Slashdot Mirror
Worm Claimed For Apple OS X
SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."
As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm.
If by fully testing you mean "auctioning it to the highest bidder" then yea.
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
First of all, if he's found a real vulnerability, he reports it. I don't care if it's Apple or Linux or even Windows. "Waiting until I finish it" is a disgusting excuse. Will he sell it to the bad guys? Is this free publicity for some jerk? I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.
The fact that the breaking news on slashdot is "someone found the third way to attack a mac machine" is a compelling argument to purchase a mac over a PC. Unless someone can explain to me how this is the seed of an impending snowball of mac-targeted malware.
While I have no doubt that worms etc can be created for OSX (or any OS, given enough time.) I'm not really fond of companies blowing their trumpet until they're certain. It's very rich to claim all that publicity without notifing the vendor, or even being 100% certain. Otherwise it comes across as yet another company that is trying to claim solely for the benefit of the massive attention that it will draw on the company. Whether it's a fiasco involving wifi hardware or an antivirus company claiming endless vulnerabilities to sell their "protection tools". The apple community is well versed in frauds and half-truths spun as a "massive vulnerability" who cry wolf.
Somebody writes a worm for OSX that works across a specific test network (of which we have no clue as to settings, layout, patch levels, etc etc), and it's really, really, really big news. Media orgs around the planet sound the klaxon, and (nearly) everyone gets all hyper-ventilated. Claims of "OSX is just as vulnerable!!!1111!!" will fly off the pages.
Meanwhile, the next near-periodic iteration of MSFT-specific malware in-the-wild will get not so much as a grunt outside of security circles (such as SANS ISC and F-Secure's blog as ferinstances). It will likely subvert 40x as many victims in its first hour, and the media won't say so much as 'boo' about it.
Perspective (at least outside of security and some geek circles)? Never heard of it.
Quo usque tandem abutere, Nimbus, patientia nostra?
I havent really looked at the market share percentages of OSes recently, has Apple really grown large enough for Virus makers to start targeting Apple?
Bundle it with a Windows worm. Exploit Macs on the same subnet as Windows boxes. Then the infected Macs scan for vulnerable Windows boxes and spread the infection. Every vector is useful in an attacker's bad of tricks.
If by "well versed in frauds and half-truths" you mean well versed in spreading their own brand of propoganda and half-truths, then yes, you are correct.
(A)bort, (R)etry, (I)gnore?_
Apart from the claim by infosec sellout sounding less than adult - he says the payload was "weaponised" - and his claim that Apple will somehow not fix the "root cause" of the vulnerability if he gives it to them now - extortion anyone? mDNSResponder is Open Source - I seriously question how some independent reearcher can have, as he claims, a test base of 1500 systems. A big company with $1million to throw around might have that, or a university, but I seriously doubt he has the place or resources to afford a test base of this size unless he is using a local university or school, and judging by his spelling and grammar, he is either not English native or he is a teenager, or both. That says nothing about the veracity (truth) of his claim but it is somewhat juvenile, the whole thing.
IMO the really funny thing is that this joker decided to use a Bonjour vulnerability to work on, when everything I've heard indicates a major reworking of the Bonjour code in Leopard anyway.
Isn't this kinda like working out a vulnerability in AppleTalk a month before they stopped using it?
The Windows camp has nothing to gloat about as long as I'm getting a hundred spam messages a day from compromised Windows machines.
Most of the stuff on
I frequently hear the old chestnut that the only reason Macs aren't infested with malware is their lack of market share. Whether true or not, it's a funny argument, especially if the person using it is defending their choice of Windows.
"I'm not going to use Mac because while it may be clean now, I could get covered in shit at any time!"
"But you're already covered in shit".
"Errr... yes. But I'm sorta used to it..."
Take ActiveX as one of the main examples: it enables you to do some tricks easily because you can run executable code from a browser, but the security for it sucks (as evidenced by the number of patches/security updates that were always being released for it a few years ago).
Erm, what do you think browser plugins using NSAPI do?
I have no doubt that OSX is more secure than Windows - how could it not be? Maybe a silly attitude since I don't know much about BSD, or what Apple changed to make the OS more user friendly (maybe they added in something equivalent to ActiveX that gives nice fancy features but poor security?), but I find it hard to believe that any recent OS could be worse than the mess that is Windows. And I hope there never will be.
OS X probably is more secure, at least than XP if not Vista, because of obscurity. On a technical level, browser plug-ins are technically similar to Active X, in that they give nice features, but allow foreign code to execute it the browser process (ie the plug-in code), so if there's a bug in that code, a malicious website can potentially take advantage of it to hijack the browser process, and then do anything that process can do (which on OS X is, I think, anything the owning user can do -- Vista runs at least IE processes with more restricted security, so hijacking the browser process is of limited value).
This could be a big problem on some university campuses, however. Mine, for example, has a huge flat-topology network that was deployed in the '80s (maybe before) and has been upgraded piecemeal without anyone really knowing how the whole thing fits together anymore. When I plug my laptop in, I get around 10KB/s of background traffic sent to the broadcast address hitting me. Running tcpdump shows that most of this is iTunes DAAP. Does this exploit also run on Windows? Apple bundle MDNSResponder with iTunes on Windows, so if that's where the exploit is then it could also be a problem there. It might also be a problem on other *NIX systems that bundle it, since Apple have released it under an Apache 2.0 license (cue all the 'Apple just takes from Open Source and never gives anything back' trolls).
I am TheRaven on Soylent News
The only people I always see spouting such crap are the people who claim to hate Apple fanboys. I've never seen an Apple fanboy make absurd claims like yours. This is like a fucking self-fullfilling prophecy. Every damn article about Apple is run over by stupid Anti-Apple trolls who write hundreds of comments laughing about imaginary Apple fanboys and the imaginary stupid things they say.
Here's an idea: Shut up, and let those who are interested in the article discuss it. Thanks.
Even assuming he hasn't made up that bit, I'm sure some of the real, ethical researchers looking at the mDNSresponder source code right now will figure out what he's hinting at.