Mac Developer Mulls Zero-day Security Response
Posted by
CowboyNeal
on Thu Feb 01, 2007 10:49 PM
from the in-the-nick-of-time dept.
from the in-the-nick-of-time dept.
1.6 Beta writes "Landon Fuller, the Mac programmer/Darwin developer behind the 'month of Apple fixes' project, plans to expand the initiative to roll out zero-day patches for issues that put Mac OS X users at risk of code execution attacks. The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches. The article quotes him as saying, 'Perhaps [it could be] the Mac OS equivalent to ZERT,' referring to the Zero-day Emergency Response Team."
Related Stories
[+]
MacBook Hacked In Contest Via Zero-Day Hole in Safari 156 comments
EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"
[+]
$16,000 Bounty for Sendmail, Apache Zero-Day Flaws 173 comments
Famestay writes "Verisign's iDefense is putting up a $16,000 prize for any hacker who can find a remotely exploitable vulnerability in six critical Internet infrastructure applications. The bounty is for a zero-day code execution hole on the following Internet infrastructure technologies: Apache httpd, Berkeley Internet Name Domain (BIND) daemon, Sendmail SMTP daemon, OpenSSH sshd, Microsoft Internet Information (IIS) Server and Microsoft Exchange Server. 'Immunity founder Dave Aitel, who also purchases flaws and exploits for use in the CANVAS pen testing tool, says its doubtful iDefense will get any submissions from hackers. "It's very hard to exploit [those listed applications]," Aitel said. "IIS 6 hasn't had a public remotely exploitable bug in it. Ever." Several other hackers I spoke to had very much the same message, arguing that $16,000 can never equate to the amount of work/expertise required to find and exploit a hole in the six targeted technologies.'"
This discussion has been archived.
No new comments can be posted.
Mac Developer Mulls Zero-day Security Response
|
Log In/Create an Account
| Top
| 94 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Bonzi buddy auto-installer (Score:5, Funny)
(http://www.atomjax.com/)
Windows has an auto-updating mechanism for "third-party patches". It's called Internet Explorer.
Arbitrary patch (Score:5, Funny)
(Last Journal: Wednesday January 31 2007, @02:25AM)
Quite nice (Score:1, Insightful)
(http://www.localdisturbance.com/)
This is not a "move on Apple's part" (Score:5, Insightful)
(http://das.doit.wisc.edu/)
What Apple should be doing is developing a much more comprehensive and responsive security response group, which is lacking now. Apple needs to be patching issues in a much more timely manner. Hopefully the outcome of MOAB, things like Fuller's proposal, and other related things will be a real discourse on Apple security response and Mac OS X security.
Re:This is not a "move on Apple's part" (Score:5, Interesting)
Let's drop the cognitive dissonance, shall we?
Vint Cerf recently made a report to the UN committee on internet security. He said that maybe 25% of all computers tied to the internet are infected. We're currently seeing the highest spam levels in the history of the internet, much of which is being sent by botnets that contain thousands or hundreds of thousands of compromised machines. We've gotten to a point in history where 'hundreds of thousands of machines compromised' is no longer a newsworthy fact. It's so freaking common that people just look at it as an unpleasant fact of life.
And right in the middle of that context we have a few tens of millions of Macs that have been running unmolested for years.
I don't give a damn about your abstractions. I don't give a damn about your heuristics. I don't give a damn about your moral indignation that Apple doesn't run its entire business in a way that's consistent with the .3 seconds of what passes for thought that you've put into any given issue. I'm an empericist. I care about what's actually happened.
What's actually happened is that there hasn't been a single large-scale compromise of the Mac platform since the introduction of OS X. What's actually happened is that Apple has been notified of several vulnerabilities over the past few years and has rolled out security updates to address them. In many cases, they've also listed the names of the people who notified them of the problem. What's actually happened is that Apple has continued to develop its security model and has built a whole new set of tools into Leopard that will make OS X even more secure than it is today.
There are exactly three classes of people who try to bang the "Macs are no more secure than Windows, but Mac users are too stupid to care" drum any more:
Please note that I do not place Landon Fuller in any of those categories. He isn't trying to sell the world the idea that Apple's sky is falling. He's talking about a fairly interesting concept of community involvement in the overall Apple security process.
I happen to disagree with the idea, personally.. IMO the chance of a zero-day patch breaking something is higher than the chance of a Mac getting infected between day zero and the time Apple releases an official patch (and yes, that includes all those issues that have been hanging out there unpatched for years.. show me the number of active exploits in the wild instead of just stuffing another set of panties into the wad currently wedged up your ass). I also see problems with trust and vetting. A MacZERT would presumably do some QA on the patches before distributing them, which leads to the same kinds of delays you get from Apple. And a MacZERT's capacity to look for unwanted side effects would be limited by the fact that outside third parties don't have all the relevant code.
I do see the possibility of large benefits from a community effort to isolate and develop proposed solutions to bugs, since that would help Apple's own security team with some of the heavy lifting. I think Apple could develop a good dialogue with the third-party security community through such a system.
But that has absolutely nothing to do with you. You're just another anti-fanboy out to spew meaningless FUD. The fact that you can't distinguish between "hundreds of thousands of compromised machines in a single botnet" and "no exploit of even a thousand machines over the past five years" means your opinion is too stupid to be taken seriously.
Re:Quite nice (Score:4, Insightful)
Given that Apple's not exactly famous for being Johnny-on-the-spot with security fixes, I don't quite get where you get "a few days" from.
Do tell, how slow is Apple to fix known security issues? My coworkers have submitted two security bugs to Apple that I know about. Both were local rather than remote, thus posed little risk to the average user. Both were fixed within a few weeks and credited the person who found them. In at least one instance of a more serious security issue Apple turned a fix around in 9 days from disclosure, which is bloody fast or a full dev/qa cycle at any real software company. So you do have some reason for believing Apple is slow to respond to real security concerns, don't you? I'm a bit less inclined to just assume you're right and a little more interested in some citations.
Unnecessary. (Score:5, Insightful)
The normal processes are working. What is NOT working is the MOAB process. If they used the normal procedure of notifying the developers privately, these bugs could have been fixed in days or even hours, before any public disclosure. But that wouldn't achieve what the MOAB hackers wanted. MOAB isn't about security, it's about publicity whoring.
Re:Unnecessary. (Score:5, Insightful)
(http://www.unsanity.org/)
Yeah, that's clearly their intention after you look at the non-apple issues such as the ones in OmniWeb, Transmit, VLC, Flip4Mac, Rumpus, et cetera. Clearly, those are an attack against apple's "flaky technical support".
bo-oh-oh-oh-oh-gus! (Score:5, Interesting)
(http://intrinsicsecurity.com/ | Last Journal: Sunday August 28 2005, @11:11AM)
Although I agree that a Mac OS X worm would be bad publicity for Apple, and that Apple could improve the way they handle response to reported security defects, I think they have produced a reasonable track record over the past five years regarding the basic security of Mac OS X. Apple's security track record is due much more to the relatively weaker security of Windows systems than to Windows market dominance. Windows is low hanging fruit, crack-wise. If it were harder to own Windows systems, crackers would switch to Mac OS X in a flash. Crackers don't need to own 20 million systems, they really only need a few thousand at a time.
Yeah, right... (Score:1, Flamebait)
Not sure I'd trust zero-day patches from a guy who couldn't hack it working for Avie.
Just sayin'.
Apt-get? (Score:4, Funny)
He's going to port apt-get to OS X?
Good idea, but needs support it won't get (Score:3, Interesting)
You'd think that this kind of hand-in-hand cooperation would be a no-brainer, but I doubt it. Companies (here's looking right at Apple) still just haven't wrapped their heads around the open exchange of ideas; they are afraid that admitting flaws makes them -look- bad. Ewwww, poor coders. But in reality I think everyone who uses computers by this point in time KNOWS flaws happen...it isn't that they will happen, it has become what are you gonna do about it? And it is pure arrogance by the OS vendors to think that neither the community has the ability to create these patchs nor that the users/admins are interested in them.
Really this is a thing that OS vendors should aspire to, integrating this kind of response mechanism into their existing Software Update suite would be a Good Thing.
Re:no trolls?! (Score:2)
I guess I would agree though, MS won't be able to match it, or they'll need to fix the fix.
Re:no trolls?! (Score:2)
They are too busy huging iPhone brochures and feeding up their credit cards.
Re:no trolls?! (Score:5, Interesting)
MOAB includes hack attempt [isfym.com]
Re:no trolls?! (Score:4, Interesting)
(http://www.noooxml.org/petition)
BTW it didn't "try" to crash Safari, the default/preinstalled browser of an operating system, a tabbed browser. It actually froze it. It is again, not a security issue but could be a good troll tool.
IMHO if nobody has seen true face of these idiots, they should have seen on day 29.
ps: That JP2 is bad for OS X Finder too, don't keep it in your disk or don't browse that folder with Finder/Path Finder,whatever uses Kakadu jp2 lib.
Re:no trolls?! (Score:5, Interesting)
(http://www.carrel.org/)
When fanbois and anti-fanbois come into contact they emit a special radiation that causes a temporal shift, known informally as "a colossal total waste of time", for anyone who happens to be reading or listening. For example, you're reading a technical thread, then two of these subsentient particles come into contact. They insist on threadjacking your discussion into an us versus them discussion that only tangentially involves the subject at hand and is logically irritating since it represents a false dilemma [wikipedia.org]. As you skip past the messages looking for some meaningful discussion and swearing about the state of technical discourse, you suddenly discover two hours have passed due to the temporal-moronic radiation.
Maybe people could study training Bayesian filters to delete those messages (or just delete the authors).
iPhone a public fiasco? (Score:2)
(http://intrinsicsecurity.com/ | Last Journal: Sunday August 28 2005, @11:11AM)
Re:Tools (Score:2)
(http://www.noooxml.org/petition)
It is good to see the profile of MOAB supporters on Slashdot considering the fact that MOAB people aren't much different, they have somehow learned how to fuzz files, use gdb or use jp2 to freeze Safari on public pages.
Re:Tools (Score:2)
Re:Java exploit? (Score:1)
The odd thing about the IT industry is that the more obviously flawed an idea, the more likely corporate people will decide to base their in house applications on it. A short list - ActiveX controls in webpages, Java anywhere but a webpage, MFC applications based on Document View architecture, and a host of other technologies that are either flat out horrible or just used way outside their natural habitat. All of them are used in some internally written application in every big company I've worked for. These things never get rewritten.
Whereas good technologies that I read about like Taos, or ACE workstations with MIPS processors or the Roadrunner OS, seemed to disappear without being used by anyone.
I guess it's kind of like trolling - if you come up with a nice sensible idea, no one remembers it. One that has design quirks that encourages flamewars between it's zombie fanboys and the rest of the industry will become famous enough to be adopted. Not to take over the industry mind you, just to get used in a few terrible in house applications.
Whereas vxWorks for example, which is an elegant design implemented efficiently has virtually died out.