Mac Developer Mulls Zero-day Security Response

1.6 Beta writes "Landon Fuller, the Mac programmer/Darwin developer behind the 'month of Apple fixes' project, plans to expand the initiative to roll out zero-day patches for issues that put Mac OS X users at risk of code execution attacks. The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches. The article quotes him as saying, 'Perhaps [it could be] the Mac OS equivalent to ZERT,' referring to the Zero-day Emergency Response Team."

Comments

Bonzi buddy auto-installer

[User 956]

The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches.

Windows has an auto-updating mechanism for "third-party patches". It's called Internet Explorer.

Arbitrary patch

[MillionthMonkey]

Because the vulnerability allowed the execution of arbitrary code within the JVM via any Java applet, Fuller created a temporary patch for Mac OS X.

Can he write an applet that runs the installer using the vulnerability? That would be really convenient.

This is not a "move on Apple's part"

[daveschroeder]

Apple isn't doing this, and Landon Fuller doesn't have anything to do with Apple, other than having worked there. (And no, conspiracy theorists, he's not doing this at Apple's behest or as part of some coordinated fanboy effort to "make Apple look good".)

What Apple should be doing is developing a much more comprehensive and responsive security response group, which is lacking now. Apple needs to be patching issues in a much more timely manner. Hopefully the outcome of MOAB, things like Fuller's proposal, and other related things will be a real discourse on Apple security response and Mac OS X security.

Re:This is not a "move on Apple's part"

[mstone]

Let's drop the cognitive dissonance, shall we?

Vint Cerf recently made a report to the UN committee on internet security. He said that maybe 25% of all computers tied to the internet are infected. We're currently seeing the highest spam levels in the history of the internet, much of which is being sent by botnets that contain thousands or hundreds of thousands of compromised machines. We've gotten to a point in history where 'hundreds of thousands of machines compromised' is no longer a newsworthy fact. It's so freaking common that people just look at it as an unpleasant fact of life.

And right in the middle of that context we have a few tens of millions of Macs that have been running unmolested for years.

I don't give a damn about your abstractions. I don't give a damn about your heuristics. I don't give a damn about your moral indignation that Apple doesn't run its entire business in a way that's consistent with the .3 seconds of what passes for thought that you've put into any given issue. I'm an empericist. I care about what's actually happened.

What's actually happened is that there hasn't been a single large-scale compromise of the Mac platform since the introduction of OS X. What's actually happened is that Apple has been notified of several vulnerabilities over the past few years and has rolled out security updates to address them. In many cases, they've also listed the names of the people who notified them of the problem. What's actually happened is that Apple has continued to develop its security model and has built a whole new set of tools into Leopard that will make OS X even more secure than it is today.

There are exactly three classes of people who try to bang the "Macs are no more secure than Windows, but Mac users are too stupid to care" drum any more:

1. Apple haters
2. Lazy journalists who don't know or care shit about security but know that putting 'Apple' and 'security' in the headlines guarantees sales/page views/etc
3. 'Security researchers' who either have a financial interest in selling AV software or are media-whore wannabees.

Please note that I do not place Landon Fuller in any of those categories. He isn't trying to sell the world the idea that Apple's sky is falling. He's talking about a fairly interesting concept of community involvement in the overall Apple security process.

I happen to disagree with the idea, personally.. IMO the chance of a zero-day patch breaking something is higher than the chance of a Mac getting infected between day zero and the time Apple releases an official patch (and yes, that includes all those issues that have been hanging out there unpatched for years.. show me the number of active exploits in the wild instead of just stuffing another set of panties into the wad currently wedged up your ass). I also see problems with trust and vetting. A MacZERT would presumably do some QA on the patches before distributing them, which leads to the same kinds of delays you get from Apple. And a MacZERT's capacity to look for unwanted side effects would be limited by the fact that outside third parties don't have all the relevant code.

I do see the possibility of large benefits from a community effort to isolate and develop proposed solutions to bugs, since that would help Apple's own security team with some of the heavy lifting. I think Apple could develop a good dialogue with the third-party security community through such a system.

But that has absolutely nothing to do with you. You're just another anti-fanboy out to spew meaningless FUD. The fact that you can't distinguish between "hundreds of thousands of compromised machines in a single botnet" and "no exploit of even a thousand machines over the past five years" means your opinion is too stupid to be taken seriously.

Re:no trolls?!

[Anonymous Coward]

I think MOAB story is getting stale. I submitted a story on how MOAB website tried to crash Safari using .jp2 vulnerability and include the comment

<!-- Never use the macbook at bed again when browsing the MoAB or you will fry your balls, looper -->

in the HTML code. However, /. didn't bother accepting it.

MOAB includes hack attempt

Unnecessary.

[sakusha]

Almost all of the MOAB bugs have already been patched, including OS fixes by Apple. Some of the application fixes were released within hours of the public announcement of the bug. Yet NONE of those fixes have been linked on the MOAB website.

The normal processes are working. What is NOT working is the MOAB process. If they used the normal procedure of notifying the developers privately, these bugs could have been fixed in days or even hours, before any public disclosure. But that wouldn't achieve what the MOAB hackers wanted. MOAB isn't about security, it's about publicity whoring.

Re:Unnecessary.

[Rosyna]

You have to realize that MOAB isn't an unwarranted attack against Apple. It's backlash for years of flaky technical support, deceitful practices and arrogance on the part of the Mac community in general.

Yeah, that's clearly their intention after you look at the non-apple issues such as the ones in OmniWeb, Transmit, VLC, Flip4Mac, Rumpus, et cetera. Clearly, those are an attack against apple's "flaky technical support".

Re:no trolls?!

[Cysgod]

quiet night tonight... not one mac fan boy or anti-mac troll has popped up yet, though im sure its just a matter of time Reversing the broken code that people find and figuring out how to patch it can be a great, fun mental exercise if it's something you're interested in. The personal satisfaction from doing that is sometimes offset by all this seemingly inevitable rabblerousing between fanbois and, their complementary particle, anti-fanbois.

When fanbois and anti-fanbois come into contact they emit a special radiation that causes a temporal shift, known informally as "a colossal total waste of time", for anyone who happens to be reading or listening. For example, you're reading a technical thread, then two of these subsentient particles come into contact. They insist on threadjacking your discussion into an us versus them discussion that only tangentially involves the subject at hand and is logically irritating since it represents a false dilemma. As you skip past the messages looking for some meaningful discussion and swearing about the state of technical discourse, you suddenly discover two hours have passed due to the temporal-moronic radiation.

Maybe people could study training Bayesian filters to delete those messages (or just delete the authors).

bo-oh-oh-oh-oh-gus!

[Gary W. Longsine]

wait until OS X gets enough market share for these vulnerabilities to be bought, sold and used to compromise computers en masse.

Apple sells over five million new systems each year. There are probably about 20 or 25 million systems running Mac OS X right now. The financial incentive to exploit Mac OS X has been plenty high enough for a long time. Botnets are rentable, and people peek at the prices now and then and report on it. I've seen numbers like this several times:

going rate for botnets: the going rate is around the USD$1,000 per hour for as many as 30,000 zombie PC's

If crackers could easily take over Mac OS X systems, they could make lots of money. Clearly, they can't easily own Mac OS X. There are plenty of systems to make it worth their while.

Although I agree that a Mac OS X worm would be bad publicity for Apple, and that Apple could improve the way they handle response to reported security defects, I think they have produced a reasonable track record over the past five years regarding the basic security of Mac OS X. Apple's security track record is due much more to the relatively weaker security of Windows systems than to Windows market dominance. Windows is low hanging fruit, crack-wise. If it were harder to own Windows systems, crackers would switch to Mac OS X in a flash. Crackers don't need to own 20 million systems, they really only need a few thousand at a time.