Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Amit Singh's Challenge: Find a Decade-Old Bug

Posted by timothy on Wed Apr 13, 2005 02:56 PM
from the older-than-the-os-that-hosts-it dept.
Bug Businesses OS X Operating Systems Apple
dreicodan writes "Well this has too many juicy Mac OS X nuggets in one bag! All details are on this page, but I'll summarise. Apparently Amit Singh discovered a 10+ year old serious bug in OS X. The bug started in Nextstep and is still in Panther (and apparently Tiger, too). Then Amit wrote a program to demo the bug, but also made the program capable of hiding what it does using some complicated Mach kernel voodo! He then threw a challenge open to OS X experts to figure out the bug. It turns out that a week and some 1000 downloads later, three brilliant hackers (Alexy Proskuryakov, Andrew Wellington, Graham Dennis) were able to solve the puzzle. Also looks like other than these guys, nobody got anywhere with the problem. Be ready for extremely gory details of how the program was written and how it was decoded. Its a thrilling read, and OS X hacking doesn't get any more hardcore than this! Hopefully Apple fixes this bug now at last."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Amit Singh's Challenge: Find a Decade-Old Bug 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Funny responses (Score:5, Funny)

    by aftk2 (556992) on Wednesday April 13 2005, @03:00PM (#12226726) Homepage Journal
    While the actual solutions submitted to Singh's challenge were interesting, some of the other responses are more entertaining:
    "I think you must be hacking the main frame to crash the kernal. Whatever you're program is doing, its hot stuff!"


    "While I haven't looked at your program, but have you checked permissions? I had my system crash at random times due to messed up permissions on my external drive."

    "Could you at least of provided a simple Cocoa GUI for your program? Terminal app programs are not very popular with Mac people, you know."

    "Who do you think you are for insulting people like this?"
    That's some funny stuff.

    http://www.kernelthread.com/mac/challenge/result/ [kernelthread.com]
    • "Could you at least of provided a simple Cocoa GUI for your program? Terminal app programs are not very popular with Mac people, you know."

      that's the response I got when macupdate.com had automatically picked up one of my sf.net [sf.net] projects. I made an OSX installer package for my binaries and received many complaints about it in the "discuss this software" forum of macupdate...

      bastards.
      • What they say is true, and if you continue this "open up a terminal lamer" attitude you won't have too much future in OS X or Win32.

        Its number 1 thing made me switch to OS X. I hated the attitude of opensource coders. I hated the win32 as well. Linux wasn't serving my needs. Call me lamer too. Whatever.

        I currently use Adium X, Growl, Quicksilver as opensource apps but their coders are totally aware of the community they serve by their own decision.

        I have no money problem and paid a lot to crap in my firs
        • Well, I wrote a program to serve a purpose to certain low-level hackers. It wasn't written for OSX, I just coded it and made sure it would compile on BSD, Darwin (OSX), Cygwin, Linux, etc. I also decided to make an OSX installer for the wannabe hackers who may have trouble with the standard ./configure && make && make install tricks.

          I worked on a GUI a little, but was having trouble keeping it uptodate with the commandline version, and it also required a complete rewrite to get certain func
    • Well, I have to say it's relieving to see that stupidity isn't exclusive to Windows users.
      • They sound like typical Mac user responses.

        You don't talk to many Windows users, do you? It's pretty much the same thing.

        I've also heard pretty similar things from people who say they use Linux, thoug admittedly not nearly as often.
        • I think opensource community, especially linux standards project should work on a "permission repair" utility rather than joking about the good willing people trying to help.

  • 10 years? (Score:4, Funny)

    by KingBahamut (615285) on Wednesday April 13 2005, @03:03PM (#12226763)
    Thats a long time, almost meets M$ standards.

    • Re:10 years? (Score:2, Insightful)

      by Anonymous Coward
      Would you care to submit an example of a similar or worse M$ (note clever use of $) bug that they couldn't find or fix for 10 years?

      Why is it that M$ (dollar sign, LOL!) gets brought up every time Linux or Apple fucks up big time, when it's not related and usually worse than any similar issues that M$ (clever!) has ever had, let alone left unfixed?
      • Would you care to submit an example of a similar or worse M$ (note clever use of $) bug that they couldn't find or fix for 10 years?

        Does c:\con\con count?
        • I believe that, and a few others might qualify. Win32 API Shatter Attack, have they fixed that yet? Will they?

          I think I remember hearing that unless M$ restructures the Sec model, there really isnt a way for them to stop it from happening.

          and why do I use M$, well, because Bill Gates exemplified Greed to me. The Largest software developer in the world, Oracle not far behind, M$ exudes Greed, Avarice, and Exclusionism (w?). And that dear friends comes from a 30 developer , not a 13yo, like so many critics
          • I believe that, and a few others might qualify. Win32 API Shatter Attack, have they fixed that yet? Will they?

            I imagine Microsoft (justifiably, IMHO) consider that to be a software developer's problem. Programs are only vulnerable if the developer writes them to be.

      • similar or worse M$ (note clever use of $) bug that they couldn't find or fix for 10 years?


        This one was in the NT based OSes for a long time:
        for(;;) printf("\t\t\b\b\b\b");

  • What's impressive (Score:4, Insightful)

    by fm6 (162816) on Wednesday April 13 2005, @03:03PM (#12226765) Homepage Journal
    It is impressive that these uber-hackers could figure out why the kernel was panicking. It is not impressive that NextStep and Apple have known about this panic bug for 10 years but haven't been able to fix it!
    • More likely it wasn't serious enough to warrant the time to fix it.

      • Re:What's impressive (Score:5, Interesting)

        by presidentbeef (779674) on Wednesday April 13 2005, @03:21PM (#12226997) Homepage Journal
        More likely it wasn't serious enough to warrant the time to fix it.

        I agree. Either they didn't know it was there, or they didn't think it was important enough to fix right away.
        But that's different from them not knowing how to fix something, which I'm sure they do.

        • Re:What's impressive (Score:4, Interesting)

          by superpulpsicle (533373) on Thursday April 14 2005, @12:02AM (#12230893)
          This was this myth I heard from someone at MIT, no I didn't go there....

          There was an old terminal machine from the 70s that had a weird bug of permanently hiding processes far beneath "ps" so no admin could ever see it. When the machine was decommissioned in the 90s, the shutdown revealed some student's print-paper-lpr process that got lost for 20 years.

      • How is a kernel panic not serious? Except on Windows, of course, where you want to force regular reboots.

        • Re:What's impressive (Score:4, Insightful)

          by SteeldrivingJon (842919) on Wednesday April 13 2005, @06:10PM (#12228663) Homepage Journal
          "How is a kernel panic not serious? "

          If you never, ever encounter it, it's not serious.

          You could probably cause a kernel panic by driving an iron spike through the boot drive during some critical OS-level operation.

          But it'd be daft to write iron-spike-handling code, to prevent a kernel panic in that rare situation.
          • The point of your weird example seems to be that programmers can't anticipate every contingency. Well, they certainly can't anticipate iron spikes (or do anything about them in any case). They can anticipate the possibility that an application will make a perfectly ordinary set of system calls.

            • If it was perfectly ordinary, it would have been discovered long ago.

              If it's gone 10 years without being discovered, if Bank of America's NeXTSTEP trading systems never broke because of it in all the years they've been in use, then it's not a significant bug.
      • How can this not be serious enough to warrant the time to fix it?

        This is the software equivalent of the F00F bug - an incredibly simple and perfectly reliable way to make a system crash - hard - that doesn't require any special privileges or anything, just the ability to execute software, which every user has.

    • Re:What's impressive (Score:5, Informative)

      by Have Blue (616) on Wednesday April 13 2005, @04:24PM (#12227686) Homepage
      I don't see anything in TFA to indicate that Apple knew about this bug before now- he just mentions that the bug has been present with no explanation as to how this was determined. Singh even spends a good bit of text explaining how the bug is triggered by ultra-low-level routines that are not normally used by anything above the BSD layer, so I'd say there's a good chance it has never even been encountered by anyone before, if OS X's own process creation code is sufficiently solid as to never generate the inconsistency panpipes does.

      • he just mentions that the bug has been present with no explanation as to how this was determined.

        If you look closely, he wrote code for the bug on NeXTStep 3.3 and presumably ran it on an old box he had.

    • It is not impressive that NextStep and Apple have known about this panic bug for 10 years but haven't been able to fix it!

      Is it clear from his write up that NextStep/Apple has known about this bug? It sounds to me like he uncovered a long standing bug but I didn't see anywhere that he says Apple knows about it. He simply says this bug has 'existed for 10 years' not that he told Steve Jobs about it 10 years ago.

      =tkk
      • yeah from the look of it he found the bud then traced it back OS by OS till he figured out NeXT had the bug as well. It doesnt seem that Apple or even NeXT knew about the bug ever.

    • Re:What's impressive (Score:5, Interesting)

      by Bastian (66383) on Wednesday April 13 2005, @08:03PM (#12229553)
      Given that the bug wouldn't be too hard to fix, and is a serious bug, I doubt that that is the case. On the contrary, while it is a bit annoying that this sort of oversight in the kernel design does exist, I think it speaks well for NeXT and Apple that they have not discovered it in all this time.

      NEXTSTEP/OS X has an incredibly layered architecture, and those layers are quite well-stratified. That stratification is a great design asset - it makes it a lot easier to keep the whole mess organized, and reduces the number of boundary conditions where bugs (such as this kernel bug :-) can pop up. Now, the fact that OS X has a sort of Mach/BSD - Jekyll/Hyde sort of thing going on in the kernel means that you should expect it to be very tempting for many developers to haphazardly make system calls as they see fit. But if that had been the way development worked at NeXT, you can bet your pants that this bug would have been discovered at least a decade ago. (Mr. Singh doesn't say exactly how far this thing goes back, but I'm going to guess it has been in NEXTSTEP the entire time - about two decades.)

      -BUT-, the bug is still there. While I normally hate old bugs as much as anyone, especially ones that cause kernel panics, in this case I am sincerely and profundly impressed at the amount of discipline that must have been present in the development culture at NeXT. (We'll see about Apple - on the inside, Classic MacOS became quite possibly the most tangled kludge of an operating system ever produced in its last few incarnations, and I do get the impression that Apple is starting to take OS X down that path, too.)

  • A reason why there weren't 1000 submissions (Score:5, Insightful)

    by Anonymous Coward on Wednesday April 13 2005, @03:10PM (#12226857)
    I think one of the reasons why only a few people submitted their analysis was because of how the contest was structured.

    Singh said he was going to give the prize to the first person with a correct submission. Not the best submission, nor the most complete submission, or the most creative submission.

    So I think people just gave up after the first couple of submissions were posted. He shouldn't have displayed the number of submissions that had been received.

    Also, this challenge didn't hit Slashdot until after it was finished. I know I didnt' hear about it until after the first two submissions were submitted.

    It was fun to track down though.

    • Re:A reason why there weren't 1000 submissions (Score:5, Informative)

      by aftk2 (556992) on Wednesday April 13 2005, @05:25PM (#12228275) Homepage Journal
      *sigh*

      aftk2's recent submissions:
      The Mac OS X Expert Challenge
      Thu Apr 07, '05 01:22 PM
      Rejected

      Not for lack of trying, unfortunately.

      • Re:A reason why there weren't 1000 submissions (Score:2, Interesting)

        by Anonymous Coward
        Yup, I submitted it too ... twice. Once on the day this was announced, and another a couple days later when a fixed deadline was announced. Challenge still had 5 days to go. Rejected both times. I think OS X people don't want to hurt their heads thinking about bugs and hacking and system level things :)
        • Ah sweet irony. A story about about 'OS X people' - whomever they are - hacking the OS, having a troll about 'OS X people' - whomever they are - not wanting hack the OS ;)
          Seriously though, it says a lot about the OS that people like Amit are abusing it and that people on /. consider abuse of the OS newsworthy. More than anything it's reached the position that submissions to /. about such fun can be ignored... now that's what i call going mainstream!
        • I doubt that is the problem, since it's entirely up to the editors on slashdot as to which article gets accepted and which doesn't. Still, I've seen quite a few editors show incredible stupidity about articles in general (preferring politics, posting duplicates other general errors) so this one getting rejected doesn't say much about OSX users, but a lot about slashdot editors.

  • How zen (Score:5, Funny)

    by daeley (126313) on Wednesday April 13 2005, @03:14PM (#12226916) Homepage
    If a bug fails in an OS, and no one finds it, does it make a sound?
    • What is the sound of one kernel panicking?
      A lot of cursing, that is.
      • A Mac owner wakes up from a nightmare in which he encountered a BSOD, and wonders to himself... Is he a Mac user who had a nightmare about Windows XP, or is he a PC user, now asleep and dreaming that he uses OS X?

  • NeXTSTEP had lots of bugs (Score:5, Interesting)

    by klui (457783) on Wednesday April 13 2005, @03:24PM (#12227042)
    NS had a lot of old bugs due to its use of 4.2BSD. People would report it but hardly any would get fixed/patched/updated. So I would not be surprised if some of these bugs were not purged by OS X's use of a more up-to-date version of BSD and its subsequent kernel reorg.

  • Let's all hope (Score:5, Funny)

    by amichalo (132545) on Wednesday April 13 2005, @03:55PM (#12227378)
    Hopefully Apple fixes this bug now at last.

    Man, What with blowing away their 2Q'05 earnings projections, I hope the first thing Apple does is address this bug that no one has paid any attention to in 10 years. That will make me as a Apple user and share holder happier than if they continue this "innovation" fad.
    • Heh, given the way Microsoft has been all along and the way some bits of J-Random-Free-OSnix (like the desktop environments) are going, I'd say that the truly innovative is is steady refinement over obsessive feature-chasing.

  • Nice Tie-In (Score:4, Interesting)

    by Lars T. (470328) <Lars.TraegerNO@SPAMgooglemail.com> on Wednesday April 13 2005, @05:40PM (#12228421) Journal
    with the Russians Claim Their Hackers the Best In the World [slashdot.org] Article - Winner is a Russian ;-)

  • exploits for dummies (Score:5, Insightful)

    by epine (68316) on Wednesday April 13 2005, @10:42PM (#12230555)
    The flaw used by panpipes has existed unnoticed for over a decade. If attackers were indeed actively looking for flaws all along, did they miss this one? If nobody was ever looking for any flaws, could there be more exploitable flaws lurking?

    The rest of the article is good fun, but this passage is a brain fart. There are millions of lines of source code in any modern operating system. Exploits don't sprout overnight like mana from heaven. The most useful skill for divining exploits is to notice the existence of edge cases in how various subsystems interact with one another. There is also the important case where "chance favors the prepared mind". This is where something funny happens as a result of an honest mistake, then the "prepared mind" notices (and pursues) the chance event's darker implications.

    Serious bugs that lurk for decades are hardly unknown. The ASN.1 bug springs to mind. It's hard to image a bug more widely deployed that escaped detection for such a long time. The question here is why, for such a long time, this simple flaw evaded interactions with dark energy. It's for precisely the same reason that experts rarely make the best testers. There are certain kinds of elementary programming mistakes that the "prepared mind" will habitually avoid. This distribution has a slim tail. If the minions of evil fail to stumble into any telltale clues after five years, chances are good it will remain hidden for a long time yet.

    This is in fact the same mistake that Kurweil makes in predicting the imminent singularity: that intellectual power is a fully ordered function, based on the premise that a really smart person can achieve any interesting result that any person much less smart can achieve. To put this in perspective, consider the recently discovered AKS primality test. This is what AKS achieved by some clever tricks using concepts of undergraduate algebra and a 15-year old theorem.

    http://www.flonnet.com/fl1917/19171290.htm [flonnet.com]

    Undergraduate concepts in algebra exploited to achieve mathematical immortality. That ought to frame a tiny, unnoticed flaw in OS/X.

    • Re:exploits for dummies (Score:5, Interesting)

      by SteeldrivingJon (842919) on Thursday April 14 2005, @12:44AM (#12231047) Homepage Journal
      "There are millions of lines of source code in any modern operating system. Exploits don't sprout overnight like mana from heaven. The most useful skill for divining exploits is to notice the existence of edge cases in how various subsystems interact with one another."

      Indeed. I think the problem is not that nobody was looking for flaws, but that they were looking in the parts they're familiar with. They'd be looking in the BSD-oriented parts, or the upper levels of the OS.

      They probably wouldn't be looking in the Mach parts of the OS, where this bug appears. I doubt many people have spent the time to learn enough about Mach to think of potential exploits.

  • Dr. Norton, are you paying attention? (Score:4, Interesting)

    by Anonymous Coward on Thursday April 14 2005, @02:32AM (#12231407)
    Companies who sell anti-viral software are conspicuous by their absence from the list "Net-demography of those interested".

    People in Capital One, Compound Therapeutics, Fossil, Goldman Sachs, IKEA, and SAAB were interested enough to download this, but no one from the Semantecs/Sophos/Secunas of this world found it worth their while to check it out??!!

    I would certainly hope that they are paying attention to the use of dynamic code modification, code obfuscation, and red herrings. While these techniques are not new, none of the (Windows) malware seen so far were designed to be even half as proficient in these matters as panpipes. Further, Amit has stated that he could have made panpipes even more difficult to debug (but didn't).

    Kudos to Amit for this highly educational exercise! He certainly seems to know his way about the innards of OS X (not to mention all the other OSes he runs [kernelthread.com] on his 17"PB via VPC.)

    (I bet he has some interesting insights about the evolution and workings of OSes from MS (he is running ALL the flavors of DOS [kernelthread.com] and Windows [kernelthread.com] that I know of.)

  • If there's one person Apple should hire (Score:5, Insightful)

    by theolein (316044) on Thursday April 14 2005, @05:44AM (#12231878) Journal
    Apple should hire, even if they never hire another person for their OSX team, Amit Singh. It is truly rare that someone as gifted as this appears on the scene and then even has a passion for the intricacies of a kernel that does not garner much attention in the OSS scene.

    Given that all the immense amount of detail that Amit has given on OSX as shown on kernelthread and in his upcoming book has been done in his spare time, could you imagine what he could achieve if this was his job. Granted, I'm no HR person, but I would think that Apple should be chafing at the bit to get him on board. I know that if it was up to me, I would offer him an almost blank cheque to write his own salary on.

    He is the person who could get OSX into the enterprise.

    Of course, if he did work for Apple, then his website would surely suffer, what with NDAs and such. Perhaps it's better that he doesn't work at Apple.
    • i've been thinking the same exact thing since I started reading his articles.
      Not only is he a brilliant computer scientest who knows his shit in-and-out, but he's a very gifted writer with an uncanny ability to write articles targeted at manny different levels of ability. He also does a great job of staying out of the OS flame war by always looking at OS's from an objective point of view.
      As far as I can tell by looking at the dates on his resume, he's only in his late-twenties or early-thirties, which
    • Seconded. His website was a dizzying assault on my sense of being in IT and like standing under a clear moonless starry night, it made me feel real small for a moment. I am in awe. Bookmarked.

  • A system call not checking input values ?? (Score:3, Interesting)

    by javaxman (705658) on Thursday April 14 2005, @02:59PM (#12237688) Journal
    From a quick read of the analysis, it comes down to a system call not checking it's input values for illegal input, right ?

    If that's the only example like that which can cause a kernel panic, I'd be impressed. Especially in kernel-level I/O areas where performance is key, it's even possible that such a check is left out on purpose, and data integrity is meant to be the job of some higher-level or intermediary calling function which is ( nearly ) always used.

    Of course, I avoid programming on such a low level if possible, so I could be wrong. But it is likely there's a reason why fixing this isn't terribly important, and why my OS X machine *never* reboots unless I've done some system software update.

    • Re:To be honest (Score:4, Insightful)

      by xenocide2 (231786) on Wednesday April 13 2005, @03:29PM (#12227102) Homepage
      Its not like there is any software immune to ancient bugs. Debian had an outstanding bug in apt-get that was recently fixed. Apparently, for seven years there was a lurking 'ignore random files while removing a package' bug in their linked list program. Of course, it wasn't random at all, it simply skipped every other node in the linked list under certain conditions (such as having a list with more than one item).

      I don't think the person behind the challenge meant to imply that macs are toys. Only that very few people outside of Apple know much about the inner workings of their beast named OS X. As far as exploits go, a kernel panic is one of the safest out there. No way of intentionally damaging specific files, no remote execution of code. Of course, as one of the many people who doesn't know much about OSX internals, I suppose its possible that the vulnerability could lead to such things. I just don't know, and given that your name wasn't on the list, I surmise you don't either.
      • The bug is a way to cause the kernel to create a process whose bsd_info pointer is null, and then cause the kernel to dereference that pointer. There shouldn't be any way to change bsd_info, so there's really no way to use this to cause anything but a kernel panic. (And even if there were, it would be a completely separate issue that happens to involve the same data structure.)

      • Re:To be honest (Score:4, Insightful)

        by guet (525509) on Thursday April 14 2005, @04:06AM (#12231619)
        This adds up to the toy image _some_ claim the Macs have. Why would someone play around with a serious security bug there for 10 years? Well, a mitigating fact is that it was there for 10 years, but still it's bad to delay a fix because of a game.

        Well, apart from the attempt to disclaim responsibility for a statement whilst still presenting it as credible (the '_some_ claim' statement), there's the gratuitous insult aimed at provoking others - 'toy'.

        Why bother claiming Macs are toys in a story about an obscure bug? What does a toy mean to you? Ironically one of the most persistent criticisms of Macs is that current games don't play well on them, so they are in fact not very good toys.
        • Hehe. Look. If you look at my comment history, or ask a subscriber, you can see that i never intended to troll.

          Well, apart from the attempt to disclaim responsibility for a statement whilst still presenting it as credible (the '_some_ claim' statement), there's the gratuitous insult aimed at provoking others - 'toy'.

          Obviously i inserted the '_some_ claim' because i'm not one of them. I was talking about an image, which can be roughly translated as a perception of the mass. I know far more than the mass

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.