Slashdot Mirror
Ex-NSA Researcher Claims That DLL-Style Attacks Work Just Fine On OS X
An anonymous reader writes Ex-NSA and NASA researcher Patrick Wardle claims to have developed a reliable technique of Shared Library replacement which renders Apple's OSX operating system just as vulnerable to exploitation as Windows has been (via its 'DLL' shared libraries) for years. Speaking at CanSecWest, Wardle explained that Apple's refusal to encrypt software downloads via its App Store allows an attacker on the same network to inject a malicious 'dylib' (shared library) without altering the hash of the legitimate-but-vulnerable software, thereby leaving the Developer ID signature intact. Wardle ran a crafted Python script on a typical Mac and discovered 150 dylib-dependent applications, including Apple's own Xcode developer environment — revealed last week by Edward Snowden to be a priority target for the NSA due to its ability to propagate compromised software.
don't the shared libs need to be signed.
Of course the problem is that when you make signing mandatory you make everyone pay for a cert.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
...an attacker on the same network...
In most scenarios, unless you have an NSA mole in your home/business, Isn't that basically the same as requiring direct access to the machine? Or are we just talking about "on the same planet" type of access?
I tend to agree with Apple on this one; there shouldn't be any need for HTTPS as the contents of the packages aren't meant to be secret. If this researcher was successful in his attempts to replace the shared libraries in a dmg package the problem is that the installer isn't checking for the signature on the dmg, or individual signatures of files within.
tldr; so long as proper signatures are in place and handling is observed traffic interception is not a problem as it will be caught and the hijacked package discarded.
Note that proper signatures are more secure than HTTPS, as the trusted Root CA list is necessary for HTTPS to work, and who really thinks that Verisign or the like would turn down a request from the US Government?
there are lots of shared object files in /usr/lib/[some-file-name].so
arent those the equivalent of dll files? or close to it?
Politics is Treachery, Religion is Brainwashing
The NSA is an intelligence gathering agency and not an entity that produces software for sale or use outside of their own organization. Therefore the concept of it ever adding 'features' to software is nonsensical. That meme really only is applicable to companies that produce and sell products to consumers and screw up their own products.
So you never heard about the NSA involvement in IPSEC or various other crypto standards, that in retrospect seem to be unnecessarily vunerable?
Watch this Heartland Institute video
If they don't want to sign the dll's, then at least they should be able to provide the MD5 checksums for them so folks can check if their machine has been compromised.
MD5's? Do you work for the NSA or something?
http://www.hotforsecurity.com/blog/md5-hash-broken-via-collision-attack-of-less-than-1-10775.html
Watch this Heartland Institute video
I think he probably meant SHA512 hash, but didn't know he meant it.
renders Apple's OSX operating system just as vulnerable to exploitation as Windows has been
Another arrow for my quiver, and I get to say I told you so.
Shit has always been insecure, remember? It relied on the fact almost no one used Apple "security through obscurity".
https://pbs.twimg.com/profile_...
"If any question why we died, Tell them because our fathers lied."
XCode is pwned. Android Developer Tools are unsigned. The Android SDK and tools are unsigned. That makes me sad because I work with these tools. I can assume my systems are all pwned at this point and act accordingly...
The degree of response by our government to terrorism does not seem to be justified. We did lose some large buildings and a few aircraft but considering the size and nature of the US the 9/11 attacks were simply a very limp effort and came far from doing major damage to our nation. The three trillion dollar expense of our wars in the mid-east have surely done us more harm than the attacks. And one can only wonder about the massive expense of all the spying that is going on. I also wonder why, considering all the information police agencies have gathered why we are not seeing huge numbers of arrests for mundane criminal activities. One would think that drug dealers and drug runners would be buried under our jails already. And income tax cheats as well as those who make a living from crime should be vanishing as well. With data mining how hard can it be to find people who are living well beyond their reported income?
The NSA did SELinux and probably similar in OS X, which has strengthened the operating systems by a large margin... something running as root doesn't have full root access unless it has the right role.
IMHO, the NSA isn't all bad. I'd say they have done more in keeping the bad guys out overall.
Two hashes are better because if one algorithm fails, you have a backup. However, with CPU and I/O time so precious in most cases, two hashes are not really feasible.
Were I going with an algo, I'd be using SHA3 or Skein, something that is as secure as one can get presently.
It would be nice to see some improvements in OS X security though just to keep ahead of the bad guys:
1: A TPM chip that can be used with FileVault 2 for additional protection (so a Mac can be set to ask for a boot password which can be a log longer than the user password.) The TPM chip would also combat brute force attacks. Since all Windows 8.1 certified machines have to have a TPM 2.0 chip, and Apple uses x86 hardware, might as well use this functionality, as it is pretty much built into all new PCs.
2: Apple should look into SED (OPAL SSC 2) functionality for their SSDs.
3: If Apple can't put in a Kensington lock slot, then why not they design something for basic physical security?
The goal isn't to keep away the guy with the blowtorch or plasma cutter, but so that one can be sitting at a table at a library, tie the laptop to the table, go use the restroom and come back, and the laptop would still be there. Yes, one can buy a PacSafe laptop bag that can be chained to an object... but shouldn't a multi-thousand dollar piece of gear at least have a little bit of design for anti-theft, even if it is a small piece of metal that flips out for a lock slot? Thin is in, yes... but Dells, HPs, and other laptop brands have similar dimensions of machines, but they can put a Kensington lock slot on their models.