Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Worm Claimed For Apple OS X

Posted by kdawson on Tue Jul 17, 2007 06:26 PM
from the apple-trees-have-roots-too dept.
Worms Businesses OS X Operating Systems Security Apple
SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."
+ -
story

Related Stories

[+] Mac Worm Author Gets Death Threats 244 comments
StonyandCher write(s) to spread news about the strange story of the reported Apple OS X worm, which is growing stranger by the day. The blog of the researcher who claimed to have created the malware reportedly received death threats. The blog was then hijacked, according to the researcher, who calls him/herself InfoSec Sellout. InfoSec blamed David Maynor for hacking the blog. For his part, Maynor apparently unmasked himself as "LMH" and InfoSec as Jon Ramsey. The post to the Fuzzing mailing list has not been independently confirmed.
Update: 07/19 13:48 GMT by KD : David Maynor wrote in and denies that he is LMH.
[+] Worm Threat Forces Apple To Disable Software? 201 comments
SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Worm Claimed For Apple OS X 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • worm in apple? (Score:4, Funny)

    by linuxmeltz (815217) on Tuesday July 17 2007, @06:29PM (#19894793)
    Hey, there's a worm in my apple...

    • Re:worm in apple? (Score:5, Funny)

      by Anonymous Coward on Tuesday July 17 2007, @06:37PM (#19894873)
      ... which is much better than half a worm!

    • Re:worm in apple? (Score:4, Funny)

      by dotpavan (829804) on Tuesday July 17 2007, @06:38PM (#19894891) Homepage
      when God (Gates) specifically asked you NOT to eat the Apple (Inc), you should have listened :)

    • Re: (Score:3, Insightful)

      by catwh0re (540371)
      While I have no doubt that worms etc can be created for OSX (or any OS, given enough time.) I'm not really fond of companies blowing their trumpet until they're certain. It's very rich to claim all that publicity without notifing the vendor, or even being 100% certain. Otherwise it comes across as yet another company that is trying to claim solely for the benefit of the massive attention that it will draw on the company. Whether it's a fiasco involving wifi hardware or an antivirus company claiming endless

  • That's not true... (Score:3, Funny)

    by oogoliegoogolie (635356) on Tuesday July 17 2007, @06:38PM (#19894881)
    That's impossible!

    • Re:That's not true... (Score:5, Funny)

      by kestasjk (933987) on Tuesday July 17 2007, @09:25PM (#19896249) Homepage

      That's impossible!
      It's possible, but:
      • It doesn't exist in the wild; this is because of OS X's stunning security features
      • This vulnerability was probably placed into the system by Jobs himself. If there were no vulnerabilities in OS X people would realize Jobs was supernatural, so he has to put one in there from time to time.
      • This vulnerability is probably the last vulnerability in OS X. Once Apple fixes this there'll be no more
      • Way, way more vulnerabilities are found in Windows and Windows products; this is because of OS X's breathtaking security features
      • This is probably a bug in BSD or Mach code, or one of the recent Intel chip bugs, or a Microsoft employee infiltrated the Cupertino campus. It's not Apple's fault.
      • Microsoft spends its entire R&D budget looking for these elusive Apple holes just as a way of discrediting Apple. If the real number of Microsoft and Linux vulnerabilities were actually disclosed there would be no comparison.
      • Apple puts the occasional vulnerability in its system because they know that Microsoft blindly copies anything Apple does. If Apple puts one bug into their system they know Microsoft will put 10 bugs in theirs.
      • Microsoft worms spread spambots and steal credit card information, Apple worms are just a misguided attempt of a loyal Apple fan to spread the good vibes and let the community know he cares. With Mac OS X only your unquestioning loyalty is contagious.
      Such a breathtaking OS on a rock solid foundation with over 1 million configurations. Say hello to OS X Panda. Starting at $99. Small sentence. Reinvented.

      • Actually... (Score:5, Insightful)

        by LKM (227954) on Wednesday July 18 2007, @06:38AM (#19898895) Homepage
        The only people I always see spouting such crap are the people who claim to hate Apple fanboys. I've never seen an Apple fanboy make absurd claims like yours. This is like a fucking self-fullfilling prophecy. Every damn article about Apple is run over by stupid Anti-Apple trolls who write hundreds of comments laughing about imaginary Apple fanboys and the imaginary stupid things they say. [crazyapplerumors.com]

        Here's an idea: Shut up, and let those who are interested in the article discuss it. Thanks.

  • *ahem* (Score:5, Insightful)

    by Duncan3 (10537) on Tuesday July 17 2007, @06:44PM (#19894953) Homepage
    As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm.

    If by fully testing you mean "auctioning it to the highest bidder" then yea.

  • temporary work-around (Score:5, Informative)

    by mzs (595629) on Tuesday July 17 2007, @06:45PM (#19894961)
    Disable mDNSResponder:

    sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

    • Re:temporary work-around (Score:5, Informative)

      by dch24 (904899) on Tuesday July 17 2007, @07:06PM (#19895157) Journal
      Very good. That might disable the security hole, if what has been disclosed so far is 100% accurate. If not, well, all you lose is Bonjour (useful for discovering iChat and iTunes connections on your local subnet).

      • also quite useless (Score:4, Insightful)

        by Jeremy_Bee (1064620) on Tuesday July 17 2007, @09:10PM (#19896141)
        IMO the really funny thing is that this joker decided to use a Bonjour vulnerability to work on, when everything I've heard indicates a major reworking of the Bonjour code in Leopard anyway.

        Isn't this kinda like working out a vulnerability in AppleTalk a month before they stopped using it?

        • Re:also quite useless (Score:4, Insightful)

          by zootm (850416) on Wednesday July 18 2007, @05:53AM (#19898735)

          Many of the major Windows worms and so forth target vulnerabilities which have already been fixed (and the fixes pushed out) months before. Not only will many not upgrade to Leopard, if the OS X userbase is similar to the Windows userbase (I'm not sure if it is, but still), many will simply not click the button to install the updates, and leave themselves vulnerable.

  • I question the ethics, and my legality (Score:4, Insightful)

    by Swift2001 (874553) on Tuesday July 17 2007, @06:46PM (#19894973)
    First of all, if he's found a real vulnerability, he reports it. I don't care if it's Apple or Linux or even Windows. "Waiting until I finish it" is a disgusting excuse. Will he sell it to the bad guys? Is this free publicity for some jerk? I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.

    • Re:I question the ethics, and my legality (Score:5, Insightful)

      by Tobenisstinky (853306) on Tuesday July 17 2007, @06:48PM (#19894995)
      Good idea. However, a serious discussion on /. is unlikely.

    • I think the Slashdot world ought to have a serious discussion of this kind of jerk. I think Congress might to. If what he's doing isn't illegal now, maybe it should be.


      I agree. We should also question the ethics of Theo de Raadt. After all, this guy published an exploit for OpenSSH. Who does this guy think he is? Hell, he should have given the problem to the developers of OpenSSH to fix it, not be out there releasing exploits and stuff.
    • Sounds like a great plan. Make it compulsory to report vulnerabilities eh? Maybe even ban the selling of vulnerabilities. Kinda makes you wonder why any third party would bother looking for them.

      • Re:I question the ethics, and my legality (Score:4, Insightful)

        by QuietObserver (1029226) on Tuesday July 17 2007, @07:15PM (#19895233)
        From my point of view, the original argument never said anything about making vulnerability reporting compulsory, but that concealing a vulnerability is morally reprehensible, and claiming to keep a vulnerability secret until an exploit is finished is a disgusting excuse.
            • And that's the problem. You want to look at it in simple terms instead of considering the whole issue.

              Apple and other software vendors have chosen a development model that maximizes their ability to hide defects in their software. If people are morally obliged to report any of the defects they independently find in the software then the vendor has no incentive to ensure the defects are found before the product hits the market. To put it another way, time to market is much more important to them than making a product free of defects. The only thing that motivates them to ensure their products are defect free is malware. As such, creation of malware actually *helps* to make the vendor take more responsibility for the defects in their product.

               

    • Re:I question the ethics, and my legality (Score:5, Insightful)

      by fox1324 (1039892) on Tuesday July 17 2007, @07:17PM (#19895245)
      If what he's doing isn't illegal now, maybe it should be.


      Maybe it shouldn't be. There are hundreds of /. threads filled up with complaints about the US government and legal system. Our rights are constantly eroded by attempts to 'legislate morality'. Repeat with me: just because something is unethical or immoral does NOT mean it needs to be illegal. Ethics and morals are nothing more than opinions, and they vary greatly from person to person.

      Neglecting to report a vulnerability is not remotely criminal, no matter how much you disagree with his motivation.

    • Re:I question the ethics, and my legality (Score:5, Insightful)

      by MadMidnightBomber (894759) on Wednesday July 18 2007, @02:27AM (#19898005)
      Because Congress is well known for its mature and insightful discussion of computer and network security issues.

  • Tipping the scales? (Score:5, Insightful)

    by dsdtzero (137612) on Tuesday July 17 2007, @06:46PM (#19894979)
    The fact that the breaking news on slashdot is "someone found the third way to attack a mac machine" is a compelling argument to purchase a mac over a PC. Unless someone can explain to me how this is the seed of an impending snowball of mac-targeted malware.

    • Re:Tipping the scales? (Score:5, Insightful)

      by Daniel Dvorkin (106857) on Tuesday July 17 2007, @07:05PM (#19895145) Homepage Journal
      Yes, exactly. Three proofs of concept vs. thousands, maybe millions, of vulnerabilities in the wild.

      The author claims, "While it is nothing special compared to Windows based Malware it does prove a point -- Apple Computers are just as susceptible to Malware as Windows based ones." Oh, bullshit. The fact that this particular security vulnerability exists does not mean that OS X is just as much a wide-open target as Windows is.

      In the "Classic" MacOS days, there was a fair amount of Mac malware -- never as much as in the PC world, of course, but plenty of it running around. Since OS X became the standard, this hasn't happened. The "vulnerability through popularity" argument just doesn't hold up to this fact.

      • Re: (Score:3, Interesting)

        by timmarhy (659436)
        the number of vulnerabilities is irrelvant, what matters is how easily it spreads and what it's payload is like.

        IF this is real, and it can spread quickly and cause maximum damage then it's just as bad as windows, because the end result is an unsafe system.

      • Re: (Score:3, Insightful)

        by NatasRevol (731260)
        I really think this argument should be given a name, something along the lines of Godwin's law.

        Perhaps Paterson's folly?

  • Windows affected? (Score:5, Interesting)

    by nuckin futs (574289) on Tuesday July 17 2007, @06:49PM (#19895007)
    exactly what vulnerability in mDNSResponder is it exploiting? Since mDNSResponder also runs on windows if you install bonjour for Windows, does that mean it can possibly be affected too?

  • Okay... let me get this straight... (Score:5, Insightful)

    by Penguinisto (415985) on Tuesday July 17 2007, @06:53PM (#19895037) Journal
    Serious question here:

    Somebody writes a worm for OSX that works across a specific test network (of which we have no clue as to settings, layout, patch levels, etc etc), and it's really, really, really big news. Media orgs around the planet sound the klaxon, and (nearly) everyone gets all hyper-ventilated. Claims of "OSX is just as vulnerable!!!1111!!" will fly off the pages.

    Meanwhile, the next near-periodic iteration of MSFT-specific malware in-the-wild will get not so much as a grunt outside of security circles (such as SANS ISC and F-Secure's blog as ferinstances). It will likely subvert 40x as many victims in its first hour, and the media won't say so much as 'boo' about it.

    Perspective (at least outside of security and some geek circles)? Never heard of it.

    /P

      • I don't know of a single Mac user or vendor who has ever claimed that OS X is *COMPLETELY* invulnerable to viruses/etc, only that there hasn't been a demonstrable, malicious, in-the-wild true OS X virus released YET, which is true.

        Major difference. In fact, every Mac user I know expects a "true" virus or two to show up for OS X sooner or later, but what of it? So the ratio will go from a bazillion to zero to a bazillion to one or two.

        Apple has roughly a 2.5% worldwide market share--wake me when they have anywhere close to 2.5% as many viruses as Windows and I'll start being overly concerned.

      • Re: (Score:3, Interesting)

        by samkass (174571)
        You make a good point. The fact that there is not a single virus or worm in the wild for MacOS X probably does make this bigger news (assuming the unsubstantiated report is real and it ever makes it into the wild) than it would otherwise be. I'm not sure how much Apple's statements on the matter really affect it, but the fact that someone succeeded in creating such a worm for MacOS X really is pretty big news, I guess. That is, as long as the news organizations don't try to portray MacOS as being as vuln

  • Is mDNS even routable? (Score:5, Interesting)

    by MBCook (132727) <foobarsoft@foobarsoft.com> on Tuesday July 17 2007, @06:58PM (#19895089) Homepage
    I was under the impression that mDNS was not routable (and specifically designed not to be routed). If that is true, doesn't that restrict this to propagating to computers on the same subnet? This could effect a business, or a computer lab (say at a university), but this fact should prevent it from spreading around the internet at large (as various Windows worms have).

    It's a bug, it's a problem, but it's no Blaster by a long shot.

    • Re:Is mDNS even routable? (Score:5, Insightful)

      by dch24 (904899) on Tuesday July 17 2007, @07:09PM (#19895183) Journal
      Bundle it with a Windows worm. Exploit Macs on the same subnet as Windows boxes. Then the infected Macs scan for vulnerable Windows boxes and spread the infection. Every vector is useful in an attacker's bad of tricks.
    • Multicast packets are routable, if the upstream routers support dealing with multicast packets correctly.

      mDNS/bonjour/zeroconf detects if a packet has crossed a router by setting the originating TTL to 255. If a multicast packet crosses a router, the TTL is supposed to be decremented, and zeroconf is supposed to ignore the packet as it is no longer considered local. Many suppositions there, as implementations vary.

      Worse, starting with a TTL of 255 means that the packets will be able to go anywhere on the internet where multicast packets can get routed. Better protected carriers will drop multicast packets with TTLs greater than 64 or 128, specifically to limit mDNS/zeroconf traffic while allowing reasonable traffic to flow. Most ISPs don't have the technical competence to deal with multicast, so they just block it, which will limit any spread of an mDNS worm.

      However, just because mDNS/zeroconf will ignore packets with TTL less that 255, doesn't mean that a buffer overflow bug isn't being treated by the protocol stack. Take a wait and see attitude on this disclosure, as it appears to be an extortion attempt rather than something from legitimate sources.

      the AC

  • Local network only - depends on mDNS (Score:4, Interesting)

    by mbessey (304651) on Tuesday July 17 2007, @07:03PM (#19895137) Homepage Journal
    So, not quite like the Internet-spanning, DDOS-producing Windows worms we've come to know and hate. I'm not too surprised the vulnerability was in MDNSResponder, though. Someone I work with found a few problems in the code when running it on Linux.

  • Market share? (Score:3, Insightful)

    by Dan_Bercell (826965) on Tuesday July 17 2007, @07:04PM (#19895139)
    I havent really looked at the market share percentages of OSes recently, has Apple really grown large enough for Virus makers to start targeting Apple?

  • Have mDNSresponder run without root privileges (Score:5, Informative)

    by e. boaz (67350) on Tuesday July 17 2007, @08:15PM (#19895739) Homepage
    If this is a real concern, there is a workaround to have mDNSResponder run without root privileges. Part of the claim is that they can deliver root payloads - this is likely because mDNSResponder runs as the root user and they might be using a buffer overflow exploit [NOTE: I have not analyzed the mDNSResponder code - this is a guess.]

    % sudo launchctl unload /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist
    % sudo chown nobody:wheel /usr/sbin/mDNSResponder
    % sudo chmod 4750 /usr/sbin/mDNSResponder
    % sudo launchctl load /System/Library/LaunchDaemons/com.apple.mDNSRespon der.plist

    If someone wants an explanation of what the above commands accomplish, please read further.
    1. launchctl is used to unload and load the mDNSResponder daemon.
    2. We change the owner of the mDNSResponder to nobody and ensure that wheel is the group. The group is used to ensure that members of the wheel group may launch mDNSResponder and not other users of the system (with the exception of root and anything else running as nobody.)
    3. We change the permissions of the mDNSResponder program to be setuid nobody. This means that mDNSResponder will run as nobody and only be able to affect files owned by that account or by files it may happen to have write privileges against.

  • 1500 Test stations? (Score:5, Insightful)

    by theolein (316044) on Tuesday July 17 2007, @08:26PM (#19895807) Journal
    Apart from the claim by infosec sellout sounding less than adult - he says the payload was "weaponised" - and his claim that Apple will somehow not fix the "root cause" of the vulnerability if he gives it to them now - extortion anyone? mDNSResponder is Open Source - I seriously question how some independent reearcher can have, as he claims, a test base of 1500 systems. A big company with $1million to throw around might have that, or a university, but I seriously doubt he has the place or resources to afford a test base of this size unless he is using a local university or school, and judging by his spelling and grammar, he is either not English native or he is a teenager, or both. That says nothing about the veracity (truth) of his claim but it is somewhat juvenile, the whole thing.

  • Wow (Score:4, Funny)

    by Enrique1218 (603187) on Tuesday July 17 2007, @10:13PM (#19896613) Journal
    3 hypothetical worms in seven years. At this rate, I may have to switch to Linux next century!

  • Covered in shit? (Score:4, Insightful)

    by GrahamCox (741991) on Wednesday July 18 2007, @02:02AM (#19897893) Homepage
    I frequently hear the old chestnut that the only reason Macs aren't infested with malware is their lack of market share. Whether true or not, it's a funny argument, especially if the person using it is defending their choice of Windows.

    "I'm not going to use Mac because while it may be clean now, I could get covered in shit at any time!"

    "But you're already covered in shit".

    "Errr... yes. But I'm sorta used to it..."

  • 10.4.10 (Score:4, Interesting)

    by djahz (1129611) on Wednesday July 18 2007, @03:03AM (#19898139) Homepage
    10.4.10 isn`t on the affected systems list.

    • Re:10.4.10 (Score:4, Interesting)

      by fplinn (1129625) on Wednesday July 18 2007, @03:56AM (#19898327)
      wasn't this patched in may ? http://docs.info.apple.com/article.html?artnum=305 530 [apple.com]

      mDNSResponder
      CVE-ID: CVE-2007-2386
      Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9
      A remote attacker may be able to cause a denial of service or arbitrary code execution
      Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue.

    • Hey, be nice now! (Score:4, Funny)

      by Anonymous Coward on Tuesday July 17 2007, @06:40PM (#19894905)
      It's not a flaw; it's a feature. Remember, things are a little different in the Apple world ;)

      • Re:rape.osx is fitting (Score:4, Insightful)

        by TheRaven64 (641858) on Wednesday July 18 2007, @06:08AM (#19898787) Homepage Journal
        This could be a big problem on some university campuses, however. Mine, for example, has a huge flat-topology network that was deployed in the '80s (maybe before) and has been upgraded piecemeal without anyone really knowing how the whole thing fits together anymore. When I plug my laptop in, I get around 10KB/s of background traffic sent to the broadcast address hitting me. Running tcpdump shows that most of this is iTunes DAAP. Does this exploit also run on Windows? Apple bundle MDNSResponder with iTunes on Windows, so if that's where the exploit is then it could also be a problem there. It might also be a problem on other *NIX systems that bundle it, since Apple have released it under an Apache 2.0 license (cue all the 'Apple just takes from Open Source and never gives anything back' trolls).

    • Re:Can this travel via "broader network segment"? (Score:5, Interesting)

      by greed (112493) on Tuesday July 17 2007, @07:49PM (#19895495)

      Sure, get infected on the school's lab LAN. Bring your iBook oops MacBook to the coffee shop and get everyone else there. They all go home and infect their room-mate's machines. Who go to a different lab and it gets loose on the LAN there.

      Most laptops aren't isolated to a single LAN these days; they move around. If there really is a flaw in mDNSResponder, then such a worm does have a chance to propagate. Especially if it is subtle and doesn't crash or overload machines, or do insane amounts of network I/O, or any of the other things that cause people to think something's wrong.

    • The "Internet Worm" targeted Sendmail. Which has proceeded to become notorious for security holes.

      The biggest UNIX webserver security holes are due to PHP.

      The biggest problem is not "closed" vs "open" source. It's design. Is the API secure (that is, if the implementation is perfect, would the resulting system be perfectly secure)? Does the API fail "open" or "closed"? Is there a mechanism to request trusted access from *outside* the trusted domain? If so, is that enabled by default?

      If the answers are "yes", "closed", "no", and "no" then you may have built a secure system.

      Surprise, surprise, there's a lot of open source software that isn't secure by that standard, including the much-lauded Firefox. Now don't get me wrong, the surface area Firefox's XPI and the XPI install mechanism exposes to attack is like the radar signature of a stealth fighter, where Internet Explorer's "insecurity" zones and ActiveX give it the radar signature of a flock of 747s, but it's not necessary for either exposure to exist at all.

      Open Source doesn't create secure systems. It's a hell of a mitigating factor, yes, but the real source of long-lasting security holes (and we don't know if this is one or not, because the soi-disant "researcher" responsible isn't being open about the vulnerability he's found) is insecure design and a preference for patching particular attack vectors rather than fixing the insecure design. And that isn't limited to closed source systems.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.