Worm Threat Forces Apple To Disable Software?

SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"

Comments

*Pulls out a plate 'o crow*

[Anonymous Coward]

Come here Apple fanboys-and-girls. Lunch is served.

News at 11...

[maztuhblastah]

Researchers find hole, act like 1337 733ns about it. Company can't be sure that they've fixed hole, so they temporarily disable the reportedly-vulnerable function.

Yawn.

Re:News at 11...

[gutter]

Hello, Artie McStrawman! Sure, there are a few idiots out there that believe that OS X is infallible - there are also some idiots out there that believe the same about windows or linux. However, you aren't likely to find them around here. You'll find plenty of people that believe that OS X is MORE secure than the some of the alternatives, largely because their heavy use of open source and their default configuration that ships with no open ports, but very few that think it is "inherently secure".

The proof is in the number of successful worms and viruses for OS X, which depending on how you define them, hover right around zero. Yes, some of this is likely because of market share, but there's plenty of bragging rights associated with creating the first large-scale OS X compromise, so I wouldn't expect to see none. And of course, even if the relatively low number of security issues is because of market share, it doesn't make it any less pleasant for those of us who use OS X, especially since I'm not expecting it's share to go over 15-20%.

Anyway, if I accept your statement that OS X isn't perfect, will you stop bitching about smug mac users every time there is a discussion marginally related to Apple?

Thanks,
gutter

Re:News at 11...

[sl3xd]

Smugness is in the eye of the beholder; unfortunately, there's often nothing that can be done either way, as a great many people aren't able to accept that something other than their chosen product (or OS in this case) might have something that theirs doesn't.

In other words, Ford Mustang owners tend to see Chevy Corvette owners as smug. Neither side is really willing to appreciate that each has advantages the other doesn't possess, and can't stand it when somebody highlights the advantage. That isn't ever going to change

I don't see how the situation is any different when an operating system is concerned, rather than a brand of vehicle.

Here's a news flash: OS X has advantages over Windows, Linux, and FreeBSD. OS X can brag about security, because there is a far smaller percentage of its users that have infected, compromised, or zombified machines. Ffind reasons to discount that fact is meaningless: It doesn't matter if the number of attackers is smaller; the goal is to not fall victim to an attack, which OS X has an excellent record of doing.

Here's another one: Macintoshes have disadvantages: They don't have as much native software. A virtualization product like VMware or Parallels is a rare sight on Windows, yet is quite common on a Macintosh. There's always some app that only exists for Windows that the user can't live without. So Mac users not only pay $130 for OS X, but also $80 for a virtualization product, and then they have to buy the most expensive license for Windows. Mac software doesn't enjoy the "freedom" that most Linux users enjoy; much of the software for the Mac is closed-source.

Still, you don't have to like it when OS X users dismiss the advantages of other OSes (like the amount of software for Windows, or the freeness of Linux).

Just take the time to realize that's it's a different flavor of the time-honored "Chevy vs Ford" debate. What is "better" depends on the way the beholder sees things, and it's childish to believe that there's only one true way.

Um, so ?

[Space cowboy]

Apple find a vulnerability (before the worm is announced, according to TFA), and remove that vulnerability in their next security update.

I'm guessing there's a regular scheduled security update process in Apple. If you can't fix it in time for the next patch-release, isn't is *better* to temporarily disable it ? I really doubt it's a permanent removal of the feature - they're just being responsible.

Simon.

Apple ... Worm

[zariok]

So an "apple" is threatened by a "worm"... you don't say.

Sensationalism by Zonk

[Night Goat]

Hey Zonk, how about using more reputable sources than one guy's blog for your links? I know they were picked by the submitter, but linking only to a blog and then putting a question mark after the headline is sketchy. I can't put much faith in the article if I can't be sure that it's not just a blogger talking out of his ass.

Apple did the right thing

[mcrbids]

Yes, I understand that there are certainly dissenting opinions here. But (IMHO) the thing that most Slash-bots complain about is that Microsoft will

A) Pick a feature that's dumb. (like embed a scripting language into an image format, or give a spreadsheet scripting language access to the filesystem)

B) Choose to preserve the dumb feature in spite of known security problems.

C) Treat the resulting backlash as a "PR issue" rather than a technical one.

D) Sometimes, if the backlash gets bad enough, they'll hack in security restrictions in response to specific known implementations that take advantage of the vulnerability rather than fix the vulnerability. EG: fixes that look for a XXX worm trace, rather than fix the thing that XXX worm exploits. (See anti-virus)

Apple is doing the right thing, here, folks! It may or may not be that the feature mentioned is analogous to (A) above. Either way, Apple is chosing security over features, even though features are important.

Re:Hmmm...

[shawnce]

An Apple employee (Stuart Cheshire) is one of the authors of the RFC(s) related to mDNS, etc.

mDNSResponder originated from Apple.

Re:Standard Operating Procedure?

[Rosyna]

I'm not opposed to temporarily disabling functionality to fix something potentially disastorous. There are three options when implementing UPnP:

1. Implement it to Microsoft's spec.
2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
3. Implement it securely.

Choose only one.

I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.

Re:Standard Operating Procedure?

[Rosyna]

I call bullshit. You are saying it's not possible to implement UPnP without being vulnerable to a buffer overflow that may lead to remote code execution? Because that's one of the (at least) two issues at hand. Nice try on passing the responsibility for this bug to the spec writers (mentioning Microsoft seems to help too), Uhm, UPnP is a microsoft created and controlled spec, this is why I specifically mentioned Microsoft. Some people think it's not microsoft related because Microsoft hides their name from being easily found on the site (they do the same thing with the Zune). But, do a whois on upnp.org or look at many of the UPnP documents and you will see Microsoft's name plastered all over.

Can you show me an implementation of UPnP that hasn't had bugs? According to wikipedia security is a problem with the spec itself. It's getting so bad that some major router manufacturers are disabling the routing of UPnP packets by default on their non-consumer (and a few consumer) networking appliances.

And my list was more of a dig at OOXML rather than being security related.

Re:wait a minute

[Sparks23]

Realistically, no OS is completely secure. This is hardly the first security issue in OS X, nor will it be the last. Linux has had its share of security flaws, too.

In the modern world, there are simply too many protocols and systems popping up; no operating system exists in a vacuum, and many vulnerabilities may be in services, subsystems and so on. And with the pressure to get things out and shave off extra CPU cycles, there are too many situations where someone simply goes 'oh, well, I checked that this data is valid up HERE, so I don't need to check again down here in this function I call later,' and then later another piece of code goes, 'oh, look, here is a function that does what I need, I will just reuse it' and assumes that function does its own error-checking, so does not check the data before passing into it. And thus, you create a pathway where unvalidated data gets passed down and can cause buffer overflows or whatever.

No operating system or development team is somehow inherently immune to this.

The thing is that Windows not only has kept large chunks of legacy code -- which makes it hard to really break down and restrict user permissions without breaking older programs -- but spent some time really pushing the Active X technology, which then proved to create a lot of problems. Apple, on the other hand, went off the tracks entirely and threw out their operating system; that was a risky move which could have killed them off entirely, but in the end they got an operating system which was built atop a multi-user system with better permissions.

That does not mean that Apple somehow writes inherently better code than Microsoft; I happen to like OS X, but Apple's engineers are not necessarily smarter or more careful in the actual lines of code they write. The difference as I see it is that Microsoft is bogged down by hard-to-debug and support legacy code, while Apple got to make a cleaner start... and then on top of that, many bits of OS X (CUPS, zeroconf/Bonjour, WebKit, etc.) are open source.

Apple contributes funds and engineering to these projects (and in some cases such as zeroconf, came up with the original specifications), but as they are open source things tend to get found and fixed faster in community review. That is why OS X, while not bulletproof, tends to be at least a bit more secure than Windows.

That is my take on it, anyway.