Mac Hole Has Users & Hackers Abuzz

the_syco

[url=http://www.blackcode.com/news/view.php?id=469]blackcode.com[/url] wrote:

Date: Friday, May 21st Source: Wired.com

Malicious script kiddies are reportedly rushing to exploit the first serious security hole discovered in Apple Computer's Mac OS X.
First discovered in February by a German Web designer, but not reported publicly until Tuesday, a vulnerability in OS X opens systems to potential hijackings when users simply visit a website.

Because of the way OS X handles certain protocols, a machine can be commanded through a Web link to run applications, scripts or Unix commands.

Though no victims have stepped forward yet, nefarious uses of the exploit are potentially unlimited. Experts warn machines could easily be hijacked to erase hard drives, spread viruses and spam, and report bank account numbers and passwords.

Apple said it is aware of the exploit and is investigating. "We take security very seriously at Apple and we are actively investigating this potential security issue," the company said in a statement.

The security hole first gained attention Tuesday after Secunia, a Danish security company, issued a security advisory. By Wednesday, Secunia upgraded its advisory to its highest rating because of an outburst of scripts and applications designed to exploit the hole.

"The rating has been upgraded to Extremely Critical because the issues are very easy to exploit and a large number of working exploits are available," notes the company's site.

"A lot of people have been developing AppleScripts to utilize this," said Nicholas Raba, president of SecureMac.com. "It's opened the floodgates. People are going, 'Hey, what can I do with this?' ... I've seen it on several websites."

Raba said the security hole could allow crackers to install backdoors or key loggers (to spy on bank accounts and corporate logins) that would run completely unknown to the user. "It's pretty serious," he said.

Richard Forno, a security consultant, said equivalent vulnerabilities have plagued Microsoft Windows for years, but this is the first "really serious" hole in OS X.

"It's nasty," he said. "This is the first major security exploit in OS X that I know of."

The exploit appears to affect all versions of OS X and all browsers, including Safari, Internet Explorer and Mozilla, among others, according to various Net reports.

The security hole stems from the way Mac OS X handles a pair of commonly used protocols: Help and Disk. When either protocol is invoked by a Web link, browsers launch the Help Viewer program or automatically mount a disk image.

Trouble is, the Help Viewer is set up to automatically run scripts. A Web link invokes the Help Viewer, which runs a script, executing a Unix command. A good example can be found here: Richard Bronosky's script (Mac OS X systems only) invokes Unix's "du" command, which harmlessly reports the contents of a hard drive in the Terminal Window. The script is easily adapted to erase the Home folder.

Secunia representatives were unavailable for comment.

While waiting for Apple to address the issue, experts like Elizabeth Lawley, an IT assistant professor at Rochester Institute of Technology, cautions users to change the way their browsers handle the Help and Disk protocols. Lawley advises downloading a free preferences tool, More Internet, to change the helper applications to non-scriptable programs like Chess. In addition, Safari's preference checkbox -- "Open 'safe' files after downloading" -- should be unchecked.

Apple's statement claims the company has an "excellent track record of identifying and rapidly correcting potential vulnerabilities," but the German Web designer who discovered the hole says he warned Apple in February and was ignored.

LixelPixel, a Web designer who lives near Munich but asked not to be identified, said he warned Apple of the vulnerability through its Bug Reporter system.

LixelPixel said his server logs show an Apple representative visited his website shortly after. But after waiting 10 weeks for word or action from Apple, he posted a public warning advising users on how to close the hole. The warning prompted Secunia to release its security advisory.

LixelPixel said the decision to go public cost him several sleepless nights, but he felt obliged to warn the Mac community before crackers discovered the vulnerability.

"I just feel terrible," LixelPixel said. "I love Apple and I'm actually terribly nervous and sorry about all this.

Hecate

A patch appeared on software update there the other day.

http://www.apple.com/support/downloads/securityupdate__2004-05-24_(10_3_3).html