Slashdot Mirror
Worm Threat Forces Apple To Disable Software?
SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"
Come here Apple fanboys-and-girls. Lunch is served.
Researchers find hole, act like 1337 733ns about it. Company can't be sure that they've fixed hole, so they temporarily disable the reportedly-vulnerable function.
Yawn.
The real litigious bastards...
Apple find a vulnerability (before the worm is announced, according to TFA), and remove that vulnerability in their next security update.
I'm guessing there's a regular scheduled security update process in Apple. If you can't fix it in time for the next patch-release, isn't is *better* to temporarily disable it ? I really doubt it's a permanent removal of the feature - they're just being responsible.
Simon.
Physicists get Hadrons!
I'm sorry but the article must be a lie. The Apple fanboys assure me that there's no risk of vulnerabilities. Therefore, the article is wrong - it does not exist.
Conor "You're not married,you haven't got a girlfriend and you've never seen Star Trek? Good Lord!" - Patrick Stewart
I often wonder why the British (and now some Americans) say "Apple go on to identify..." Apple is ONE company. Shouldn't that be the singular "Apple goes on to identify"? If it were both Apple and Microsoft than indeed it would be "Apple and Microsoft go on to identify".
Yes, Apple is made up of many people; but my car is made up of many parts. You don't say "my car need gas" do you?
This perplexes me, can someone explain it? Sorry if it's completely OT (except that this (to me) error is in the blurb).
-mcgrew
(amusingly, the capcha is "contrary". Again sorry for being OT)
So an "apple" is threatened by a "worm"... you don't say.
-zariok-
Isn't mDNSResponder and Open Source package ported for OS X?
n jour.html
http://developer.apple.com/opensource/internet/bo
Is Apple the developer of mDNSResponder or are they just using it?
I might know what I'm talkin' about, but then again, this is Slashdot...
Hey Zonk, how about using more reputable sources than one guy's blog for your links? I know they were picked by the submitter, but linking only to a blog and then putting a question mark after the headline is sketchy. I can't put much faith in the article if I can't be sure that it's not just a blogger talking out of his ass.
I mean, it was a given that, given increasing market share, Apple becomes interesting for malware. No system is 100% secure.
But at least they decided that it's better to disable the feature and minimize the damage to the net as a whole (and yes, even if you don't have an Apple, a worm damages you by clogging your tubes with packets trying to spread itself). MS decided that it's better to keep the insecure service up and running 'til it can be addressed.
Question for 100: Still getting sober/blaster packets? I do.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
A) Pick a feature that's dumb. (like embed a scripting language into an image format, or give a spreadsheet scripting language access to the filesystem)
B) Choose to preserve the dumb feature in spite of known security problems.
C) Treat the resulting backlash as a "PR issue" rather than a technical one.
D) Sometimes, if the backlash gets bad enough, they'll hack in security restrictions in response to specific known implementations that take advantage of the vulnerability rather than fix the vulnerability. EG: fixes that look for a XXX worm trace, rather than fix the thing that XXX worm exploits. (See anti-virus)
Apple is doing the right thing, here, folks! It may or may not be that the feature mentioned is analogous to (A) above. Either way, Apple is chosing security over features, even though features are important.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
1. Implement it to Microsoft's spec.
2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
3. Implement it securely.
Choose only one.
I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.
Clearly something is unclear since iChat is obviously still using UPnP IGD, likely as a client?
But why is the mDNSResponder using UPnP IGP anyway? mDNS is for service discovery etc and is basically a competitor to UPnP (I thought). Perhaps there is a way for mDNSResponder to leverage UPnP IGP to broadcast service messages (e.g. bonjour) across a local NAT? If so I've never seen nor heard of this working -- so perhaps what they're disabling is vulnerable code that wasn't doing anything anyway?
... that the iPhone will be the vector that finally gets Macs infected with a virus/worm that will replicate in the wild?
I bet there's a secret cabal at Microsoft that is working on this very thing.
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
"Hi, I'm a Mac"
"And I'm a PC. Hey Mac, I heard you don't get viruses. Congratulations."
*PC Shakes Mac's hand*
"That's right, PC. But I do have worms."
*PC starts wiping hand furiously*
Blank until
Now that Apple has disabled uPnP compatibility will the original anonymous extortionist reveal the hole that he claims he didn't want to reveal lest Apple come up with some excuse for not disabling whatever his hole was, or will we hear more FUD from him?
UPnP kind of sucks anyway. Maybe this will get people to move to MDNS-SD, which is simple, straightforward, has several implementations (both open source and not).
Can you show me an implementation of UPnP that hasn't had bugs? According to wikipedia security is a problem with the spec itself. It's getting so bad that some major router manufacturers are disabling the routing of UPnP packets by default on their non-consumer (and a few consumer) networking appliances.
And my list was more of a dig at OOXML rather than being security related.
Realistically, no OS is completely secure. This is hardly the first security issue in OS X, nor will it be the last. Linux has had its share of security flaws, too.
In the modern world, there are simply too many protocols and systems popping up; no operating system exists in a vacuum, and many vulnerabilities may be in services, subsystems and so on. And with the pressure to get things out and shave off extra CPU cycles, there are too many situations where someone simply goes 'oh, well, I checked that this data is valid up HERE, so I don't need to check again down here in this function I call later,' and then later another piece of code goes, 'oh, look, here is a function that does what I need, I will just reuse it' and assumes that function does its own error-checking, so does not check the data before passing into it. And thus, you create a pathway where unvalidated data gets passed down and can cause buffer overflows or whatever.
No operating system or development team is somehow inherently immune to this.
The thing is that Windows not only has kept large chunks of legacy code -- which makes it hard to really break down and restrict user permissions without breaking older programs -- but spent some time really pushing the Active X technology, which then proved to create a lot of problems. Apple, on the other hand, went off the tracks entirely and threw out their operating system; that was a risky move which could have killed them off entirely, but in the end they got an operating system which was built atop a multi-user system with better permissions.
That does not mean that Apple somehow writes inherently better code than Microsoft; I happen to like OS X, but Apple's engineers are not necessarily smarter or more careful in the actual lines of code they write. The difference as I see it is that Microsoft is bogged down by hard-to-debug and support legacy code, while Apple got to make a cleaner start... and then on top of that, many bits of OS X (CUPS, zeroconf/Bonjour, WebKit, etc.) are open source.
Apple contributes funds and engineering to these projects (and in some cases such as zeroconf, came up with the original specifications), but as they are open source things tend to get found and fixed faster in community review. That is why OS X, while not bulletproof, tends to be at least a bit more secure than Windows.
That is my take on it, anyway.
--Rachel
"OS X is every bit as crash prone and unreliable as Windows" (It's crash prone, but not "every bit as crash prone")
"not so with Apple, which radically changes their OS every few years" (Two points here: 1. if this is true, it belies your following statement 2. it's not true)
"There is no inherently superior security in OS X" (the overall design and implementation of OS X is more secure than the overall design and implementation of XP. Vista is a vast improvement over XP, but it remains to be seen how this works out)
"those people who blame Microsoft for vendor lock-in" (straw man, no one claims this)
"OS X is the ultimate in vendor lock-in" (OS X is an extremely open system. The only "lock-in" is with their hardware, which really isn't that big of a deal.) For someone who claims to be fighting against religious zeal, you sure come across fanatically angry. You make the basic fallacy that, "Windows is flawed, OS X is flawed, therefore Windows and OS X are equally flawed," which is complete nonsense.
There are people who get fanatical about Macs, but you're lumping a whole lot of rational people in with them, and fully deserve flaimbait or troll modding for it. the minute you take a bite of the precious worm-ridden Apple, mods put you to sleep for a year No, stupid shit like, "eat crow" gets modded down. Eat crow for what? A security flaw existed? It was patched? WTF? A lot of anti-Apple sentiment gets modded up, as well, though generally the more rational stuff, like people complaining about vendor lock-in (like you did above) or various other things that actually make sense.
Not to mention the fact that both you, and the OP are both (at present) modded positively, which makes your cries of being oppressed a bit silly.
mDNS - Apple
UPNP - Microsoft
Apple have disabled the Microsoft protocol. Won't affect them in the slightest I'd expect.
mDNS is actually fairly useful.. you can advertise servers across the network using it, and it's an easy protocol to implement (a few hundred lines of code will do it).
UPNP is an XML infested mess with a huge spec that I wouldn't try to implement unless I had a deathwish. And in all that mess they forgot to add any user or machine verification.. the upshot being if you enable it on a router you can disable its firewall with a 10 line perl script.
Not that I'm defending macs in any way, but you do realize that there have been quite a few remote exploits (in the wild, not theoretical) that require nothing other than having a windows computer online and having its card pulled by another infected machine, right? It's not about if you're "smart" enough not to click on something, but if you were a bit brighter you'd already know that.
Those days are also over (atleast for the most part). Windows now comes with its firewall on by default, and those wide open services have been secured a lot better. It's not just a Windows thing either, I remember the days when a Redhat 5/6 install on the open internet would get pwned rather quickly too.