Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Mac Developer Mulls Zero-day Security Response

Posted by CowboyNeal on Thu Feb 01, 2007 10:49 PM
from the in-the-nick-of-time dept.
1.6 Beta writes "Landon Fuller, the Mac programmer/Darwin developer behind the 'month of Apple fixes' project, plans to expand the initiative to roll out zero-day patches for issues that put Mac OS X users at risk of code execution attacks. The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches. The article quotes him as saying, 'Perhaps [it could be] the Mac OS equivalent to ZERT,' referring to the Zero-day Emergency Response Team."
+ -
story

Related Stories

[+] MacBook Hacked In Contest Via Zero-Day Hole in Safari 156 comments
EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"
[+] $16,000 Bounty for Sendmail, Apache Zero-Day Flaws 173 comments
Famestay writes "Verisign's iDefense is putting up a $16,000 prize for any hacker who can find a remotely exploitable vulnerability in six critical Internet infrastructure applications. The bounty is for a zero-day code execution hole on the following Internet infrastructure technologies: Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft Internet Information (IIS) Server and Microsoft Exchange Server. 'Immunity founder Dave Aitel, who also purchases flaws and exploits for use in the CANVAS pen testing tool, says its doubtful iDefense will get any submissions from hackers. "It's very hard to exploit [those listed applications]," Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever." Several other hackers I spoke to had very much the same message, arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies.'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by User 956 (568564) on Thursday February 01 2007, @11:02PM (#17854674) Homepage
    The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches.

    Windows has an auto-updating mechanism for "third-party patches". It's called Internet Explorer.
  • by MillionthMonkey (240664) on Thursday February 01 2007, @11:06PM (#17854702)

    Because the vulnerability allowed the execution of arbitrary code within the JVM via any Java applet, Fuller created a temporary patch for Mac OS X.
    Can he write an applet that runs the installer using the vulnerability? That would be really convenient.
      • And that, folks, is the good side of virus writing.

        If you're going to do this, please put a sleep statement in between your 'attacks'. Welchia [wikipedia.org] worked but made no attempt to throttle network connections, swamping every network segment where it was active, and Microsoft's sites as well. If it had taken on one machine every fifteen minutes on a segment, nobody probably would have noticed.
  • I love the idea of zero day patches, it's very... at the risk of being labeled a fanboi, Apple-ish. I know a lot of people are going to be calling for Microsoft to do something similar, but that's not going to happen just because of the sheer number of patches M$ has to put out. That makes the idea of a zero-day response team even more advantageous to Apple because it would give them yet another advantage over Microsoft that Gates just can't match. Definitely a good move on Apple's part, both for its use
    • by daveschroeder (516195) * on Thursday February 01 2007, @11:22PM (#17854812)
      Apple isn't doing this, and Landon Fuller doesn't have anything to do with Apple, other than having worked there. (And no, conspiracy theorists, he's not doing this at Apple's behest or as part of some coordinated fanboy effort to "make Apple look good".)

      What Apple should be doing is developing a much more comprehensive and responsive security response group, which is lacking now. Apple needs to be patching issues in a much more timely manner. Hopefully the outcome of MOAB, things like Fuller's proposal, and other related things will be a real discourse on Apple security response and Mac OS X security.
      • People who are close to Apple or at least know how company works said they won't rush out untested OS patches/updates just because some idiot file fuzzer (can crash the kernel via broken DMG. http://en.wikipedia.org/wiki/Fuzz_testing [wikipedia.org]

        In professional World, people already asks AVID, Adobe, Quark before applying any OS updates or they test it on test machine several days to make sure it won't break their work cycle.

        I was only bugged about Quicktime issue (which was exploited at Myspace) and Apple released the
        • given how apple seems to encourage use of dmgs for distributing mac files (a mac file is defined here as a file that contains actual information in the resource fork) i'd say a security issue (iirc it was a "crash but potential arbitary code" one) sounds pretty serious to me.
      • What Apple should be doing is developing a much more comprehensive and responsive security response group, which is lacking now.

        I've heard claims that Apple is not responsive enough before, but never any real support for those claims. They've certainly been fast enough in responding to security bugs we sent them. It would always be nice if they were faster. If they had 1000 people waiting by the phone to instantly work on any security issues that came up, and rolled them out in hours on an unstable bran

        • by mstone (8523) on Friday February 02 2007, @01:03PM (#17861922)

          Let's drop the cognitive dissonance, shall we?

          Vint Cerf recently made a report to the UN committee on internet security. He said that maybe 25% of all computers tied to the internet are infected. We're currently seeing the highest spam levels in the history of the internet, much of which is being sent by botnets that contain thousands or hundreds of thousands of compromised machines. We've gotten to a point in history where 'hundreds of thousands of machines compromised' is no longer a newsworthy fact. It's so freaking common that people just look at it as an unpleasant fact of life.

          And right in the middle of that context we have a few tens of millions of Macs that have been running unmolested for years.

          I don't give a damn about your abstractions. I don't give a damn about your heuristics. I don't give a damn about your moral indignation that Apple doesn't run its entire business in a way that's consistent with the .3 seconds of what passes for thought that you've put into any given issue. I'm an empericist. I care about what's actually happened.

          What's actually happened is that there hasn't been a single large-scale compromise of the Mac platform since the introduction of OS X. What's actually happened is that Apple has been notified of several vulnerabilities over the past few years and has rolled out security updates to address them. In many cases, they've also listed the names of the people who notified them of the problem. What's actually happened is that Apple has continued to develop its security model and has built a whole new set of tools into Leopard that will make OS X even more secure than it is today.

          There are exactly three classes of people who try to bang the "Macs are no more secure than Windows, but Mac users are too stupid to care" drum any more:

          1. Apple haters
          2. Lazy journalists who don't know or care shit about security but know that putting 'Apple' and 'security' in the headlines guarantees sales/page views/etc
          3. 'Security researchers' who either have a financial interest in selling AV software or are media-whore wannabees.

          Please note that I do not place Landon Fuller in any of those categories. He isn't trying to sell the world the idea that Apple's sky is falling. He's talking about a fairly interesting concept of community involvement in the overall Apple security process.

          I happen to disagree with the idea, personally.. IMO the chance of a zero-day patch breaking something is higher than the chance of a Mac getting infected between day zero and the time Apple releases an official patch (and yes, that includes all those issues that have been hanging out there unpatched for years.. show me the number of active exploits in the wild instead of just stuffing another set of panties into the wad currently wedged up your ass). I also see problems with trust and vetting. A MacZERT would presumably do some QA on the patches before distributing them, which leads to the same kinds of delays you get from Apple. And a MacZERT's capacity to look for unwanted side effects would be limited by the fact that outside third parties don't have all the relevant code.

          I do see the possibility of large benefits from a community effort to isolate and develop proposed solutions to bugs, since that would help Apple's own security team with some of the heavy lifting. I think Apple could develop a good dialogue with the third-party security community through such a system.

          But that has absolutely nothing to do with you. You're just another anti-fanboy out to spew meaningless FUD. The fact that you can't distinguish between "hundreds of thousands of compromised machines in a single botnet" and "no exploit of even a thousand machines over the past five years" means your opinion is too stupid to be taken seriously.

            • Enh, probably..

              But seriously folks, this well has been poisoned. To my mind there are three highlight events associated with the whole, "Mac users need to get off their complacent butts" meme:

              1. Symantec published a white paper with essentially that title. Its contents were a bunch of generalizations about complacency being bad and prevention being good.

                About a month later they published another paper that boiled down to, "No, we don't know of any actual Mac exploits in the wild. No, we don't have a

    • Re: (Score:3, Insightful)

      It shouldn't be a marketing advantage, releasing patches with so little testing onto the general population. Yes patches should be released in a timely manner, but that would just be taking it to opposite extreme.
    • What I like is that along with the innovation, Apple continues to think more about the customer than M$, in more ways than one. Fanboy, yup.
      • Re: (Score:2, Insightful)

        It's more risky running "zero day patches" than it is waiting a few days for any bugs with said patch to be flushed out.

        Given that Apple's not exactly famous for being Johnny-on-the-spot with security fixes, I don't quite get where you get "a few days" from.

        When days become weeks and weeks become months waiting for the official patch to arrive, the risk equation (such as it is) may very well be worth it for some groups of users. Maybe not you, but it's no use foreclosing everyone who might be interested from that possibility. And even beyond that there's the whole Freedom to Tinker [freedom-to-tinker.com] thing. I personally found working on some

        • Re:Quite nice (Score:4, Insightful)

          by 99BottlesOfBeerInMyF (813746) on Friday February 02 2007, @11:26AM (#17860110)

          Given that Apple's not exactly famous for being Johnny-on-the-spot with security fixes, I don't quite get where you get "a few days" from.

          Do tell, how slow is Apple to fix known security issues? My coworkers have submitted two security bugs to Apple that I know about. Both were local rather than remote, thus posed little risk to the average user. Both were fixed within a few weeks and credited the person who found them. In at least one instance of a more serious security issue Apple turned a fix around in 9 days from disclosure, which is bloody fast or a full dev/qa cycle at any real software company. So you do have some reason for believing Apple is slow to respond to real security concerns, don't you? I'm a bit less inclined to just assume you're right and a little more interested in some citations.

          • Well, one obvious example would be that it's now N days into February and only one of the MoAB bugs has a patch, and there is (as usual per Apple policy) no communication about what's being done with respect to the other bugs. Will they ever get fixed? Are they working on them? Who knows? Certainly not the user community and (again per policy) usually not the person that reported the problem either.

            My own experience (DHCP remote root a couple years ago) was that it took 2 1/2 months for a fix during which c
            • Well, one obvious example would be that it's now N days into February and only one of the MoAB bugs has a patch...

              I take it you've never done commercial software development in your life? How exactly would you schedule a dev/qa cycle that gets all the bugs fixed and regression tested so that all the bugs at the beginning of the month and end of the month are fixed at the end of the month a day after the last, official bug is announced? Part of the reason the MoAB is so responsible is that spacing out bug

  • Unnecessary. (Score:5, Insightful)

    by sakusha (441986) on Friday February 02 2007, @12:22AM (#17855204)
    Almost all of the MOAB bugs have already been patched, including OS fixes by Apple. Some of the application fixes were released within hours of the public announcement of the bug. Yet NONE of those fixes have been linked on the MOAB website.

    The normal processes are working. What is NOT working is the MOAB process. If they used the normal procedure of notifying the developers privately, these bugs could have been fixed in days or even hours, before any public disclosure. But that wouldn't achieve what the MOAB hackers wanted. MOAB isn't about security, it's about publicity whoring.
    • Re: (Score:2, Informative)

      I wholeheartedly agree with the importance of notifying the vendor -- unfortunately, that's not always done. The point of "0-day" patches is to provide a security option where none currently exists.
    • I think it would be also very bad to link to MOAB site to make people's Safari browser freeze with a tab having non submitted webmail waiting?

      http://www.isfym.com/site/blog/C65B4D05-6B0F-46AB- 9D15-9B841876FEF1.html [isfym.com]

      These guys and organised trolls in name of professional developer houses could be one of the worst ones IT industry ever seen.

      I don't recall any security "blog" freezing OS default browser to prove their 133t capabilities. I have also heard that jp2 issue is a year old bug which was never publici
      • These guys and organised trolls in name of professional developer houses could be one of the worst ones IT industry ever seen.

        Yeah, they are real security "experts" [heise-security.co.uk]

        This is not the first time that the MoAB team has had its fun at the expense of users. Those who tried to call not yet released advisories by guessing their file names were treated to extremely disgusting pornographic images. When heise Security reported on the matter and refused to retract its criticism, calling the action "childish", LMH accused Heise of being into "illegal, dishonest, malicious" activities.
        He apparently just failed to understand that a German ver

      • Re:Unnecessary. (Score:5, Insightful)

        by Rosyna (80334) on Friday February 02 2007, @01:19AM (#17855494) Homepage
        You have to realize that MOAB isn't an unwarranted attack against Apple. It's backlash for years of flaky technical support, deceitful practices and arrogance on the part of the Mac community in general.

        Yeah, that's clearly their intention after you look at the non-apple issues such as the ones in OmniWeb, Transmit, VLC, Flip4Mac, Rumpus, et cetera. Clearly, those are an attack against apple's "flaky technical support".
        • The claim that the "Mac community is arrogant" mystified me until I realized that people who make this claim are probably masking an inferiority complex of some sort. Most Macintosh users don't know enough about computers to be arrogant. They are, if anything, rather meek on the whole. I suspect that IT professionals whose experience is limited to Windows (which is, after all, most of them) resent the honestly dumbfounded looks they get from these fawn-eyed Mac users who innocently say things like, "Why
          • Re: (Score:3, Interesting)

            I realized that people who make this claim are probably masking an inferiority complex of some sort.

            I can assure you that is not the case. I consider myself a Linux user above all else. As for the arrogance, I can only speak about those I've come in contact with, which is mainly here on slashdot. It seems that every post about OS X security or Apple's business practices ends with "but-but-but Windows!". That comes off as arrogant to me. I know there are plenty of exceptions. Just don't claim that I feel
            • As for the arrogance, I can only speak about those I've come in contact with, which is mainly here on slashdot. It seems that every post about OS X security or Apple's business practices ends with "but-but-but Windows!".

              Yeah, well, same applies to posts about Linux, and about Windows. Newsflash: n% of all people are idiots. That applies to Mac users as well as to Linux or Windows users.

            • I realized that people who make this claim are probably masking an inferiority complex of some sort.

              I can assure you that is not the case. I consider myself a Linux user above all else.
              So you can't be arrogant because you use Linux?
            • As for the arrogance, I can only speak about those I've come in contact with, which is mainly here on slashdot.

              If our opinion of humanity was based on comments posted to Slashdot, I think we'd have all shot ourselves by now.

      • Your argument is out of context. You can not compare intentionally malicious methods, like worms, with an intentionally educational or informational which is certainly not a malignant one. In this case, the proper method to do what MOAB is doing is to actually work with the developers directly, or Apple regarding OS issues. They can *also* post them to their site, but to just throw them up there as if they were gotchas....its publicity whoring.

        Your argument boils down to bad OS karma. That's pretty wea
      • bo-oh-oh-oh-oh-gus! (Score:5, Interesting)

        by Gary W. Longsine (124661) on Friday February 02 2007, @03:17AM (#17856084) Homepage Journal

        wait until OS X gets enough market share for these vulnerabilities to be bought, sold and used to compromise computers en masse.
        Apple sells over five million new systems each year. There are probably about 20 or 25 million systems running Mac OS X right now. The financial incentive to exploit Mac OS X has been plenty high enough for a long time. Botnets are rentable, and people peek at the prices now and then and report on it. I've seen numbers like this several times:

        going rate for botnets: [blanchfield.com.au] the going rate is around the USD$1,000 per hour for as many as 30,000 zombie PC's
        If crackers could easily take over Mac OS X systems, they could make lots of money. Clearly, they can't easily own Mac OS X. There are plenty of systems to make it worth their while.

        Although I agree that a Mac OS X worm would be bad publicity for Apple, and that Apple could improve the way they handle response to reported security defects, I think they have produced a reasonable track record over the past five years regarding the basic security of Mac OS X. Apple's security track record is due much more to the relatively weaker security of Windows systems than to Windows market dominance. Windows is low hanging fruit, crack-wise. If it were harder to own Windows systems, crackers would switch to Mac OS X in a flash. Crackers don't need to own 20 million systems, they really only need a few thousand at a time.
          • "many experts have said as much."

            For somebody who took another to task for not putting numbers into context, perhaps you should have qualified the assertion above by stating that the linked article quotes two people, so in this case "many" should be read as "a couple".
          • ...botnet owners are going for the easiest source of income.

            Yeah, and he DID mention Windows as the "low hanging fruit", did he not? That does translate into the "easiest source of income".

            Kinda makes our point. Doesn't matter if the Mac OS has vulnerabilities or not. Doesn't matter if his numbers are right or not. (Which, at the rate of sales per Q1 this year, may well be right.)

            The point is, that Windows is so vulnerable, due in large part to lazy or uneducated users failing to patch their systems and
              • EQUALLY? I still don't see that.

                The Month of Apple Bugs couldn't even find 30 bugs in the OS itself to fill up a typical month, let alone 31 for the chosen month of January. Just how does that stack up to the huge number of vulnerabilities, exploits, viruses, worms and trojans now hitting even the 1/4 of all PCs you cite?

                I'm sorry, but your balance seems just a bit skewed.
                  • None of that changes the fact that your balance, like I noted, is skewed.

                    Nothing I said claimed that the Mac OS is invincible. You can take your Arty McStrawman back to where you drug him out from under some rock. What does matter is that, on balance, the Mac OS IS less vulnerable than the bug riddled mess that is Windows, which, like has been noted before, is much of the reason why malware writers go after Windows, and not the relative numbers.

                    Nice try at changing the subject...
      • You have to realize that MOAB isn't an unwarranted attack against Apple. It's backlash...

        Oh, yeah, backlash. Is that why they inserted html code into the web page for day 29 that crashes Safari? Complete with a nasty little jibe at "loopers" (whatever that is???)

        Complete bullshit.

        These guys are only after the same thing Maynor and Ellch were after last summer - notoriety and publicity.

        Anything that includes a hidden attack in the code of a web page is unethical, unwarranted, unprofessional and just plain
      • On this and the MOAB claims that Apple doesn't fix bugs that are reported thru the official channels.

        Show us specific, documented examples of bug reports sent to Apple that they have refused to address.

        If MOAB doesn't like the attitudes of some users, then go kick some tires. But exhaust the official channels with Apple or 3d party developers, be professional, or you're going to be dismissed by professionals as dangerous and immature.

        Instead, they've come out swinging at not only the Mac community that app
      • It's backlash for years of flaky technical support, deceitful practices and arrogance on the part of the Mac community in general.

        Yeah... Although I think it's mostly Artie MacStrawman [crazyapplerumors.com] who's responsible for the Mac community's bad image.

      • These are reasonable concerns and it shows that Apple is worrying about the bottom line more than the customer.

        One of the reasons OS X will have better security than any Windows release for the foreseeable future is that Apple's bottom line is directly tied to the satisfaction of their customers. If the average OS X user starts to have problems because of worms, they switch to something else and Apple loses money. There is very little locking people in. You can even just install a new OS on the Mac. Most

        • There is very little locking people in.

          Except for

          • iTunes' movies (DRM)
          • iTunes' music (DRM)
          • Microsoft Office (platform dependant)
          • iLife (doesn't lock me in, but it has 'locked' some people I know in -- even though they hate OS X)
          • Hardware (often not fully supported on other OSes)
          • Proprietary file formats, that prevent you from migrating things over (e-mail databases? music labellings [couldn't just use id3 with mp3s for storing all the information that is possible]?)
  • Apt-get? (Score:4, Funny)

    by MECC (8478) * on Friday February 02 2007, @07:20AM (#17857236)
    auto-updating mechanism for the third-party patches.

    He's going to port apt-get to OS X?

  • by ScooterComputer (10306) on Friday February 02 2007, @08:48AM (#17857796)
    I don't see why this shouldn't be done. In fact, it makes a lot of sense for all platforms. Create a third party mechanism by which users/admins can patch Zero day/unpatched flaws that relies on a community effort to provide the patches. Simple. Except it really needs the support of the OS vendor, because at some point, when the vendor releases the patch, you'd want to be able to "turn off" the temporary one. You'd also need an agreed upon "Master List" of vulns, for tracking purposes.

    You'd think that this kind of hand-in-hand cooperation would be a no-brainer, but I doubt it. Companies (here's looking right at Apple) still just haven't wrapped their heads around the open exchange of ideas; they are afraid that admitting flaws makes them -look- bad. Ewwww, poor coders. But in reality I think everyone who uses computers by this point in time KNOWS flaws happen...it isn't that they will happen, it has become what are you gonna do about it? And it is pure arrogance by the OS vendors to think that neither the community has the ability to create these patchs nor that the users/admins are interested in them.

    Really this is a thing that OS vendors should aspire to, integrating this kind of response mechanism into their existing Software Update suite would be a Good Thing.
    • It's 1pm here, so I was eating lunch! ;-)

      I guess I would agree though, MS won't be able to match it, or they'll need to fix the fix. :-)

    • They are too busy huging iPhone brochures and feeding up their credit cards.

    • Re:no trolls?! (Score:5, Interesting)

      by Anonymous Coward on Thursday February 01 2007, @11:58PM (#17855052)
      I think MOAB story is getting stale. I submitted a story on how MOAB website tried to crash Safari using .jp2 vulnerability and include the comment

      <!-- Never use the macbook at bed again when browsing the MoAB or you will fry your balls, looper -->
      in the HTML code. However, /. didn't bother accepting it.

      MOAB includes hack attempt [isfym.com]
      • Re:no trolls?! (Score:4, Interesting)

        by Ilgaz (86384) on Friday February 02 2007, @06:36AM (#17856976) Homepage
        I guess Slashdot joined some of major IT sites not giving any "advertisement" to MOAB trolls. For example, Slashdot could publicise these idiots having inline jp2 which will make Safari which is a TABBED browser freeze, other script kiddies may link it as their homepage on some zealot fighting sites such as Digg.

        BTW it didn't "try" to crash Safari, the default/preinstalled browser of an operating system, a tabbed browser. It actually froze it. It is again, not a security issue but could be a good troll tool.

        IMHO if nobody has seen true face of these idiots, they should have seen on day 29.

        ps: That JP2 is bad for OS X Finder too, don't keep it in your disk or don't browse that folder with Finder/Path Finder,whatever uses Kakadu jp2 lib.
    • Re:no trolls?! (Score:5, Interesting)

      by Cysgod (21531) on Friday February 02 2007, @12:39AM (#17855278) Homepage

      quiet night tonight... not one mac fan boy or anti-mac troll has popped up yet, though im sure its just a matter of time
      Reversing the broken code that people find and figuring out how to patch it can be a great, fun mental exercise if it's something you're interested in. The personal satisfaction from doing that is sometimes offset by all this seemingly inevitable rabblerousing between fanbois and, their complementary particle, anti-fanbois.

      When fanbois and anti-fanbois come into contact they emit a special radiation that causes a temporal shift, known informally as "a colossal total waste of time", for anyone who happens to be reading or listening. For example, you're reading a technical thread, then two of these subsentient particles come into contact. They insist on threadjacking your discussion into an us versus them discussion that only tangentially involves the subject at hand and is logically irritating since it represents a false dilemma [wikipedia.org]. As you skip past the messages looking for some meaningful discussion and swearing about the state of technical discourse, you suddenly discover two hours have passed due to the temporal-moronic radiation.

      Maybe people could study training Bayesian filters to delete those messages (or just delete the authors).
        • Uhm... in case you hadn't noticed, everyone who uses a cell phone in the United States is talking about the Apple iPhone. I'd say the current status of the iPhone is more like: "the most insanely successful publicity coup that has ever been executed by a corporation for a single product."
    • So you claim Rob Malda, CmdrTaco getting "free powerbook" from Apple to post this story.

      It is good to see the profile of MOAB supporters on Slashdot considering the fact that MOAB people aren't much different, they have somehow learned how to fuzz files, use gdb or use jp2 to freeze Safari on public pages.
    • I can see by the drivel you spout why you did it while hiding your identity...