Worm Claimed For Apple OS X

SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."

Comments

worm in apple?

[linuxmeltz]

Hey, there's a worm in my apple...

Re:worm in apple?

[Anonymous Coward]

... which is much better than half a worm!

Re:worm in apple?

[dotpavan]

when God (Gates) specifically asked you NOT to eat the Apple (Inc), you should have listened :)

Re:worm in apple?

[catwh0re]

While I have no doubt that worms etc can be created for OSX (or any OS, given enough time.) I'm not really fond of companies blowing their trumpet until they're certain. It's very rich to claim all that publicity without notifing the vendor, or even being 100% certain. Otherwise it comes across as yet another company that is trying to claim solely for the benefit of the massive attention that it will draw on the company. Whether it's a fiasco involving wifi hardware or an antivirus company claiming endless vulnerabilities to sell their "protection tools". The apple community is well versed in frauds and half-truths spun as a "massive vulnerability" who cry wolf.

Re:worm in apple?

[Anonymous Coward]

Does that make Jobs the Snake? That does explain why he slithers.

Re:worm in apple?

[Anonymous Coward]

Your opinion? Is it the result of envy because a mac user spends more time using their system productively instead of configuring it? Those that spend all day configuring their system, installing software they'll never use and reinstalling stuff for "fun" are obviously envious of the productive mac users who spend their computer time creating content and not just playing with the content designed by others.

Hey, be nice now!

[Anonymous Coward]

It's not a flaw; it's a feature. Remember, things are a little different in the Apple world ;)

*ahem*

[Duncan3]

As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm.

If by fully testing you mean "auctioning it to the highest bidder" then yea.

temporary work-around

[mzs]

Disable mDNSResponder:

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

Re:temporary work-around

[dch24]

Very good. That might disable the security hole, if what has been disclosed so far is 100% accurate. If not, well, all you lose is Bonjour (useful for discovering iChat and iTunes connections on your local subnet).

I question the ethics, and my legality

[Swift2001]

First of all, if he's found a real vulnerability, he reports it. I don't care if it's Apple or Linux or even Windows. "Waiting until I finish it" is a disgusting excuse. Will he sell it to the bad guys? Is this free publicity for some jerk? I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.

Re:I question the ethics, and my legality

[Tobenisstinky]

Good idea. However, a serious discussion on /. is unlikely.

Re:I question the ethics, and my legality

[Mr. Flibble]

I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.

I agree. We should also question the ethics of Theo de Raadt. After all, this guy published an exploit for OpenSSH. Who does this guy think he is? Hell, he should have given the problem to the developers of OpenSSH to fix it, not be out there releasing exploits and stuff.

Re:I question the ethics, and my legality

[QuantumG]

Sounds like a great plan. Make it compulsory to report vulnerabilities eh? Maybe even ban the selling of vulnerabilities. Kinda makes you wonder why any third party would bother looking for them.

Re:I question the ethics, and my legality

[QuietObserver]

From my point of view, the original argument never said anything about making vulnerability reporting compulsory, but that concealing a vulnerability is morally reprehensible, and claiming to keep a vulnerability secret until an exploit is finished is a disgusting excuse.

Re:I question the ethics, and my legality

[fox1324]

If what he's doing isn't illegal now, maybe it should be.

Maybe it shouldn't be. There are hundreds of /. threads filled up with complaints about the US government and legal system. Our rights are constantly eroded by attempts to 'legislate morality'. Repeat with me: just because something is unethical or immoral does NOT mean it needs to be illegal. Ethics and morals are nothing more than opinions, and they vary greatly from person to person.

Neglecting to report a vulnerability is not remotely criminal, no matter how much you disagree with his motivation.

Re:I question the ethics, and my legality

[samkass]

I'm sure you're trying to be sarcastic, but it would DEFINITELY be a good idea to include everyone from your random teenage mom's basement hacker to Theo de Raadt in the discussion. Just because someone has done great things for the community it doesn't mean he's going about addressing exploits in the best way.

Re:I question the ethics, and my legality

[QuietObserver]

The only way for a person to improve is to receive constructive criticism and to listen when others point out their failings. I personally listen when others point out my mistakes, and do my best to correct them, so I likewise believe that concealing information for the sole purpose of one's own advantage, without consideration for anyone who might be hurt because of one's actions, is immoral. Furthermore, I don't understand how you can consider the creation of malware a complex issue; in the long run, no matter how well intentioned the creator is, malware inevitably harms the population as a whole, and all in all, that sounds pretty simple to me.

Re:I question the ethics, and my legality

[QuantumG]

And that's the problem. You want to look at it in simple terms instead of considering the whole issue.

Apple and other software vendors have chosen a development model that maximizes their ability to hide defects in their software. If people are morally obliged to report any of the defects they independently find in the software then the vendor has no incentive to ensure the defects are found before the product hits the market. To put it another way, time to market is much more important to them than making a product free of defects. The only thing that motivates them to ensure their products are defect free is malware. As such, creation of malware actually *helps* to make the vendor take more responsibility for the defects in their product.

Re:I question the ethics, and my legality

[MadMidnightBomber]

Because Congress is well known for its mature and insightful discussion of computer and network security issues.

Tipping the scales?

[dsdtzero]

The fact that the breaking news on slashdot is "someone found the third way to attack a mac machine" is a compelling argument to purchase a mac over a PC. Unless someone can explain to me how this is the seed of an impending snowball of mac-targeted malware.

Re:Tipping the scales?

[Daniel Dvorkin]

Yes, exactly. Three proofs of concept vs. thousands, maybe millions, of vulnerabilities in the wild.

The author claims, "While it is nothing special compared to Windows based Malware it does prove a point -- Apple Computers are just as susceptible to Malware as Windows based ones." Oh, bullshit. The fact that this particular security vulnerability exists does not mean that OS X is just as much a wide-open target as Windows is.

In the "Classic" MacOS days, there was a fair amount of Mac malware -- never as much as in the PC world, of course, but plenty of it running around. Since OS X became the standard, this hasn't happened. The "vulnerability through popularity" argument just doesn't hold up to this fact.

Re:Tipping the scales?

[toadlife]

In the "Classic" MacOS days, there was a fair amount of Mac malware -- never as much as in the PC world, of course, but plenty of it running around. Since OS X became the standard, this hasn't happened. The "vulnerability through popularity" argument just doesn't hold up to this fact. Why not? OSX has never had nearly the same install-base that classic Mac OS did during it's heyday, and of all the predominant methods that malware spreads simply can't work on OSX like they do on Windows because there are not enough potential hosts.

Take the classic email based worm for example. Given that only about 4-8% of computers run OSX, how would an email worm spread on Macs? If you sent it to 100,000 email addresses you'd be lucky if 8,000 OSX users received the email. If 50% of those 8000 OSX users fell for it and executed the payload, the worm would have to find 25 new email addresses that belong to uninfected OSX users in order to maintain it's population. Otherwise he number of new infections would decrease exponentially until the worm became extinct.

The 50% infection rate and number of new email addresses required per infected host are both unrealistic IMO. More realistic numbers would only serve to further prove my point - that spreading malware to OSX computers is virtually impossible.

Network borne malware is a different story, but that's become an almost non-issue since Windows XP SP2 came out and enabled the firewall by default.

Windows affected?

[nuckin futs]

exactly what vulnerability in mDNSResponder is it exploiting? Since mDNSResponder also runs on windows if you install bonjour for Windows, does that mean it can possibly be affected too?

Okay... let me get this straight...

[Penguinisto]

Serious question here:

Somebody writes a worm for OSX that works across a specific test network (of which we have no clue as to settings, layout, patch levels, etc etc), and it's really, really, really big news. Media orgs around the planet sound the klaxon, and (nearly) everyone gets all hyper-ventilated. Claims of "OSX is just as vulnerable!!!1111!!" will fly off the pages.

Meanwhile, the next near-periodic iteration of MSFT-specific malware in-the-wild will get not so much as a grunt outside of security circles (such as SANS ISC and F-Secure's blog as ferinstances). It will likely subvert 40x as many victims in its first hour, and the media won't say so much as 'boo' about it.

Perspective (at least outside of security and some geek circles)? Never heard of it.

/P

Re:Okay... let me get this straight...

[Trillan]

I don't see any suggestions this be buried, only that it be kept in perspective. (Which, I'll grant, is impossible.)

Re:Okay... let me get this straight...

[BlueDjinn]

I don't know of a single Mac user or vendor who has ever claimed that OS X is *COMPLETELY* invulnerable to viruses/etc, only that there hasn't been a demonstrable, malicious, in-the-wild true OS X virus released YET, which is true.

Major difference. In fact, every Mac user I know expects a "true" virus or two to show up for OS X sooner or later, but what of it? So the ratio will go from a bazillion to zero to a bazillion to one or two.

Apple has roughly a 2.5% worldwide market share--wake me when they have anywhere close to 2.5% as many viruses as Windows and I'll start being overly concerned.

Is mDNS even routable?

[MBCook]

I was under the impression that mDNS was not routable (and specifically designed not to be routed). If that is true, doesn't that restrict this to propagating to computers on the same subnet? This could effect a business, or a computer lab (say at a university), but this fact should prevent it from spreading around the internet at large (as various Windows worms have).

It's a bug, it's a problem, but it's no Blaster by a long shot.

Re:Is mDNS even routable?

[dch24]

Bundle it with a Windows worm. Exploit Macs on the same subnet as Windows boxes. Then the infected Macs scan for vulnerable Windows boxes and spread the infection. Every vector is useful in an attacker's bad of tricks.

Re:Is mDNS even routable?

[anticypher]

Multicast packets are routable, if the upstream routers support dealing with multicast packets correctly.

mDNS/bonjour/zeroconf detects if a packet has crossed a router by setting the originating TTL to 255. If a multicast packet crosses a router, the TTL is supposed to be decremented, and zeroconf is supposed to ignore the packet as it is no longer considered local. Many suppositions there, as implementations vary.

Worse, starting with a TTL of 255 means that the packets will be able to go anywhere on the internet where multicast packets can get routed. Better protected carriers will drop multicast packets with TTLs greater than 64 or 128, specifically to limit mDNS/zeroconf traffic while allowing reasonable traffic to flow. Most ISPs don't have the technical competence to deal with multicast, so they just block it, which will limit any spread of an mDNS worm.

However, just because mDNS/zeroconf will ignore packets with TTL less that 255, doesn't mean that a buffer overflow bug isn't being treated by the protocol stack. Take a wait and see attitude on this disclosure, as it appears to be an extortion attempt rather than something from legitimate sources.

the AC

It doesn't

[SuperKendall]

Doesn't mean you can't build them. Just means none are released in the wild, true to this date.

Local network only - depends on mDNS

[mbessey]

So, not quite like the Internet-spanning, DDOS-producing Windows worms we've come to know and hate. I'm not too surprised the vulnerability was in MDNSResponder, though. Someone I work with found a few problems in the code when running it on Linux.

Market share?

[Dan_Bercell]

I havent really looked at the market share percentages of OSes recently, has Apple really grown large enough for Virus makers to start targeting Apple?

Re:Apple Coded

[Trillan]

mDNSResponder is open source.

Re:Can this travel via "broader network segment"?

[greed]

Sure, get infected on the school's lab LAN. Bring your iBook oops MacBook to the coffee shop and get everyone else there. They all go home and infect their room-mate's machines. Who go to a different lab and it gets loose on the LAN there.

Most laptops aren't isolated to a single LAN these days; they move around. If there really is a flaw in mDNSResponder, then such a worm does have a chance to propagate. Especially if it is subtle and doesn't crash or overload machines, or do insane amounts of network I/O, or any of the other things that cause people to think something's wrong.

Have mDNSresponder run without root privileges

[e. boaz]

If this is a real concern, there is a workaround to have mDNSResponder run without root privileges. Part of the claim is that they can deliver root payloads - this is likely because mDNSResponder runs as the root user and they might be using a buffer overflow exploit [NOTE: I have not analyzed the mDNSResponder code - this is a guess.]

% sudo launchctl unload /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist
% sudo chown nobody:wheel /usr/sbin/mDNSResponder
% sudo chmod 4750 /usr/sbin/mDNSResponder
% sudo launchctl load /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

If someone wants an explanation of what the above commands accomplish, please read further.
1. launchctl is used to unload and load the mDNSResponder daemon.
2. We change the owner of the mDNSResponder to nobody and ensure that wheel is the group. The group is used to ensure that members of the wheel group may launch mDNSResponder and not other users of the system (with the exception of root and anything else running as nobody.)
3. We change the permissions of the mDNSResponder program to be setuid nobody. This means that mDNSResponder will run as nobody and only be able to affect files owned by that account or by files it may happen to have write privileges against.

Re:Root Account Disabled...

[Mr2001]

No, just because you can't log into the account doesn't mean it doesn't exist. Type "sudo sh" and enter your password - presto, you're running a shell as root. Exploit any service running as superuser and you can do the same thing.

1500 Test stations?

[theolein]

Apart from the claim by infosec sellout sounding less than adult - he says the payload was "weaponised" - and his claim that Apple will somehow not fix the "root cause" of the vulnerability if he gives it to them now - extortion anyone? mDNSResponder is Open Source - I seriously question how some independent reearcher can have, as he claims, a test base of 1500 systems. A big company with $1million to throw around might have that, or a university, but I seriously doubt he has the place or resources to afford a test base of this size unless he is using a local university or school, and judging by his spelling and grammar, he is either not English native or he is a teenager, or both. That says nothing about the veracity (truth) of his claim but it is somewhat juvenile, the whole thing.

Dear Apple Inc

[deke_kun]

Seriously, sit down with this guy. Put a suitcase full of large bills on the table, and tell him it's his if he can prove it works. And then, give the guy some incentive to continue to disclose his so-called "root causes". He is CLEARLY a total whore for cash, which means he is easily bought. You have pockets deep enough, you just sold a bojillion iphones, so buy this guy. If he's full of crap, make the fact that you wanted his "root cause" and he couldnt show you it publicly known, then he gets shamed into STFU and stops spreading FUD. If he does show the root cause, then great, put him on retainer and continue to have a fantastic OS. I know jobs likes to do things all secretive and on his own terms, but this is a public perception issue, it needs to be handled in the public eye. Get on the private jet and go see this guy in person, use the RDF to mess with him and get this shit cleared up. Microsoft got into the situation they're in now by ignoring things like this and pulling the secretive garbage, you don't wanna go down that road, otherwise this crap will get out of hand.

also quite useless

[Jeremy_Bee]

IMO the really funny thing is that this joker decided to use a Bonjour vulnerability to work on, when everything I've heard indicates a major reworking of the Bonjour code in Leopard anyway.

Isn't this kinda like working out a vulnerability in AppleTalk a month before they stopped using it?

Re:also quite useless

[zootm]

Many of the major Windows worms and so forth target vulnerabilities which have already been fixed (and the fixes pushed out) months before. Not only will many not upgrade to Leopard, if the OS X userbase is similar to the Windows userbase (I'm not sure if it is, but still), many will simply not click the button to install the updates, and leave themselves vulnerable.

Re:That's not true...

[kestasjk]

That's impossible! It's possible, but:

• It doesn't exist in the wild; this is because of OS X's stunning security features
• This vulnerability was probably placed into the system by Jobs himself. If there were no vulnerabilities in OS X people would realize Jobs was supernatural, so he has to put one in there from time to time.
• This vulnerability is probably the last vulnerability in OS X. Once Apple fixes this there'll be no more
• Way, way more vulnerabilities are found in Windows and Windows products; this is because of OS X's breathtaking security features
• This is probably a bug in BSD or Mach code, or one of the recent Intel chip bugs, or a Microsoft employee infiltrated the Cupertino campus. It's not Apple's fault.
• Microsoft spends its entire R&D budget looking for these elusive Apple holes just as a way of discrediting Apple. If the real number of Microsoft and Linux vulnerabilities were actually disclosed there would be no comparison.
• Apple puts the occasional vulnerability in its system because they know that Microsoft blindly copies anything Apple does. If Apple puts one bug into their system they know Microsoft will put 10 bugs in theirs.
• Microsoft worms spread spambots and steal credit card information, Apple worms are just a misguided attempt of a loyal Apple fan to spread the good vibes and let the community know he cares. With Mac OS X only your unquestioning loyalty is contagious.

Such a breathtaking OS on a rock solid foundation with over 1 million configurations. Say hello to OS X Panda. Starting at $99. Small sentence. Reinvented.

Wow

[Enrique1218]

3 hypothetical worms in seven years. At this rate, I may have to switch to Linux next century!

Re:pfft

[Divebus]

The Windows camp has nothing to gloat about as long as I'm getting a hundred spam messages a day from compromised Windows machines.

Covered in shit?

[GrahamCox]

I frequently hear the old chestnut that the only reason Macs aren't infested with malware is their lack of market share. Whether true or not, it's a funny argument, especially if the person using it is defending their choice of Windows.

"I'm not going to use Mac because while it may be clean now, I could get covered in shit at any time!"

"But you're already covered in shit".

"Errr... yes. But I'm sorta used to it..."

10.4.10

[djahz]

10.4.10 isn`t on the affected systems list.

Re:10.4.10

[fplinn]

wasn't this patched in may ? http://docs.info.apple.com/article.html?artnum=305 530

mDNSResponder
CVE-ID: CVE-2007-2386
Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9
A remote attacker may be able to cause a denial of service or arbitrary code execution
Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue.

Re:rape.osx is fitting

[TheRaven64]

This could be a big problem on some university campuses, however. Mine, for example, has a huge flat-topology network that was deployed in the '80s (maybe before) and has been upgraded piecemeal without anyone really knowing how the whole thing fits together anymore. When I plug my laptop in, I get around 10KB/s of background traffic sent to the broadcast address hitting me. Running tcpdump shows that most of this is iTunes DAAP. Does this exploit also run on Windows? Apple bundle MDNSResponder with iTunes on Windows, so if that's where the exploit is then it could also be a problem there. It might also be a problem on other *NIX systems that bundle it, since Apple have released it under an Apache 2.0 license (cue all the 'Apple just takes from Open Source and never gives anything back' trolls).

Actually...

[LKM]

The only people I always see spouting such crap are the people who claim to hate Apple fanboys. I've never seen an Apple fanboy make absurd claims like yours. This is like a fucking self-fullfilling prophecy. Every damn article about Apple is run over by stupid Anti-Apple trolls who write hundreds of comments laughing about imaginary Apple fanboys and the imaginary stupid things they say.

Here's an idea: Shut up, and let those who are interested in the article discuss it. Thanks.

Closed source software like Sendmail and PHP?

[argent]

The "Internet Worm" targeted Sendmail. Which has proceeded to become notorious for security holes.

The biggest UNIX webserver security holes are due to PHP.

The biggest problem is not "closed" vs "open" source. It's design. Is the API secure (that is, if the implementation is perfect, would the resulting system be perfectly secure)? Does the API fail "open" or "closed"? Is there a mechanism to request trusted access from *outside* the trusted domain? If so, is that enabled by default?

If the answers are "yes", "closed", "no", and "no" then you may have built a secure system.

Surprise, surprise, there's a lot of open source software that isn't secure by that standard, including the much-lauded Firefox. Now don't get me wrong, the surface area Firefox's XPI and the XPI install mechanism exposes to attack is like the radar signature of a stealth fighter, where Internet Explorer's "insecurity" zones and ActiveX give it the radar signature of a flock of 747s, but it's not necessary for either exposure to exist at all.

Open Source doesn't create secure systems. It's a hell of a mitigating factor, yes, but the real source of long-lasting security holes (and we don't know if this is one or not, because the soi-disant "researcher" responsible isn't being open about the vulnerability he's found) is insecure design and a preference for patching particular attack vectors rather than fixing the insecure design. And that isn't limited to closed source systems.