Slashdot Log In
Worm Threat Forces Apple To Disable Software?
Posted by
Zonk
on Fri Aug 03, 2007 11:15 AM
from the batten-down-the-hatches dept.
from the batten-down-the-hatches dept.
SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"
Related Stories
[+]
Worm Claimed For Apple OS X 398 comments
SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
*Pulls out a plate 'o crow* (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
I don't think the issue is the spec, it's the asinine cute features that M$ decided to implement. Like UPnP, BHO, etc etc. Maybe we should follow Apple's example, and eliminate all vulnerabilities by disabling the TCP/IP stack?
Re: (Score:2, Funny)
Re: (Score:3, Informative)
Re:wait a minute (Score:5, Insightful)
In the modern world, there are simply too many protocols and systems popping up; no operating system exists in a vacuum, and many vulnerabilities may be in services, subsystems and so on. And with the pressure to get things out and shave off extra CPU cycles, there are too many situations where someone simply goes 'oh, well, I checked that this data is valid up HERE, so I don't need to check again down here in this function I call later,' and then later another piece of code goes, 'oh, look, here is a function that does what I need, I will just reuse it' and assumes that function does its own error-checking, so does not check the data before passing into it. And thus, you create a pathway where unvalidated data gets passed down and can cause buffer overflows or whatever.
No operating system or development team is somehow inherently immune to this.
The thing is that Windows not only has kept large chunks of legacy code -- which makes it hard to really break down and restrict user permissions without breaking older programs -- but spent some time really pushing the Active X technology, which then proved to create a lot of problems. Apple, on the other hand, went off the tracks entirely and threw out their operating system; that was a risky move which could have killed them off entirely, but in the end they got an operating system which was built atop a multi-user system with better permissions.
That does not mean that Apple somehow writes inherently better code than Microsoft; I happen to like OS X, but Apple's engineers are not necessarily smarter or more careful in the actual lines of code they write. The difference as I see it is that Microsoft is bogged down by hard-to-debug and support legacy code, while Apple got to make a cleaner start... and then on top of that, many bits of OS X (CUPS, zeroconf/Bonjour, WebKit, etc.) are open source.
Apple contributes funds and engineering to these projects (and in some cases such as zeroconf, came up with the original specifications), but as they are open source things tend to get found and fixed faster in community review. That is why OS X, while not bulletproof, tends to be at least a bit more secure than Windows.
That is my take on it, anyway.
Parent
Re: (Score:3, Informative)
Those days are also over (atleast for the most part). Windows now comes with its firewall on by default, and those wide op
Re:*Pulls out a plate 'o crow* (Score:4, Interesting)
I hope this indicates a return to sensibility at Apple. Lately they are trying so hard to be like MS, that the security has suffered. Can't turn off HTML in email is at the top of my security vulnerabilities.
Parent
News at 11... (Score:5, Insightful)
Yawn.
Re: (Score:3, Insightful)
Here is a hint: A pretend army of supporters is still a pretend army.
Isn't it fascinating to watch as shitty comments (like we see above), vacillate back and forth between "+5 Insight
Re: (Score:2, Insightful)
I can think of a lot of phrases that would increase the signal to noise ratio (for me) if I could use them to exclude noise.
I believe a site mandated filter would be both useless and undemocratic.
New PC "language" (Score:2)
Re:News at 11... (Score:5, Insightful)
The proof is in the number of successful worms and viruses for OS X, which depending on how you define them, hover right around zero. Yes, some of this is likely because of market share, but there's plenty of bragging rights associated with creating the first large-scale OS X compromise, so I wouldn't expect to see none. And of course, even if the relatively low number of security issues is because of market share, it doesn't make it any less pleasant for those of us who use OS X, especially since I'm not expecting it's share to go over 15-20%.
Anyway, if I accept your statement that OS X isn't perfect, will you stop bitching about smug mac users every time there is a discussion marginally related to Apple?
Thanks,
gutter
Parent
Re:News at 11... (Score:5, Insightful)
In other words, Ford Mustang owners tend to see Chevy Corvette owners as smug. Neither side is really willing to appreciate that each has advantages the other doesn't possess, and can't stand it when somebody highlights the advantage. That isn't ever going to change
I don't see how the situation is any different when an operating system is concerned, rather than a brand of vehicle.
Here's a news flash: OS X has advantages over Windows, Linux, and FreeBSD. OS X can brag about security, because there is a far smaller percentage of its users that have infected, compromised, or zombified machines. Ffind reasons to discount that fact is meaningless: It doesn't matter if the number of attackers is smaller; the goal is to not fall victim to an attack, which OS X has an excellent record of doing.
Here's another one: Macintoshes have disadvantages: They don't have as much native software. A virtualization product like VMware or Parallels is a rare sight on Windows, yet is quite common on a Macintosh. There's always some app that only exists for Windows that the user can't live without. So Mac users not only pay $130 for OS X, but also $80 for a virtualization product, and then they have to buy the most expensive license for Windows. Mac software doesn't enjoy the "freedom" that most Linux users enjoy; much of the software for the Mac is closed-source.
Still, you don't have to like it when OS X users dismiss the advantages of other OSes (like the amount of software for Windows, or the freeness of Linux).
Just take the time to realize that's it's a different flavor of the time-honored "Chevy vs Ford" debate. What is "better" depends on the way the beholder sees things, and it's childish to believe that there's only one true way.
Parent
Standard Operating Procedure? (Score:2)
Re:Standard Operating Procedure? (Score:5, Interesting)
1. Implement it to Microsoft's spec.
2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
3. Implement it securely.
Choose only one.
I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.
Parent
Re:Standard Operating Procedure? (Score:4, Informative)
Parent
Re:Standard Operating Procedure? (Score:5, Interesting)
Can you show me an implementation of UPnP that hasn't had bugs? According to wikipedia [wikipedia.org] security is a problem with the spec itself. It's getting so bad that some major router manufacturers are disabling the routing of UPnP packets by default on their non-consumer (and a few consumer) networking appliances.
And my list was more of a dig at OOXML rather than being security related.
Parent
Um, so ? (Score:5, Insightful)
I'm guessing there's a regular scheduled security update process in Apple. If you can't fix it in time for the next patch-release, isn't is *better* to temporarily disable it ? I really doubt it's a permanent removal of the feature - they're just being responsible.
Simon.
ITS A LIE (Score:3, Funny)
Re: (Score:3, Funny)
OT but... (Score:2, Informative)
Yes, Apple is made up of many people; but my car is made up of many parts. You don't say "my car need gas" do you?
This perplexes me, can someone explain it? Sorry if it's completely OT (except that this (to me) error is in the blurb).
-mcgre
Re: (Score:3, Informative)
If you prefer, consider mentally replacing "Apple" with "the people who work at Apple"...
Simon
Apple ... Worm (Score:5, Funny)
Re: (Score:2)
Hmmm... (Score:3, Interesting)
http://developer.apple.com/opensource/internet/bo
Is Apple the developer of mDNSResponder or are they just using it?
Re:Hmmm... (Score:5, Informative)
mDNSResponder originated from Apple.
Parent
Re: (Score:2)
Re: (Score:2)
Sensationalism by Zonk (Score:5, Insightful)
Shouldn't this be optional? (Score:2)
At least they disabled it! (Score:4, Interesting)
But at least they decided that it's better to disable the feature and minimize the damage to the net as a whole (and yes, even if you don't have an Apple, a worm damages you by clogging your tubes with packets trying to spread itself). MS decided that it's better to keep the insecure service up and running 'til it can be addressed.
Question for 100: Still getting sober/blaster packets? I do.
Re: (Score:3, Insightful)
Re: (Score:2)
My guess is that it was simply more convenient to do NOTHING. And this security hole (and disabling it) is far from a product-crippling effect that you describe. More accurately, it would be a bug in Office's Thesaurus and disabling it. Yes, it would inconvenience some people, but it's far from crippling the product into uselessness.
Re: (Score:3, Informative)
Outlook was plagued by viruses and Microsoft responded by releasing a patch that simply refused to allow the user to open certain types of attachments. There was no override in the original version of the patch.
http://www.slipstick.com/outlook/esecup.htm [slipstick.com]
When Exchange 5.5 was targeted by reverse-NDR spam attacks Microsoft shipped a patch that allowed the user to simply turn off non-delivery reports. Unfortunately the patch didn't work as described on many
Apple did the right thing (Score:5, Insightful)
A) Pick a feature that's dumb. (like embed a scripting language into an image format, or give a spreadsheet scripting language access to the filesystem)
B) Choose to preserve the dumb feature in spite of known security problems.
C) Treat the resulting backlash as a "PR issue" rather than a technical one.
D) Sometimes, if the backlash gets bad enough, they'll hack in security restrictions in response to specific known implementations that take advantage of the vulnerability rather than fix the vulnerability. EG: fixes that look for a XXX worm trace, rather than fix the thing that XXX worm exploits. (See anti-virus [wikipedia.org])
Apple is doing the right thing, here, folks! It may or may not be that the feature mentioned is analogous to (A) above. Either way, Apple is chosing security over features, even though features are important.
Re: (Score:3, Interesting)
Many, many programs use IGD, from Instant Messengers to games.
Sorry, I cannot agree that it is the right thing.
Re: (Score:2)
Re: (Score:2)
"additional validation" or "disabled support" (Score:3, Interesting)
Clearly something is unclear since iChat is obviously still using UPnP IGD, likely as a client?
But why is the mDNSResponder using UPnP IGP anyway? mDNS is for service discovery etc and is basically a competitor to UPnP (I thought). Perhaps there is a way for mDNSResponder to leverage UPnP IGP to broadcast service messages (e.g. bonjour) across a local NAT? If so I've never seen nor heard of this working -- so perhaps what they're disabling is vulnerable code that wasn't doing anything anyway?
Re: (Score:2)
My guess is that since Apple decided to unilaterally disable the feature (without giving any option to activate it for the mighty or protected folks) it is because it was probably never used.
Who wants to bet... (Score:3, Interesting)
I bet there's a secret cabal at Microsoft that is working on this very thing.
Now that Apple has disabled uPnP compatibility.... (Score:3, Interesting)
Big Loss! (Score:3, Informative)
Re: (Score:3, Insightful)
You can give yourself points for knowing unrelated details about Microsoft's non-standard, security challenged architecture. The number of devices using UPNP as anything other than a way to play games over a router are really insignificant however.
The wikipedia article you linked to points out:
- UPnP uses HTTP over UDP (known as HTTPU and HTTPMU for unicast and
Re: (Score:2)
Here is a page with instructions about how to remove it (read the full thread; the first post has an error):
http://www.x64bit.net/site/board/index.php?showtop ic=4214 [x64bit.net]
Re: (Score:2)
Re:Does anyone use mDNS? (Score:4, Insightful)
UPNP - Microsoft
Apple have disabled the Microsoft protocol. Won't affect them in the slightest I'd expect.
mDNS is actually fairly useful.. you can advertise servers across the network using it, and it's an easy protocol to implement (a few hundred lines of code will do it).
UPNP is an XML infested mess with a huge spec that I wouldn't try to implement unless I had a deathwish. And in all that mess they forgot to add any user or machine verification.. the upshot being if you enable it on a router you can disable its firewall with a 10 line perl script.
Parent
Re:TV add (Score:4, Funny)
"And I'm a PC. Hey Mac, I heard you don't get viruses. Congratulations."
*PC Shakes Mac's hand*
"That's right, PC. But I do have worms."
*PC starts wiping hand furiously*
Parent
Re:Moderations tell all (Score:4, Informative)
"OS X is every bit as crash prone and unreliable as Windows" (It's crash prone, but not "every bit as crash prone")
"not so with Apple, which radically changes their OS every few years" (Two points here: 1. if this is true, it belies your following statement 2. it's not true)
"There is no inherently superior security in OS X" (the overall design and implementation of OS X is more secure than the overall design and implementation of XP. Vista is a vast improvement over XP, but it remains to be seen how this works out)
"those people who blame Microsoft for vendor lock-in" (straw man, no one claims this)
"OS X is the ultimate in vendor lock-in" (OS X is an extremely open system. The only "lock-in" is with their hardware, which really isn't that big of a deal.)
There are people who get fanatical about Macs, but you're lumping a whole lot of rational people in with them, and fully deserve flaimbait or troll modding for it.
Not to mention the fact that both you, and the OP are both (at present) modded positively, which makes your cries of being oppressed a bit silly.
Parent