Mac OS X worm maker raps Apple on security
619128
(InfoWorld) - The anonymous researcher who claims to have crafted a Mac OS X worm said Tuesday that he or she will report his findings to Apple Inc., but added that the Cupertino, Calif. company "has a very long way to go" on security. Identified only as the researcher behind the Information Security Sell Out blog, he or she on Sunday announced that a still-unpatched bug in mDNSResponder, a component of Apple's Bonjour automatic network configuring service, could be exploited by a worm. Apple's May security update, dubbed 2007-005, included a fix for the mDNS bug. "[My worm] is in the same code base, obviously, but that is where the similarity to the recently patched issues ends," said the Info Sec researcher in an e-mail interview. "When Apple fixed the previous issues, they did not take care of the entire code base and there are a lot of bugs there...some are exploitable, like the one I am using, while others are not. But the fact remains that Apple did a horrible job in fixing this package." According to Info Sec, the worm is fully automated and ready to use. "It would be considered a fully weaponized exploit and fully automated," said the researcher. "This is really no different than other worms we have seen [on the Windows platform]. Other than that, I am not able to give any more details." Another researcher, however, questioned whether Info Sec crafted the worm in only a few hours, as claimed. "Writing the exploit in one day...unlikely for anything other than a stack overflow," said Dave Aitel, the chief technology officer at Immunity Inc., the Miami Beach, Fla.-based security company best known for its CANVAS penetration testing ("pentest") software. "So most likely he found a stack overflow in mDNS, which is perfectly possible. It is open source, after all." Info Sec didn't detail the vulnerability, but did emphasize that writing the exploit was a breeze. "The hard part is finding the bug," he or she said. "Once you have found it, it is very easy to exploit. The Bonjour (mDNS) service is UDP [User Datagram Protocol, one of the core Internet protocols] Universal as well, making it even more fun for things like worms." But like other researchers who have grown tired of claims that Mac OS X is more secure than rival operating systems, Info Sec saved a last shot for Apple. Although he/she will report the new-found vulnerability to Apple at some point, there is no timetable for the moment. "I do believe in being responsible and working with vendors," said Info Sec, "but I also feel that some vendors need to be treated like children and learn lessons the hard way. Apple has a very long way to go when dealing with security issues in their products." Aitel leaned a bit the same way. In a posting to his DailyDave mailing list Monday in which he pointed out the Info Sec exploit, Aitel said: "I note that 'Infosecurity Sellout' is claiming there is another bug in mDNS which is wormable. This is obviously untrue, since there are no more remote bugs in OS X." That last line was firmly tongue in cheek, Aitel clarified today in an e-mail. "No, I'm just being funny. OS X is horribly insecure," he said. In an e-mailed statement, Apple spokesman Anuj Nayar rebutted. "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users," he said.
268614
A new virus targeting Mac OS X is not expected to cause much trouble. But malcode experts said it should serve as a warning to those using alternatives to Microsoft that their machines are not attack-proof.
749180
The Story: It?s not often that an analyst covering computer security issues tells you that he doesn?t do much to protect his systems. But one reputable analyst I know said just that as we talked about the rising threat of malware aimed at Apple?s hardware. I won?t mention his name, but the gentleman is dead wrong. The days when you can assume that Apple?s products are exempt from harm are over.[ Slideshow: 2007's top underreported tech stories ]                                                    Is it time to panic? No, actual attacks against Macs and the rest of the Apple family, such as the iPhone, are still rare. But as the platform becomes more and more popular, hackers are gearing up to do damage. You?d better protect yourself.?Most Mac users take security too lightly. In fact, most are quite proud of the fact that they don?t run any security at all,? says IDC analyst Chris Christiansen. ?That?s an open door; at some point it will be exploited,? he says.First some numbers: In 2006, the National Institute of Standards and Testing (NIST) tabulated 106 ?vulnerabilities? in Apple?s Mac OS X. (It defines vulnerabilities as a weakness in the code that could be exploited to perform unauthorized, and generally harmful, functions by the application.) In the first six months of 2007 there were 78 vulnerabilities found in Mac OS X. Windows XP (all flavors), meanwhile, had 55 vulnerabilities in 2006 and 19 in the first six months of 2007. Vista, which wasn?t available in 2006, chalked up 19 vulnerabilities in 2007.In a sense, Apple is a victim of its own success. Savvy hackers read the same stories and watch the same television programs as the rest of us, and so they are very aware of the burgeoning popularity of Apple?s products. Hacking Windows still provides a lot more bang per bug than attacks on Apple, but the smaller rival is a more satisfying target than ever before. And the company?s deserved reputation for building good products has probably made users overconfident.?Apple has better commercials, but the Mac is no harder to break into than a Windows PC,? says Gartner security analyst John Pescatore. What?s more, most IT shops can automatically patch large numbers of PCs at the same time, while Macs generally have to be patched one at a time, he said.The Bottom Line: Actual attacks on the Mac platform are still unusual. But as it becomes a juicier target, that will change. Why take a chance? Give a lot more thought to securing your Macs this year.Complete list of 2007 underreported stories: 1.? Java is becoming the new Cobol 2.? Sun Microsystems is back in the game 3.? Hackers take aim at Mac OS X 4.? There are some threats you can worry less about 5.? Companies may have found a way around H-1B visa limits 6.? Open source?s new commercial strategy 7.? End-to-end Ethernet finally arrives 8.? Blade servers arrive for the masses 9.? BI is dead; long live BI 10. Balance of power shifts to software buyers
259181
In early October Apple released a small series of patches for Mac OS X version 10.2 and later. Most of the fixes in this group blocked possible denial-of-service problems that are, to date, theoretical.
227893
Blog: This security update for Windows users piggybacks patches for Apple users.
751466
Shell script disables Mac OS X's built-in firewall, steals personal information and can destroy data.
81490
Five uber updates in as many months Apple has released an update that patches more than a dozen OS X vulnerabilities, several of which can lead to the remote execution of malicious code.â¦
757260
(InfoWorld) - Apple on Thursday unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities, but fewer than one-third of them could lead to hackers injecting their own code into a compromised system. Thursday's release also marked the first time this year that an operating system security update from Apple did not patch a vulnerability disclosed by the January Month of Apple Bugs project. If Apple sorted bugs by a ranking system -- as do other vendors, including Microsoft Corp. -- most of the bugs fixed by Security Update 2007-005 would be rated less than critical. In eight out of the 17, for example, exploits could do no more damage than to generate a denial of service of, or crash, the affected component. Microsoft typically pegs such vulnerabilities as "important" rather than "critical." Only five of the patched vulnerabilities could result in an attacker executing his own code. Among the serious bugs is one in how Mac OS X 10.4, known as Tiger, handles PDF files. "By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution," Apple's advisory said. Attacks sporting this strategy, although rare on Macs, are common threats faced by Windows users, who have had to learn -- sometimes unsuccessfully -- to be wary of unexpected file attachments. Another dangerous flaw fixed Thursday exists in the code that maps ports on home networks in iChat, Apple's instant messaging service and software. An attacker need only send a malformed packet to trigger a buffer overflow, which could then be used to add malicious code to the Mac. The hacker, however, must have access to the local network to exploit the bug. Other parts of Mac OS X that were patched Thursday include BIND (Berkeley Internet Name Domain), the de facto standard Domain Name System server software, which was patched against four vulnerabilities; the Ruby CGI library (two vulnerabilities); and Fetchmail (one vulnerability). Although Thursday's update pushed Apple's year-to-date patch total to over 100, there was a bright side: It included fixes for fewer flaws thanÂ last monthÂ (25) and the month before (45). The security update can be downloaded from theÂ Apple siteÂ or using Mac OS X's built-in update service.
339482
Apple Computer Inc. released this week a security patch for its Mac OS X iChat instant messaging client, which contains a flaw that could a hacker could use to takeover a person&#39;s computer.
643974
Derrick Story writes for the O&#146;Reilly MacDevCenter, summarizing a Mac OS X Tiger preview recently presented to the O&#146;Reilly Mac OS X Conference by Apple product manager Chris Bourdon. [Nov 17]
660602
The security features introduced in Apple&#39;s Leopard operating system need work. That&#39;s according to security experts who have been putting the new version of Mac OS X through its paces since&#160;the upgrade was introduced&#160;last Friday.Leopard introduces a number of important security features to the Mac, but they are often implemented incompletely, leaving users vulnerable to attack, said Thomas Ptacek, a researcher at Matasano Security, who Monday wrote a detailed assessment of Leopard&#39;s security.&quot;They&#39;ve done a really good job of robbing Microsoft advocates of their talking points,&quot; he said. But, &quot;I don&#39;t see anything that they&#39;ve done out of the box, where it&#39;s really any more resistant to attack than Tiger was,&quot; he added, referring to the previous update to Apple&#39;s operating system.According to Ptacek, two of Apple&#39;s key security enhancements -- Sandboxing and Library Randomization -- are great ideas that are imperfectly applied within Leopard.Take Library Randomization. It&#39;s a new feature that&#39;s supposed to make it hard for some of the most commonly used computer attacks like buffer overflows, where the attacker takes advantage of a software bug to place code somewhere in the computer&#39;s memory where he knows it will be run. Microsoft developed a similar technology for Vista, called Address Space Load Randomization. Library Randomization makes it much harder, if not impossible, for the attacker to know where to place this code, reducing the risk of attack.The problem is that Apple did not randomize all of the parts of the operating system that it should have, according to Ptacek. In particular, Apple&#39;s Dynamic Link Library has not been randomized.Security researcher Dino Dai Zovi said he&#39;s used this library in several of the Mac exploits he&#39;s written over the past few years. He has taken advantage of the fact that this library is not randomized, he agreed with Ptacek&#39;s assessment that this feature, as it&#39;s implemented in Leopard, would simply make things a little more difficult for attackers.Sandboxing is another feature that could ultimately make Mac OS X more secure. Sandboxing restricts software running on Mac OS so that even if it&#39;s hacked, it can&#39;t do things that it shouldn&#39;t, such as add new software to the computer. The problem is that Apple hasn&#39;t sandboxed many of the most commonly attacked applications such as the browser, mail client, or instant messaging software, Ptacek said.And the programs that have been sandboxed have not been walled off as thoroughly as they should be, he added.For example, the Quick Look file viewer has been sandboxed, but only to restrict network access. The software can still be misused to write malicious files where they will be automatically launched, Dai Zovi said. &quot;Most of the things that were sandboxed were network services,&quot; he said. &quot;Increasingly these days IM, e-mail and Web surfing are where most of the attacks are coming from, not directly on your network.&quot;Independent consultant Rich Mogull said that his biggest problem was with the Leopard firewall, which he said suffered from a confusing interface that made it very difficult to control access to individual services on the Mac. &quot;It was very complicated and very hard to get the right settings,&quot; he said.Worse, when he installed Leopard, he found himself suddenly without a firewall. &quot;It turned off my firewall when I upgraded, despite that being a default setting.&quot; he said.Like Ptacek and Dai Zovi, Mogull said he had been expecting more from Apple with the Leopard release, but he agreed that the new security features were a step in the right direction. &quot;I think that Apple has started down the right path but they are not as far as they communicated that they would be,&quot; he said. &quot;The firewall is the big negative; they really messed that up.&quot;Apple declined to comment in detail on its new security features. Company spokesman Anuj Nayar said via e-mail that &quot;Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users.&quot;Ptacek said that it is great that Apple has begun adding these security features even when the Mac has not been the target of a widespread worm or virus outbreak. &quot;I&#39;m impressed that when they didn&#39;t have to do it, they went after low-level features that no one will understand,&quot; he said. &quot;I like the direction they&#39;re headed. I&#39;m just saying that they&#39;ve got a long way to go to catch up with Microsoft.&quot;&#160;
505477
SAN FRANCISCO - A computer worm is attacking some business PCs through a flaw in antivirus software by Symantec Corp., a security company warned Friday.
615895
Apple has officially downplayed concerns over the "Opener" malware program designed for Mac OS X, rejecting reports by antivirus companies. Opener, also called Renepo, cropped up in late October after a Mac Web site posted details of its malicious tact to disable the OS X firewall and copy user information to a publicly shared folder.
766050
As Apple continues to grow its worldwide market share and the company's products find their way into more business environments, attackers are certain to follow and create greater volumes of exploits aimed at vulnerabilities in the company's software, security experts contend.
713098
The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.The latest security updates fix 11&#160;bugs in the Mac operating system, including eight bugs in the recently released Mac OS X 10.5, known as &quot;Leopard.&quot; Apple released the security fixes in conjunction with an 10.5.2 update to Leopard, which includes dozens of other updates.Some of the security flaws are extremely serious, and could be exploited by hackers to run unauthorized software on a victim&#39;s computer, although Apple did not report any incidents of this occurring.The patches include fixes for Safari, Mail, Launch Services, the Mac OS Directory Services, Open Directory and Parental Controls. There are also patches for several Unix components that ship with Apple&#39;s software, including a recently patched flaw in the Samba file-and-print software.&quot;The Samba bug was expected, since all the open-source distributions released fixes a while ago,&quot; said Andrew Storms, nCircle&#39;s director of security operations, via instant message.It&#39;s been a busy time for software developers working on some widely used software products.Apple&#39;s patches come a day before&#160;Microsoft is set to issue a massive set of updates&#160;itself. Last week, the software vendor said it expected to release 12 security updates for a variety of products including critical updates for Windows, Internet Explorer and Office.Last week other&#160;critical patches were also released for Adobe Reader&#160;and Apple&#39;s QuickTime media player.&#160;
216524
The top US computer security watchdog issues a warning about a flaw in Apple's OS X software.
89668
Apple Computer Inc. has sued  three men for illegally distributing test copies of the next  version of its Mac OS X operating system on a file-sharing Web  site, court records showed on Tuesday.