in the Mac OS, the infidels would not find them. We would know about them first and Fix them forthwright. They will never defeat us for 1000 generations.

We welcome the discovery of bugs in the Macintosh! We have set a trap for them and when they fall into it, we will be victorious, Jobs willing! We will ensnare them with the traps we have set and will cast them out of the kernel and back to where they came from!

Flamebait? Give me a break. This is very creative and funny satire. I got a good laugh.

Thank you for the good chuckle bmajik, humour brightens everyone's day. (well except for the killjoy moderators around here...)

Overflow

[jrwr00]

OH NOES! The dam is about to overflow! RUN FOR YOU APPLES!

Silly Crackers...

[Anonymous Coward]

They've succeeded in furthering the silly notion that OSX is more secure. :( Here we have 20 some odd bugs and not a SINGLE disastrous outbreak among OSX computers. Will someone please find the ball and GET ON IT?!? Maybe they'll have some amazingly earth shattering ones towards the end of the month.

If this little act of theirs doesn't result in a major worm/virus outbreak, then that means that even if you SHOW people how to break the system they still can't, again furthering the notion that OSX is somehow more secure than Windows!!

Re:Silly Crackers...

[IamTheRealMike]

They said one of the exploits was reported to them as a Zero-Day which is in fact being exploited by a malicious self-encrypting program (if you can call xord strings self-encrypting). So it seems there has indeed been an "outbreak".

Viruses

[Anonymous Coward]

Quicktime is right up there with Realplayer. They are both viruses of the worst kind.

As much as I hate Flash, at least they have the decency not to take over your computer.

Re:Viruses

[Anonymous Coward]

... and I'm sure that the fact that I have been running the same windows installation (which never crashes) for over five years is not unrelated to having never installed Quicktime, Realplayer or Norton after having observed how they mangle and corrupt a windows install on other people's machines.

Want a stable Windows install? Never install Norton, Quicktime or Realplayer. It's a fact.

iTunes? Wouldn't touch it with a ten foot pole...

Infidel!

[Anonymous Coward]

...Jobs willing!...

How dare you speak His name! HE is whom who we may never speak thy name!

Praise be the co-creator!

Why the propensity to acronyms genetic?

[Jzor]

What is it with the human race and creating an acronym for every damn thing?

Re:Why the propensity to acronyms genetic?

[Anonymous Coward]

makes you sound less DUM!!!

Desktop Unified Messaging?
Database Upgrade Manual?

Re:Why the propensity to acronyms genetic?

[Anonymous Coward]

What is it with the human race and creating an acronym for every damn thing?

Ah, you mean the WIIWTHRACAAFEDT effect?

Re:Why the propensity to acronyms genetic?

[Conanymous Award]

(Offtopic, but who (besides some disgruntled mod) cares...)

Acronyms and product names like XY6342w are not a 'human' thing. It's an engineer/geek thing. In fact I was thinking about this today: part of the success of the iPod, for example, could be thanks to its simple, memorable name. It really stands out in the myriad of alphabetic-numerically named 'generic' MP3 players. I'm sure the iPod would still be quite succesful if it was called Apple MP3Player E3807-92i, but that kind of names just aren't nice or 'sexy'. Real word names just hit home harder. (OK, somebody could argue that 'iPod' is not a real word, but I don't care. ;P)

Re:Why the propensity to acronyms genetic?

[sigzero]

FIIK

Re:Why the propensity to acronyms genetic?

[Anonymous Coward]

It's not the human race, it's american tradition, or laziness, depending on who you ask.

Re:Why the propensity to acronyms genetic?

[Anonymous Coward]

What is it with the human race and creating an acronym for every damn thing?

It's in their DNA.

Response

[99BottlesOfBeerInMyF]

So what is the proper response to the MOAB people? They are revealing real bugs, some of which could be exploitable. Ignoring them leads to decreased security. At the same time they have behaved very irresponsibly with regard to those bugs they have found, not notifying the vendor and providing time to fix before publication, nor following the route of immediate disclosure, the MOAB people seem to think it is all right to sit on bugs they find until the most convenient time for them to gain publicity. Worse, they intentionally space out the publication of the bugs, making a Dev/QA cycle to fix them have to wait till the end or commit to missing some. As such they have maximized the time of exposure for these bugs which encourages worms by giving malware authors as much time as possible.

Obviously increasing the security of end users is not the top priority. Accurately informing the public does not also seem to be their top concern since they named their project "Month of Apple Bugs" while many of the bugs they've announced are in third-part code (some of it cross-platform) that has nothing to do with Apple. It seems to me all they care about is publicity and sensationalizing themselves in the hope that they can capitalize upon it. Looking at them in that light, it makes sense to spread out the announcement of these bugs and not inform vendors beforehand because it increases the likelihood that people will be compromised, giving them the opportunity to go to news outlets ands say, "see we told you this might happen."

Given all of the above, what can be done? I'd certainly never want to work with people who eschew responsible disclosure and are interested only in themselves, nor would I trust them. But any press is good press, and most people are not security people and won't even understand what it is these people are doing, they'll just know they got press for security research. Is there any way the security or computing community can discourage this crap in the future and make it clear that irresponsible behavior like this is unacceptable?

Re:Response

[Anonymous Coward]

LOL.

You make it sound like this is the first time anyone has ever done anything like this. Since the conception of BOF and FS bugs this type of disclosure has occured. And I think you are way off here saying they are only looking out for themselves. Have you every attempted to do a disclosure with Apple? It's nearly impossible. These 30 odd bugs they are going to release would take apple YEARS to fix if this disclosure method was not taken.

I'm sure both of these researchers are Apple users or such a project wouldn't have taken place. It's my belief that they are sick of Apple's antics and simply want results. But maybe thats just me.

Re:Response

[bbernard]

"At the same time they have behaved very irresponsibly with regard to those bugs they have found, not notifying the vendor and providing time to fix before publication, nor following the route of immediate disclosure, the MOAB people seem to think it is all right to sit on bugs they find until the most convenient time for them to gain publicity."

Spoken like a true Mac apologist. How dare anybody manipulate any information, timing, or accuracy to make my computer company look bad! Welcome to the world that Microsoft lives in, here's your initiation T-shirt.

Where is this outrage when an unpatched Windows bug is announced? Why is this only a problem when somebody points out flaws in Macintosh software? Admittedly, flaws in 3rd party software don't really seem to have any business in the MOAB list, but of the 23 issues they've reported so far I believe only 3 have been for 3rd party apps. So ignore them.

The fact is that yes, there is a "more responsible" way that vulnerabilities should be handled by the MOAB team. However, Apple could do a better job as well. They could actually take a lesson from Microsoft's disclosure process.

The whitewashing job Apple has done demanded (to some people) a highly publicized "retaliation" to prove that, indeed, Apple's feces doesn't smell like roses after all. This is the message that just doesn't seem to get across to Macintosh users, and until they not only get the idea that their OS isn't 100% secure, and that they need to take precautions just like Windows (and Linux) users then people like this MOAB team will continue seeking publicity more than seeking to "responsibly" get vulnerabilities reported and resolved.

(I'll get back off my soapbox now.)

Re:Response

[99BottlesOfBeerInMyF]

And I think you are way off here saying they are only looking out for themselves.

It is the only reason for this method of disclosure I can think of.

Have you every attempted to do a disclosure with Apple? It's nearly impossible.

What? They have a bug reporting form on their Website. You don't even have to give them any info on who you are. I've submitted bugs that were fixed in short order, although none were security issues. My coworker a few offices down submitted a local escalation security bug though and it was fixed a few weeks later and he was given credit in the the security update. How is that "nearly impossible?"

These 30 odd bugs they are going to release would take apple YEARS to fix if this disclosure method was not taken.

That's just bullshit. If they found the bugs this month and handed them all to the respective vendors then announced the results at the end of next month all the vendors would fix them before the announcement.

I'm sure both of these researchers are Apple users or such a project wouldn't have taken place.

At least one of these "researchers" has performed the month of bugs thing on other vendors, one of which was cancelled when he was paid off, as I understand it.

It's my belief that they are sick of Apple's antics and simply want results.

If they followed the schedule I listed above, and Apple did not fix them within that one month dev/QA time these guys could scream bloody murder and I'd be right behind them. They'd be following responsible industry practices and Apple would be in the wrong. I'm firmly convinced they did not do this because they were pretty sure Apple would fix the bugs and they would get only minor press once, instead of ongoing sensationalist press.

Also, before you go to far in defending these guys, you do know they are now accused of illegally exploiting one of their bugs against users before announcing it, right?

Re:Response

[DLG]

I was more troubled by the way they treated Omniweb, a small software company that has a good reputation for being responsive to users and released an update to the bug almost immediately. The workaround is to use Firefox (which has its own bugs) or wait for Omniweb to release a fix. They didn't bother to update their bug report to point to the fix.

I think in general they haven't got much press. People who argue that Apple's are no more secure than other OS's will continue to miss the point, which is that Microsoft intentionally designed their OS to allow their Email Reader or Word Processor to have the power to modify the OS. It wasn't a buffer overflow, improper validation of file formats. It was a feature designed to allow developers to create extensibility. The fix was to tell grandma not to open any email from anyone whose address she didn't recognize.

Yes it is true that diskutils and such is the kind of convenience that shields the user from understanding the repurcussions of permissions and other issues that can result in insecurity, but to suggest that someone who intentionally authenticates and authorizes System Administration tasks that overtly effects permissions on the box they are maintaining may effect security permissions on that machine is hard to justify as a security flaw. One may as well state that any machine that allows root access to anyone at all is inherently flawed. There ARE infact arguments that this is true, that there should be no root account, but that often just spreads the risk around to multiple accounts.

Similar flaws in devices in your home including chairs that can be used to hit people in the head, sharp knives, cars that allow the user to control the direction risking the possibility that they might drive into things, and lots of choking hazards such as doorknobs.

Re:Response

[99BottlesOfBeerInMyF]

Spoken like a true Mac apologist. How dare anybody manipulate any information, timing, or accuracy to make my computer company look bad! Welcome to the world that Microsoft lives in, here's your initiation T-shirt.

Who cares about making Apple look bad. I'm concerned about the very real security implications of these actions. They're putting people at risk in order to get press and ignoring the established practices of the industry. You can argue for delayed disclosure based upon vendor response. You can argue for immediate disclosure. Now do tell me the argument for not informing the vendor and not informing the public until a specific day. It doesn't matter what vendor they are doing this to, it is still unethical.

Where is this outrage when an unpatched Windows bug is announced?

There are valid reasons for announcing an unpatched bug in some situation and I fully support that. In some cases there are even valid reasons for announcing a bug to the public immediately without disclosing it to the vendor first. That said, this is neither of those cases. There is no security justification for immediate disclosure in this case. And, they aren't disclosing immediately, but are delaying disclosure.

Admittedly, flaws in 3rd party software don't really seem to have any business in the MOAB list, but of the 23 issues they've reported so far I believe only 3 have been for 3rd party apps.

That would be 6, not 3... or approaching 1/3 of them.

The fact is that yes, there is a "more responsible" way that vulnerabilities should be handled by the MOAB team. However, Apple could do a better job as well.

I think that is understating the case. They're accused of actually using the bugs to exploit users before announcing the bugs. That goes way beyond "less responsible" and enters the realm of "probably criminal." As for disclosure times, When you're dealing with a vendor that provides no feedback and has a history of slow bug fixes and you think the vulnerability might be being exploited in the wild and there is a work around, immediate public disclosure makes sense and increases overall security. When you're dealing with a bug in OmniWeb that is almost certainly not being exploited, it makes no sense. These guys provide immediate feedback and turn around security related bugs in hours. Yet the MOAB project not only did not give them hours, they never bothered to inform them of the bug at all and they had to learn of it from someone who read the MOAB and reported it to them from there. That is indefensible.

The whitewashing job Apple has done demanded (to some people) a highly publicized "retaliation" to prove that, indeed, Apple's feces doesn't smell like roses after all.

Whitewashing job? Do elaborate. How is Apple covering up security problems or misinforming people?

This is the message that just doesn't seem to get across to Macintosh users, and until they not only get the idea that their OS isn't 100% secure, and that they need to take precautions just like Windows (and Linux) users then people like this MOAB team will continue seeking publicity more than seeking to "responsibly" get vulnerabilities reported and resolved.

Umm, but Mac users to date haven't had to take any security measures to have a negligible possibility of malware infection. That could change in future and Apple should be proactive about keeping it that way, but you can always spend more effort on security. I'd like Apple to do more, but so far they have been "good enough" and I haven't seen them misinforming anyone. Some of their Ads may oversimplify, but that is a good thing since most people don't want complex messages about computers security. "Get a mac and you're safer than if you have Windows" is about as complex as the average consumer can handle and remember.

Re:Response

[99BottlesOfBeerInMyF]

I was more troubled by the way they treated Omniweb...

Even more troubling is the hubbub surrounding their Colloquy vulnerability, mentioned in this article. They are accused of actually using the exploit on a public IRC channel before releasing the vulnerability and publishing a log of that hack in the announcement. I don't know if it is true, but given their behavior with the rest of this project they're slipping more and more towards the blackhat end of the spectrum.

Re:Response

[bbernard]

"That would be 6, not 3... or approaching 1/3 of them."

My apologies. I went back and identified 3 more that were, indeed, not Apple software.

"They're accused of actually using the bugs to exploit users before announcing the bugs. That goes way beyond "less responsible" and enters the realm of 'probably criminal...' Umm, but Mac users to date haven't had to take any security measures to have a negligible possibility of malware infection."

Haven't you just argued both sides of the same point? There's nothing Mac users need to do to protect their machines, yet the MOAB people are accused of exploiting these bugs in the wild? Either one or the other of these statements is, therefore, incorrect. (Let me pause here to make clear the fact that I condemn the acts that the MOAB team is accused of doing)

I will agree with you that the OS-X platform has not suffered from the same number of reported and/or patched issues that the Windows platform has over the same time period. Hands down, there have been fewer reported issues. But that does not mean that the platform is safe. "Black Hats" aren't hacking as much anymore just for kicks, they're hacking for money. Don't believe that? Then explain what all those bot-nets are being used for. Where is the money in hacking a Mac? How many financial institutions rely on Macintoshes for storing sensitive data? How many Macs does the DoD use? How many Macs are high-value targets for making money off of hacking?

The absence of evidence of active hacking against the Mac platform is not proof that it is secure. That's the logical fallacy that Apple is happy to perpetuate, and that the "Mac Nation" will happily swallow. That's the Kool-Ade that I'd like to see fewer people drink.

Re:Response

[Goaway]

And I think you are way off here saying they are only looking out for themselves.

Have you tried actually reading their blog? With all the self-promotion, personal attacks and vitriol, it's glaringly obvious they are doing this first and foremost for drawing attention to themselves.

Re:Response

[shawnce]

Have you every attempted to do a disclosure with Apple? It's nearly impossible.

Yeah we have. It is actually rather easy to do. Personally I would file a defect with Apples bug-reporter system and then send an email into the product-security email address with a reference to the bug number.

http://www.apple.com/support/security/
http://developer.apple.com/bugreporter/

Re:Response

[99BottlesOfBeerInMyF]

Haven't you just argued both sides of the same point? There's nothing Mac users need to do to protect their machines, yet the MOAB people are accused of exploiting these bugs in the wild? Either one or the other of these statements is, therefore, incorrect.

No, that is not the case. Apple has an install base of millions. Colloquy users, on OS X, using that software actively on a channel where it is being exploit, in that one week window between the discover/alleged use and fix make up a negligible part of those millions. Adding together all the exploits used in the wild, including trojans, still accounts for a negligible part. I'm more likely to lose data because I got in a car crash which destroyed my laptop than I am to be remotely exploited.

But that does not mean that the platform is safe.

This statement is meaningless. Nothing is ever "safe." Even if you have a mythical, perfect computer security system there is the possibility that Illuminati agents will kidnap you, use drug and hypnotherapy, and make you copy all you data onto disc and give them a copy then forget about it. Security is relative. OS X is much better than Windows, but much less secure than OpenBSD. The point is to keep your customers happy by providing most of the with security that is appropriate. Given the lack of widespread exploitation on OS X, they are succeeding thus far.

"Black Hats" aren't hacking as much anymore just for kicks

There are lots of reasons OS X is less likely to be exploited, including market share, default settings, and the skill set of most malware authors. New worms already attack multiple Windows vulnerabilities to increase their chances of spreading. There have been cross-platform worms. There are worms that mine data, like online account info and CC#'s The motivation for adding an OS X exploit is there, if it is easy enough. There are a number of worms written for purposes like prestige, attention, and profit that would be more effective if they targeted the Mac. To date, it has not been easy enough.

Where is the money in hacking a Mac? How many financial institutions rely on Macintoshes for storing sensitive data?

If you're being directly attacked by a skilled researcher, the Mac is not the best platform. Use a locked down SELinux setup. That does not apply to most people, however. For the data on average laptops that widespread malware is targeting, macs have plenty of it. Half of the Windows machines you hit are going to have nothing of worth because they are owned by people in relatively poor areas, many pirating Windows. Mac users are relatively affluent by comparison.

How many Macs does the DoD use?

This is not really relevant do to the same reasons as above, but it is an interesting question. How many do they use? What naval intelligence? What about the CIA. I know some CIA operatives had powerbooks because they handled large satellite photographs and maps better. As for other uses, I don't know. Do you?

The absence of evidence of active hacking against the Mac platform is not proof that it is secure.

The relative lack of hacking against the Mac platform is one reason why it is more secure than Windows. Nothing is ever, "secure."

That's the logical fallacy that Apple is happy to perpetuate, and that the "Mac Nation" will happily swallow. That's the Kool-Ade that I'd like to see fewer people drink.

99% of people don't know what an "OS" is. If you tell them that Macs are not "secure" and neither is Windows and they need to take a course in computer security to learn safe practices, they'll ignore you as another techno-babbling geek. You might convince them to stay with Windows instead of switching to a Mac because both are insecure, right? Practically speaking the message, "get a mac and you're less likely to have security problems" is more likely to increase the overall security in our current environment than anything else. It gets people to switch to a company that needs to keep customers happy or it loses money and it gives MS incentive to make their machines more secure. Attempts to confuse this message or make it more complex are likely to result in net decreased security.

Re:Response

[DLG]

I just searched around on this, and was also disturbed by what I see which can be summed up by 'they tested it live, the developers fixed the bug based on the attack, the MOAB team posted a release with evidence of the attack, then removed it, then denied it happened, and denounced all potential proof as unreliable'

The parent shouldn't be modded flamebait, but thats not really important. Even the fact that they used it live was relatively minor (it wasn't infecting peoples computers as far as I could tell). What bothers me is that the lack of transparency they accuse Apple or other developers of, hardly seems valid in light of their own lack of honesty. This has been questioned before, and if they hadn't already made themselves look a bit foolish by targetting open source multiplatform tools, they certainly would have lost credibility based on this stunt.

Re:Response

[tknd]

"Who cares about making Apple look bad. I'm concerned about the very real security implications of these actions. They're putting people at risk in order to get press and ignoring the established practices of the industry. "

Funny. I'm willing to bet if you replaced Apple with Microsoft you would have been modded down.

Re:Response

[Jeff DeMaagd]

Apple may be better, but I've heard stories on this very forum, where several people complaining that Apple took many months to fix problems. I have not seen any fix to the Quicktime HREF vulnerability that caused virus trouble at MySpace, and I'm pretty sure Apple's known about that for several more weeks than this.

Re:Response

[nathanh]

So what is the proper response to the MOAB people? They are revealing real bugs, some of which could be exploitable. Ignoring them leads to decreased security. At the same time they have behaved very irresponsibly with regard to those bugs they have found, not notifying the vendor and providing time to fix before publication, nor following the route of immediate disclosure, the MOAB people seem to think it is all right to sit on bugs they find until the most convenient time for them to gain publicity.

Not true.

Two of the bugs had been reported to Apple one month before MOAB begun. Apple did nothing (and they've still done nothing).

One of the exploits was already in the wild (real-world machines being compromised) and MOAB simply reported it. Apple still hasn't fixed that one either.

Two bugs are related to stupid design decisions in Safari that date back two years and Apple still hasn't fixed those faults.

One bug is related to Apple's stupid practise of making the first user account an administrator and then setting lackluster permissions on system directories. Once again, known for years.

You can't blame the MOAB guys for all these problems.

Re:Response

[99BottlesOfBeerInMyF]

Two of the bugs had been reported to Apple one month before MOAB begun. Apple did nothing (and they've still done nothing). One of the exploits was already in the wild (real-world machines being compromised) and MOAB simply reported it. Apple still hasn't fixed that one either.

Citation please.

Two bugs are related to stupid design decisions in Safari that date back two years and Apple still hasn't fixed those faults.

This is incorrect. Several of the bugs (as they list them) take advantage of a design choice in Safari that sacrifices security for usability. To call it a "stupid" choice is a valid opinion, but seeing as how basically no one has been exploited yet due to that decision and seeing as we don't know how many sales it has garnered Apple, it is also a bit presumptuous.

One bug is related to Apple's stupid practise of making the first user account an administrator and then setting lackluster permissions on system directories. Once again, known for years.

If you're referring to APE, it was the APE installer that set the permissions in question using administrative privileges.

You can't blame the MOAB guys for all these problems.

I blame the MOAB guys for not informing vendors before releasing bugs, an issue which has been confirmed by numerous developers whose applications were affected, and for intentionally delaying the announcement of the bugs to fit with their PR schedule. If they actually did test their Colloquy exploit on live users I certainly blame them for that. These guys are not behaving responsibly and none of the security researchers I know would put their own PR this much ahead of users.

I posted this elsewhere too...

[jpellino]

This fix is in line with the typical timing and attention given Apple security updates - relatively quick and competent.

This pretty much busts MOAB's claims of Apple's ignorance and/or hostility at bug reports.

Apple has been doing better than most, fixing 99.9% of their problems through their established channels without MOAB's brand of nonsense. Count all the bugs fixed thru the normal dev bug report process. Count all those fixed by MOAB's. Compare.

IIRC nearly a third of their "Apple Bugs" are 3rd party problems to begin with.

MOAB are still flaming Apple Inc., Apple users, and anyone else who critiques their methods, and it's gotten personal and insulting. They come out swinging their fists at the Apple community, then cry foul because someone hits back.

If Apple users make you cry, go kick your tires.
You want the world to believe that you're a responsible developer that anyone will listen to or hire, prove it in daylight.

Re:I posted this elsewhere too...

[Midnight Thunder]

MOAB are still flaming Apple Inc., Apple users, and anyone else who critiques their methods, and it's gotten personal and insulting. They come out swinging their fists at the Apple community, then cry foul because someone hits back.

This may be true and there may be better ways (using the Bug Report server for example), but if the end result is getting these problems fixed and a better system out of it, then I am happy with the effort put into it.

Maybe we need something like this for Linux and Windows?

Re:I posted this elsewhere too...

[IamTheRealMike]

This fix is in line with the typical timing and attention given Apple security updates - relatively quick and competent.

Not sure I'd agree with that, actually. Apple is generally regarded as being slower than Microsoft at patching problems. According to the MOAB folks the QuickTime HREF universal XSS was patched slowly and then only for MySpace (huh?). Plugin XSS is pretty serious! It's possible they got better, but according to this study from 2006 it took them 91 days on average to fix known exploits.

IIRC nearly a third of their "Apple Bugs" are 3rd party problems to begin with.

Yes, of course, it's silly to call it the "Month of Apple Bugs" when they are also reporting exploits in third party software. Unfortunately, it's also understandable - the fact that many security problems in Windows are caused by third party software does not stop people blaming Microsoft for the insecurity of the Windows platform. Given that quite a few of these third party exploits are privilege escalation (eg instant root), it is Apples problem. If third party devs cannot write secure code then they'll end up in the same situation as Windows - and it seems they can't write secure code (no surprises here). Apple are already being targetted by attackers.

MOAB are still flaming Apple Inc., Apple users, and anyone else who critiques their methods, and it's gotten personal and insulting. They come out swinging their fists at the Apple community, then cry foul because someone hits back.

I quite agree that these "Month of X bugs" things seem to be quite irresponsible and even immature. I'm not sure what the point of them is, except to make a bad situation worse.

Re:I posted this elsewhere too...

[99BottlesOfBeerInMyF]

Apple is generally regarded as being slower than Microsoft at patching problems.

Yeah, I've read those studies in detail. The Window of exposure for exploits was much higher with Microsoft products and they only cover publicly acknowledged security bugs. My info says less than half of the security bugs MS finds internally are fixed ever. I don't know about the situation at Apple.

...but according to this study from 2006 it took them 91 days on average to fix known exploits.

You're confusing the term "exploit" with "potential vulnerability." A lot of Windows vulnerabilities are disclosed when someone notices an exploit in the wild. This has never been the case with Apple, as far as I recall. The window of exploitation is the time between when blackhats start exploiting a hole and when the vendor fixes that hole. That is the number that counts and MS is way behind on it.

Yes, of course, it's silly to call it the "Month of Apple Bugs" when they are also reporting exploits in third party software. Unfortunately, it's also understandable - the fact that many security problems in Windows are caused by third party software does not stop people blaming Microsoft for the insecurity of the Windows platform.

Yeah and if an uninformed guy off the street confused these I'd understand, but these are supposed to be security researchers. When that happens, it isn't a mistake, it is knowingly promoting a falsehood.

Given that quite a few of these third party exploits are privilege escalation (eg instant root), it is Apples problem.

Certainly I'm all in favor of Apple finishing their MAC implementation and locking down applications and threads, but the chances of being exploited right now is so small that it is not an issue for customers yet.

I quite agree that these "Month of X bugs" things seem to be quite irresponsible and even immature. I'm not sure what the point of them is, except to make a bad situation worse.

The point is to generate press for the "researchers" at all costs, even if it means promoting the creation of worms in the hopes that they can get more press out of that.

Re:I posted this elsewhere too...

[eli pabst]

You seriously don't have a clue do you?
Look at the past security fixes apple has released. For bugs found in both Linux and OSX, look at the CVEs and you can compare when Linux vendors fixed the bug and when the OSX fix was released. Redhat fixed most of the bugs within a day or 2. Apple had release times in months. They are horrible when it comes to timely release of security fixes.

Look at the Security update 11-28-6 for example:
GnuZip (reported 8-24-6)
redhat fixed 9-19-6

Perl (reported 12-01-5) That's a almost a year earlier
redhat fixed 12-20-05

PHP(reported 3-29-6)
redhat fixed 4-25-6

And that is actually not as bad as some of the other security updates. For awhile I was responsible for putting out a security mailing list that required me to manually sort through the bugs to remove duplicates and I always noticed Appple releasing fixes for bugs that I had seen months and months ago in Linux and the other BSDs. The bugs required for a worm are out there (remote arbitrary code execution/privilege escalation). It's surprising that they haven't been taken advantage of, personally I think there aren't as many people interested in writing exploits for Apple products.

Re:I posted this elsewhere too...

[Anonymous Coward]

I'm a Linux user, I would love something like this. They can run it for a full year if they want to. 365 security holes closed. Would be sweet. I will not complain about third party apps either since I use a few of them.

I have to agree

[bobalu]

Not to let Apple off the hook, but it seems to me this could be handled better.

MOAB... Mother of all Bombs?

[Phu5ion]

Maybe this is Apples strategy to any future iPod pre^H^H^Hcontenders.

Where are they?

[iceperson]

I've still never seen an OSX computer out of the store...

Re:Where are they?

[Anonymous Coward]

You'll typically find them in the homes of men who make a habit of taking cocks into their mouths and anuses. Also in San Francisco. But I repeat myself.

It is mentioned in the article...

[PatMouser]

Submitter might want to read the Apple article that was linked to. It specifically mentions MOAB and where to find the QT file.

Re:It is mentioned in the article...

[frdmfghtr]

Submitter might want to read the Apple article that was linked to. It specifically mentions MOAB and where to find the QT file.

I did in fact read the link, and I stand by my statement.

"Description: A buffer overflow exists in QuickTime's handling of RTSP URLs. By enticing a user to access a maliciously-crafted RTSP URL, an attacker can trigger the buffer overflow, which may lead to arbitrary code execution. A QTL file that triggers this issue has been published on the Month of Apple Bugs web site (MOAB-01-01-2007). This update addresses the issue by performing additional validation of RTSP URLs."

Where does it state that the fix was a result of the MOAB effort? The bulletin states where a sample file that triggers the issue can be found, that's all.

Wish they'd picked a different acronym

[blueZ3]

Any other vets out there who keep reading these headlines about the MOAB and wondering how Apple's Cupertino campus survived the "mother of all bombs"? I mean, you gotta love those later-day daisy-cutters and once you've seen one of those things falling out of a C-130, the MOAB acronym just doesn't work for anything else.

Re:Wish they'd picked a different acronym

[Zordak]

I've never even been in the military, and that's the first thing I thought of. But then I did formerly work for a defense contractor.

Re:Wish they'd picked a different acronym

[h4ck7h3p14n37]

I'm no vet, but that's the first thing I thought of when seeing the acronym. Some time ago I caught a Discovery Channel show about the MOAB. The show also talked about a new device that was deployed from an aircraft like a bomb, then split apart and threw out hundreds of these spinning discs that communicated amongst themselves and then started firing at targets. They showed a brief demo of one of the devices taking out an entire tank column.

Response?

[UnknowingFool]

Apple has released what appears to be the first security update as a result of the "Month of Apple Bugs.

I don't know about that. Apple releases updates routinely and seem to be on a monthly schedule. I wouldn't say it was clear case of cause and effect.

Re:Response?

[M. Baranczak]

http://docs.info.apple.com/article.html?artnum=304 989/

The summary is wrong. Apple specifically said that the fix is in response to a report from MOAB.

Re:Response?

[99BottlesOfBeerInMyF]

The summary is wrong. Apple specifically said that the fix is in response to a report from MOAB.

To clarify, they say it was made public on MOAB's Web site. They did not say it was in response to that announcement, nor did they imply that MOAB had reported the problem to Apple, via the normal bug report channels.

Re:Response?

[frdmfghtr]

This is true, and I've argued that point several times. In a way, I contradicted myself when submitting the summary, stating that it appeared to be a result of MOAB and then saying it didn't appear to be explicitly a result of MOAB.

Lots of comment...

[shawnce]

I am see several comments from folks stating that they are surprise that Apple is taking steps to patch issues ("taking it seriously", etc.). I find that a little strange comment given that Apple is actually rather good about addressing vulnerabilities that others report to them and give them credit (if they reported it to Apple). Granted Apple's general no comment policy until investigated and patched can be a little annoying if you report an issue and would like to know more but that policy doesn't mean that Apple doesn't take security reports seriously.

Just review all of the attribution Apple has given for the many vulnerabilities they have addressed over the years. For example look at the security release announcements for 2006 (mailing list archive).

As a side note a few MOAB issues are centered on group admin writable locations that can be used to take over the system is you have local access (possibly via a remote exploit). It may take Apple a little while to address this type of issue given the possibility of permission changes causing Apple and 3rd party software (installers most likely) to fail for customers. Luckily a few new security related feature will debut in Mac OS X 10.5 that will make this type of attack harder to pull off (us 3rd party developers should adopt them ASAP).

A brief listing...

CoreGraphics
CVE-ID: CVE-2006-1444
Available for: Mac OS X v10.4.6, Mac OS X Server v10.4.6
Impact: Characters entered into a secure text field can be read
by other applications in the same window session
Description: Quartz Event Services provides applications with
the ability to observe and alter low-level user input events.
Normally, applications cannot intercept events when secure event
input is enabled. However, if "Enable access for assistive
devices" is on, Quartz Event Services can be used to intercept
events even when secure event input is enabled. This update
addresses the issue by filtering events when secure event input
is enabled. This issue does not affect systems prior to Mac OS X
v10.4. Credit to Damien Bobillot for reporting this issue

Keychain
CVE-ID: CVE-2006-1446
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS
X v10.4.6, Mac OS X Server v10.4.6
Impact: An application may be able to use Keychain items when
the Keychain is locked
Description: When a Keychain is locked, it is not possible for
applications to access the Keychain items it contains without
first requesting that the Keychain be unlocked. However, an
application that has obtained a reference to a Keychain item
prior to the Keychain being locked may, in certain
circumstances, be able to continue using that Keychain item
regardless of whether the Keychain is locked or unlocked. This
update addresses the issue by rejecting requests to use Keychain
items when the Keychain is locked. Credit to Tobias Hahn of HU
Berlin for reporting this issue.

GDB
CVE-ID: CVE-2006-4146
Available for: Mac OS X v10.4 and later
Impact: Opening a maliciously-crafted DWARF binary with GDB may
lead to arbitrary code execution
Description: GDB, the GNU Debugger, is susceptible to multiple
vulnerabilities that may lead to arbitrary code execution when
loading maliciously-crafted DWARF binaries. This update
addresses the issues by performing additional validation while
handling DWARF binaries. Credit to Will Drewry and Tavis Ormandy
of the Google Security Team for reporting this issue.

etc.

MOAB is doing us a favor...

[Anonymous Coward]

...by doing security review and finding some flaws that shouldn't be there in OS X.

We value OS X for its security and Unix-derived security and stability. How can you all claim to be good Commie open-sourcers like Stallman is and still oppose any peer-review that leads to the improvement of one or more BSD distro's security?

Many of these flaws are common on all platforms. OS X developers will have to be more careful in coding as this review shows. If we want to go on being secure on our virus-free platform, Apple and our developers need to do the code reviews for security.

Mod Abuse?

[99BottlesOfBeerInMyF]

How is it "flamebait" to link to an article about the MOAB people being accused of criminal activities related to their project?

MOD ABUSE - MOD PARENT UP

[Anonymous Coward]

This is about as far from flamebait as I can imagine.

Re:yawn

[Anonymous Coward]

yeah, sure, spoken like a true member of a marginalized fringe group. I'll shoot you next time in CS or BF2. Oh wait... you can't play those on osx

Bugs...not Melissa pws j00

[gsfprez]

many of the bugs are problems that are just outright bizare in thinking of how they'd get executed.

"Here is a malformed HFS+ filesystem that can potentially cause a kernel panic and cause arbitrary code execution. you should all be quaking in your boots."

now just one damn minute... first, you have to get me a DMG, which, apparently, will instantly panic the kernel. Fine. so what? In real life, i'd throw out the dmg file, download it again, it would panic again, and i'd give up.

I'm missing (and it could just be me) how that's in any way exploitable in any meaningful sense.

i think the problem is that MOAB is putting on a show of bugs.. and nothing more. These are bugs that either made it past the guys in Cupertino, or they just didn't see them as that big of a deal, and figured they'd get to them eventually.

Some of these bugs are bad and could cause Macs the world over to get pwn3d and get used to do whatever you can do with an pwn3d Windows box. Fine.

But many of them are just, well.. bugs that causes the system to crash. So the hell what? Without some kind of setup and extreme set of circumstances, the majority of the bugs here crash your system, and then you reboot...

Microsoft's problem has been "be a user on the internet with their software, get pwn3ed." I'm trying to see which of these bugs would give Mac users similar "functionality".

#21 requires a local user to take advantage of this escalation problem - on a machine that they are probably already the only user of

#20 is the same thing... as is #8, and #15.

the bulk of the others are "DoS, cause computer to crash with possibility of arbitrary code execution..." and that assumes the panic condition is consistent.

the only actual scary ones are #19 (not apple's software, and i don't even know if it could actually allow arbitrary code execution), #17, #1 (now fixed), #2 (not apple, and fixed), #4, and #20... so, 6... and 4 are left.

this is just stupid.. my machines are still buck naked on the internet, and i'm still not scared at all.

Re:Bugs...not Melissa pws j00

[natenovs]

these bugs can cause arbitrary code execution because they are crashes that happen deep in the kernel. if you sculpt your malformed input correctly the instruction pointer will actually hold the value of your input. if your malformed input is 01 02 03 04 05 06 07 08 09 (this is just an example) and the buffer over runs when it gets to the 04, then the EIP will be pointing to 05060708. the system will try to execute the command at 05060708. put the beginning of your virulent code at that location of memory, and you have just hijacked the system. worse, your virualent code will run with what ever permissions were granted to the last comman, ie kernel permission. the reason why MoAB says this is possible but doesn't have an example is that a hack like this is extremely difficult to pull off. the fact that the application crashes in the kernel means that it is possible. if the app just crashed in user space, then the system would be safe. also, anyone notice that this fix theyre posted doesnt fix the windows version of quicktime?

Re:Bugs...not Melissa pws j00

[marmoset]

#19 is fixed, and the developers somehow resisted the urge to slap the snot out of these jerks for not emailing them privately beforehand.

Re:Bugs...not Melissa pws j00

[petermgreen]

if you don't consider "DoS, cause computer to crash with possibility of arbitrary code execution..." to be a serious security issue you have very very low standards. They can crash your machine causing you to lose any data you have open and potentially they can get complete control over your machine instead if they can get the exploit details just right.

Apple DOES Credit MOAB!

[toonerh]

See their update notice.

flame on

[catmistake]

so... January is MOAB?

but every month, including this one, is MOM$B
---
jeez, these MOAB guys are real douche bags... too bad (for them) what comes around goes around

You forgot...

[Anonymous Coward]

To mention the Moabites :-)

(Look 'em up in the OT.)

Windows fix is missing in action

[Anonymous Coward]

Apple claims to have fixed the overflow problem for both QuickTime for Mac and for Windows, but the fix for the Windows version is nowhere to be found. The Apple Downloads web page only has Mac fixes on it.

Re:Windows fix is missing in action

[Weedlekin]

Use the in-built updater in QuickTime, which will find it for you.

yeah yeah yeah

[Anonymous Coward]

STFU

NOT impossible to report a security bug

[Brownian Motion]

It's not impossible to report a security bug to apple and get a response.

Though a misunderstanding of UNIX permissions, I reported what I thought was a security problem to apple. Apple responded, followed up with me, by then I'd figured out that I was a moron, and what I could do to make what I want happen.

The main point was that Apple was quick to respond (hours). I can't imagine that they'd be any less responsive for a REAL security problem, that the reporter could demonstrate.

If you're curious on what I was stupid about, if you own the directory, you can overwrite any file in that directory, no matter who owns the file. It did not seem right, but it is standard UNIX behavior (Linux, OS X, Solaris all behave this way). OS X even has a fix for this by setting the immutable flag with chflags.

It turns out that this is even used in the MOAB. You can overwrite some of the sticky bit files if you are an admin (w/o authenticating) because the folder is owned by the admin group. Then, when fix permissions is run, it'll reset the sticky bit and make the file owned by root again. Then you just run the file, and get instant root access.

Any sticky bit root programs need to be in a folder owned by root/wheel, have no write permission except by the root user, and the same for the individual file.

And fix permissions should be updated to use a tripwire on anything it gives sticky bit permissions to, so it can also note if someone has tried to change a file that, by definition, is a possible attack vector. And it wouldn't hurt to mark them as immuatable with schg.

The MOAB people are really bright, but also out for the notoriety. They claim that "you can't fix this, as a repair permissions will undo all this".

Which is wrong, and they should know it. For one, you can mark those files as immutable, which will prevent their being over-written w/o using super user privs (instead of just admin privs). And even root can't overwrite an immutable file w/o removing the flag first. If the attacker already has root privs, you've already lost, and they won't be messing with this.

Secondly, you can easily hack repair permissions to have the settings you want on those files. Just make an installer package which over-writes those files, with the permissions you want. Once that package is installed, repair permissions should keep the permissions the way you've set them. I've not tested that, but it should work.

More bugs...

[eli pabst]

Fetchmail (CVE-2005-2335) assigned 07-21-2005
redhat fixed 07-25-2005
Apple fixed 08-01-2006 (a year later)

Gunzip/Gzip (CVE-2005-0988) assigned 04-06-2005
Redhat fixed 06-13-2005
Apple fixed 08-01-2006 (a year later)

Telnet (CVE-2005-0488) assigned 2-20-2005
Redhat fixed 06-14-2005
Apple fixed 08-01-2006 (a year later)

ClamAV (CVE-2006-1614) assigned 04-05-2006
SuSE fixed 04-11-06 (not a RH package)
Apple fixed 05-11-2006

Libcurl (CVE-2005-4077) assigned 12-08-2005
Redhat fixed 12-20-2005
Apple fixed 05-11-2006

Ruby (CVE-2005-2337) assigned 07-21-2005
Redhat 10-25-2005
Apple fixed 05-11-2006 (almost a year later)

Sudo (CVE-2005-1993) assigned 06-20-2005
Redhat fixed 06-29-2005
Apple fixed 10-29-2005

If you don't care about this and pretend like there isn't an issue, then Apple won't care either. Look at Microsoft, they only made security a priority when their own users started to complain.

Is the glass house getting to you?

[Anonymous Coward]

Obviously increasing the security of end users is not the top priority.

Why would it be?

Do they have any responsibility to report anything they find? Do they have a personal interest in OSX being secure? Are they being paid by Apple to find bugs? Are they supposed to fix it for them?

No, No, No and No.

So really: what's your fucking problem?

So what is the proper response to the MOAB people?

Duh. The software developers fix bugs ASAP after they become aware of them. It's that simple.

Given all of the above, what can be done?

Do you work for Apple? If not, it's not your software. So why do you care? If you do work for Apple, congratulations - you have some bugs to fix.

I'd certainly never want to work with people who eschew responsible disclosure and are interested only in themselves

I guess you'll never get a job then, since your goal would involve personal profit.

Is there any way the security or computing community can discourage this crap in the future and make it clear that irresponsible behavior like this is unacceptable?

Quit being so terrified about it and fix the problems? You can't force everyone to conform to your world view of being a perfect bug-reporter - they will simply move underground and vanish if you try. You sound like a schoolteacher who's afraid of their students - who in turn smell fear and terrorize you.

Or maybe you're a Mac user who's been throwing stones at Windows, only to suddenly find out that you live in a glass house.