Slashdot Log In
Less Than a Minute to Hijack a MacBook's Wireless
Posted by
timothy
on Thu Aug 03, 2006 07:10 AM
from the uh-oh dept.
from the uh-oh dept.
Kadin2048 writes "As reported by Ars Technica and the Washington Post, two hackers have found an exploitable vulnerability in the wireless drivers used by Apple's MacBook. Machines are vulnerable if they have wireless enabled and are set to connect to any available wireless network, fairly close to their default state, and the exploit allows an attacker to gain "total access" -— apparently a remote root. Although the demo, performed via video at the BlackHat conference, takes aim at what one of the hackers calls the "Mac userbase aura of smugness on security," Windows users shouldn't get too smug themselves: according to the Post article, "the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS." Ultimately, it may be the attacks against embedded devices which are the most threatening, since those devices are the hardest to upgrade. Currently there have not been any reports of this vulnerability 'in the wild.'" According to this story at ITwire.com, they were able to exploit Linux and Windows machines, too. (Thanks to Josh Fink.)
Related Stories
[+]
Hardware: Apple Patches Wireless Drivers 143 comments
Frank writes "Apple quietly released a pair of patches today to its wireless drivers. The patches (one for PowerPC, one for Intel) address distinct buffer overflow vulnerabilities found during an internal audit in response to the claim that fuzzing the drivers resulted in an exploitable failure."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Mac Users (Score:5, Funny)
Re:Mac Users (Score:5, Funny)
(For the humour challenged among you, this is a joke. I know there are a lot more than 1000 Mac users. Only stupid mods mod jokes as trolls and flamebait.)
Parent
Re:Mac Users (Score:5, Informative)
Next?
Parent
That's ridiculous (Score:5, Funny)
Re:That's ridiculous (Score:5, Funny)
C'mon, don't tell me you've never taken your laptop to the "reading room".
Parent
Actually, your Powerbook probably IS safe! (Score:5, Informative)
MacBooks use different wireless drivers (because they have Intel wireless chips). Your Powerbook has the old Airport card; unless there's also a similar flaw in it, it's safe.
Parent
Re:Actually, your Powerbook probably IS safe! (Score:3, Informative)
So MacBooks are not normally venerable to this sort of attack: they went out of their way to introduce third-party hardware that opened the door to the attack. I am not saying that Apple should not work to close even that door, bu
Re:Actually, your Powerbook probably IS safe! (Score:5, Informative)
Parent
Re:Actually, your Powerbook probably IS safe! (Score:5, Funny)
It was bad enough when all this "oil crisis" nonsense ruined my H2 Hummer for me. Overnight I became "guy who's supporting terrorism." It was so much better when I was just "guy with a small penis."
-Eric
Parent
Re:That's ridiculous (Score:5, Funny)
With "undetectable rootkit detection software", duh....
Unless the rootkit has an "undetectable rootkit detection software" detector and tries to disable it, then you need "undetectable rootkit detection software detector detector software" to disable the rootkit's detector - no big deal..
Parent
But... (Score:4, Funny)
never mind.
Linux Wireless (Score:5, Funny)
Requests for testing have been sent to the guy in California who were rumoured to have gotten it running though.
Parent
A Mac Exploit (Score:5, Funny)
In related news... (Score:5, Informative)
Uh (Score:5, Insightful)
This exploit is OS independent. How is this in any way indicative of Mac user smugness? Are they so smug that they made Windows and Linux boxes explotable too?
Re:Uh (Score:5, Informative)
Parent
Re:Uh (Score:4, Informative)
There are two possibilities here. If the testing driver is in the firmware, then it will still be present in OpenBSD. Since the firmware does not run on the host CPU, however, compromising it is only useful if you can then return something to the driver that will be executed, usually be exploiting a flaw in the driver causing it to execute arbitrary code in ring 0.
The other alternative is that this really is a driver you are talking about. In which case, it would not be present in OpenBSD, since the OpenBSD driver is a clean-room implementation and shares no code with the official driver.
And if OpenBSD has no problem and its the OS driver that needs replacing, then Apple will just take your OpenBSD driver and port it to their system, problem solved. That is why they went with BSD, they can borrow from any BSD that is out there.
I'm sorry, but that's not even remotely true. OS X uses IOKit for all device drivers, which is an Embedded C++ API. OpenBSD and FreeBSD use derivatives of the old BSD device API. It is possible to port device drivers between FreeBSD and OpenBSD relatively easily, because the API changes between the two have been small and incremental. If you try 'porting' a network driver from OpenBSD to OS X, then what you are really doing is using the OpenBSD driver as a substitute for real documentation and writing a driver from scratch. Doing this is likely to introduce bugs, since code (even good code) is a poor substitute for documentation.
Parent
Re:Uh (Score:4, Informative)
Parent
Re:Uh (Score:5, Insightful)
Parent
Spin (Score:3, Interesting)
The flaw was found in a number of wireless drivers; they purposely chose to demonstrate it (in their video, which I haven't been able to find on the web anywhere) using a MacBook, because of that "aura of smugness."
Apparently their biggest complaint is those Mac/PC Apple ads: "'We're not picking specifically on Macs here, but if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one o
Third party wireless card? (Score:5, Interesting)
The built-in card IS vunerable (Score:5, Informative)
During the course of our interview, it came out that Apple had leaned on Maynor and Ellch pretty hard not to make this an issue about the Mac drivers -- mainly because Apple had not fixed the problem yet. Maynor acknowledged that he used a third-party wireless card in the demo so as not to draw attention to the flaw resident in Macbook drivers. But he also admitted that the same flaws were resident in the default Macbook wireless device drivers, and that those drivers were identically exploitable. And that is what I reported.
Parent
Re:Third party wireless card? (Score:4, Funny)
Because someone is running a pirated version of OS X on a "beige" PC?
Parent
More disturbing (Score:5, Insightful)
Re:More disturbing (Score:3, Insightful)
Why did they need a 3rd party card? (Score:5, Insightful)
Apple's wiress drivers are flawed too, read ... (Score:5, Informative)
During the course of our interview, it came out that Apple had leaned on Maynor and Ellch pretty hard not to make this an issue about the Mac drivers -- mainly because Apple had not fixed the problem yet. Maynor acknowledged that he used a third-party wireless card in the demo so as not to draw attention to the flaw resident in Macbook drivers. But he also admitted that the same flaws were resident in the default Macbook wireless device drivers, and that those drivers were identically exploitable. And that is what I reported.
( Looks like Apple was wielding a big stick
Parent
3rd party (Score:3, Informative)
And I was joking about this on a security mailing list yesterday. I mean, come on: 3rd party drivers that nobody is using anyways because the ones you get with the system are perfectly ok? What's next? Writing the exploitable drivers yourself?
Re:3rd party (Score:5, Informative)
Read Brian Krebs' follow up
http://blog.washingtonpost.com/securityfix/2006/0
Apple 'leaned heavily' on the presenters to make them use a different card. The built in card *is* vulnerable.
Parent
Only with third party wireless card (Score:3, Insightful)
I would suspect that the problem is that a wireless connection can be created without knowledge of the user, and a user who has a Macintosh that was made vulnerable but should be safe because it has no network connection would unexpectedly be unsafe.
The ISC discussed this yesterday (Score:5, Informative)
Watch the video (Score:5, Informative)
The actual video is here [washingtonpost.com].
the Bottom Line (Score:5, Insightful)
This is disgusting. No matter how many stories you run about Mac OSX and how it "really isn't secure" two facts will remain:
1) It's more secure than Windows. There are both less flaws and less exploits. It doesn't matter why, it's still true and, most likely, it will remain true for a long time to come. It's difficult to prove which has less flaws because neither is open source, but I think all of you, no matter how devoted to Microsoft you are, know deep down what would happen if both systems went open source tomorrow. It's very easy to prove which has less exploits, and it makes no difference whether that's because of less flaws, a different user base, a smaller user base, or some combination of the three because the net effect is a safer OS. Even if you disagree with the statement that OS X has less flaws on the basis that you believe it is secretly harboring more crappy code than Windows my second argument still holds.
2) There are almost never any malicious programs of any kind spread among Mac OS X users, unless you count people sharing copies of Windows XP to be installed with BootCamp. This may change in the future, but I doubt it.
Re:the Bottom Line (Score:4, Interesting)
Sadly true, though it's just as true that as long as you're alive on planet Earth, you're not safe, either.
Get off this whole "my OS is more secure than your OS" crap.
But, um, some OS'es *are* more secure than others.
Realize that you are vulnerable and take the correct steps to protect yourself.
I'm curious to know what "correct steps" you have in mind.
If it's "use an antivirus scanner", that's a retarded or at least suboptimal strategy, because antivirus scanners are of course imperfect (they'll never make you perfectly safe, either), and at any rate all they do is patch over the fact that an OS that needs them has a fundamentally flawed security model.
If it's "disable all the services you're not using", that's a pretty retarded strategy, too, because they should have been turned off by default, and the advice should really be phrased "don't enable anything you're not using."
For me, one of the biggest "correct steps" is, "use OS'es that take security seriously and have a decent security model". So of course I don't use Microsoft OS'es. I'm sorry if that's an example of the "my OS is more secure than your OS" crap, but really: it's at least as valid a strategy as "use an antivirus scanner".
Parent
I don't believe it. (Score:3, Insightful)
I want to see this work on Linux, for that matter.
2. It requires your system to be setup to automatically associate with all non-password protected APs. This is not a default setting, either; and none of the Mac users I know run their systems on this setting.
People DO tend to run their systems on "Alert me to all unprotected wireless access points", but that's all.
I don't see why everyone is so willing to accept this vulnerability. Their talking about attacking Atheros drivers on Windows, Linux, and OS X, with at least three independent driver teams working on them, with the Linux one being opensource (Madwifi). Furthermore, I don't see how you would get the same three driver stacks to exhibit the same buffer overrun to root-level excutable code, particularly a locked down Linux.
It's not protecting anyone to hide this vulnerability. Releasing the information now would prove whether or not this is real, and would permit quick resolution to this problem, particularly for the MadWifi people.
Until there's more information, I don't believe it. Even if I did believe it, without any details there's no effective way for me to protect myself. If the attack requires associating with an AP, most systems are not vulnerable. If the attack simple requires scanning avaliable APs, then every system out there is vulnerable unless Wireless is entirely disabled. Either way, it's stupid not to release the details, and reeks of more "Mac's aren't safe! See! Buy Norton Antivirus for the Mac!".
Ha! I've done even better! (Score:3, Funny)
I disintegrated a car with my mind!
I have it on video!
Of course, I weakened the car's frame with a blowtorch... and the car was packed with explosives... and there was the whole "lit fuse" thing... but still! I disintegrated a car with my mind. Some anonymous guy with a video says so!
Security is your responsibility (Score:4, Interesting)
I have run windows machines since 3.1 and DOS before that and never had problem. On the other hand I have shown people (relatives, friends etc) how to secure and maintain their machines and the next week I find them back to doing their own self-defeating behaviours.
Someone found an exploit. Whoop-de-do. There will always be exploits found for all systems that people can screw with. There is almost always a way to secure against it. Almost always a large group of users ignores what is good for them and their machines and gets burned. Frankly, the platform matters less when it comes to these things than the user's behaviour.
Hysterical inability to quantify risk (Score:5, Insightful)
Macs are so secure that A STORY about a third party wireless carded being hacked gets national-level coverage.
The PC owners rejoicing over the Mac's equivalence to their vulnerable platforms are being ridiculous. The quantifiable risk ratio between operating a Windows laptop and a MacBook is practically infinite, as there are no known virii for MacBooks, no known owning of MacBooks, no known security risks in operating a MacBook. At this point, hackers are well aware of a large installed userbase for Apple products, and certainly would attack them. If they could. Obviously they can't.
Silly people. Don't forget to run your virus and spyware checkers today. And back up your data, you never know when the bad guys will nail your hard drive in new and exciting ways through yet another buffer overflow in Windows.
Not Apple Wireless Hardware (Score:4, Insightful)
Note that if you research the article a bit, you'll find that the "researchers" didn't hack the MacBook through the built-in wireless adaptor [go.com], they actually used a 3rd party wireless card plugged into it. They did it on a Mac just for the publicity storm they hoped it would generate (and lookie here, they were right).
So all the crap about "Oh oh, now your Mac is just as insecure as a Windows Box" is really, well, wrong.
And researchers deserves the double-quotes in my opinion; anyone with a nickname like "Jonny Cache" seems a bit silly to me in the first place.
Re:How about warning the vendor. (Score:5, Informative)
Also, christ, I'd say they're being pretty responsible about it.
Parent
Re:How about warning the vendor. (Score:5, Informative)
Seeing you can't be bothered reading tfa to find out that they haven't discolsed & gone to some trouble to ensure the vulnerability's details weren't leaked, I'll quote the relevant sections for you:
and:
One last quote for you (just 'cause its funny):
Parent
Re:Driver vulnerabilities (Score:3, Informative)
Re:Misconceptions by users (Score:5, Insightful)
BUT, and you'll notice this is a capital 'but', I have never seen a worm propagate across linux computers (I don't know for macs, I'm not a user of these). I mean, in the 98 era, windows computers were plagued with these. In the pre-SP1 era too. I have never seen a *single* self-propagating thingie for linux. The first one to do such a feat would get a lot of credit in the "scene" (if such a thing still exists). I, for one, believe that the security design of the OS is not stranger to this clean record.
Parent
Re:Misconceptions by users (Score:3, Informative)
What about the SSL worm from a couple of years back? I had at least one linux server rooted by that at the time.
Re:Centrino. Feh. (Score:5, Informative)
To be specific the new Macbooks/pros use a Atheros 5006x. This is in comparison to the powerbooks that use a broadcom based card. So Apple doesn't use Centrino.
Parent
Re:Smug Mac users? (Score:3, Funny)
Many will begin by saying "This is not a virus" or noting you need proximity to take advantage of this flaw.
Well, they would be saying that, if someone hadn't gone and corrupted their MacBooks via wireless exploit...
Re:Smug Mac users? (Score:3, Interesting)
Second, this really isn't Apple's fault. It is the fault of their vendor that made the card and wrote the software driver for it. One of the main arguments of the "Windows fanboys" is that driver issues are not Microsoft's fault and that environment richness is one reason why they shouldn't be totally blamed for instability.
Well guess what? So that particular bug finally bit Apple. Do ya know what we'll do? Take our new wireless Mighty Mic
Re:Smug Mac users? (Score:3, Informative)
Re:Smug Mac users? (Score:3, Informative)
Re:True? Or many want it to be true? (Score:5, Insightful)
Not actually demonstrating your methods while presenting them at a conference is pretty common in other disciplines where it's really hard to lug around an X-ray diffractometer or the New Guinea Urungwi tribe. In CS it's different, but I think the risk of interception is a pretty good excuse.
Parent