Apple Adds Memory Randomization To Leopard

.mack notes a ZDNet blog outlining some of the security features added to OSX Leopard (10.5). Here's Apple's brief description of all 11 new security features. "Apple has announced plans to add code-scrambling diversity to Mac OS X Leopard, a move aimed at making the operating system more resilient to virus and worm attacks. The security technology, known as ASLR (address space layout randomization), randomly arranges the positions of key data areas to prevent malware authors from predicting target addresses. Another new feature coming in Leopard is Sandboxing (systrace), which limits an application's access to the system by enforcing access policies for system calls."

Even Windows does this

[OriginalArlen]

Even Vista has a not-completely-broken implementation of ASLR. Linux, of course, has been doing it for years [wikipedia.org]...

Re:Even Windows does this

[Just Some Guy]

From your Wikipedia link:

ASLR is enabled by default in Linux since 2.6.20

Since that release was made on 2007-02-05, you could more accurately say that "Linux, of course, has been doing it for months". OpenBSD didn't even really get a strong version of it until 3.8 [openbsd.org], and that wasn't quite 2 years ago. It sounds like Windows had problems [zdnet.com] with it as recently as February 2007, but maybe that's fixed now.

This is still fairly cutting-edge stuff. It's not like they just now implemented memory protection for the first time.

Re:Cool, but even better...

[gEvil (beta)]

My biggest questions: are there Windows programs that support these features via CalDAV, and is there a CalDAV server in FreeBSD's ports?

It looks like there are a handful of Windows apps [osafoundation.org] that support CalDAV at this time. Since it's an open standard, it shouldn't be long before more calendar apps support it. As for the server, this [wikipedia.org] is what I could find with a 10 second search. Looks promising, too.

Re:Even Windows does this

[Anonymous Coward]

This is as much in reply to 0racle as you, but from the very same ASLR article you should find a reference to PaX. (http://en.wikipedia.org/wiki/PaX)

July 2001 was the first release with ASLR.

Re:Cool, but even better...

[link915]

Currently no viable solution exists on a Windows box. There are things like Sunbird and Yagoon but they don't work well with Outlook (i.e. no real integration). Currently there is a project called Open Connector that exists to bring caldav support to Outlook. It is quickly reaching beta but the main developer needs help. I am pitching in and hope that others will as well. Check it out at http://www.openconnector.org./ [www.openconnector.org]

Also, the calendar server that is used in Leopard is nothing more than the open-source Darwin calendar server at http://trac.calendarserver.org/projects/calendarserver [calendarserver.org]

So, although nothing exists in ports that I can find you can run the Darwin calendar server on FreeBSD.

Re:Pre-Binding?

[dreamchaser]

The OS knows where it's bits and pieces are and anyone using published API's will be fine; it's rather transparent to the programmer. Where you'll run afoul is if you are trying to directly access a 'known' code entry point illicitly, without going through the proper channels via the OS. This is why it is a step that can help prevent some types of attacks.

It's still a bandaid though, just as it is in every other OS that's implemented it (pretty much everything OTHER than OS X has a form of this already).

Re:These are just bandaids

[_merlin]

Eventually? Look back at the past! IBM System/390 mainframes (and the zSeries derived from it) have all those features in hardware. Array overrun? Hardware exception. Integer overflow? Hardware exception. Touch memory you deallocated? Hardware exception. ALU produces a spurious result? System picks it up because it runs all the code on at least two cores, and the same fault is unlikely to occur in two cores simultaneously - operation is retried on two more cores to determine which of the two original cores was correct, and the failing core is taken out of service.

You know why we don't do all that in hardware in PCs? Because it requires a huge amount of silicon. Sure, it's great. You learn good programming practices, because you can't get away with slipping even a little. But it costs a lot, gets hot, and goes slow. PCs are meant to be a good enough and cheap enough solution - not necessarily the best solution.

Re:Even Windows does this

[martin-sandsmark]

It has been the default in certain distros (e. g. Gentoo Hardened) long before it was set as default in vanilla Linux. So, Linux has been doing it for years, although Linus hasn't.

Re:Cool, but even better...

[PeeweeJD]

It sounds like a high-level player finally decided to take on Exchange.

According to this article [appleinsider.com], apple corporate has switched from a third party calendaring program to iCal so those feature additions make perfect sense.

from page 3:

Even home users that have no need for group calendaring will benefit from the new server-side improvements to iCal. That's because Apple didn't just build its iCal Server to fill out a feature check list. It has also begun using it company wide as its own corporate scheduling software in place of Meeting Maker. That means Apple employees are also now using the iCal client, and the result is that iCal itself has progressed rapidly.

Re:Woo!

[bunratty]

As far as I can tell, even the Linux kernel doesn't have memory randomization. You need a patch like PaX [wikipedia.org] to get that feature.

Re:Woo!

[bzzzt]

Microsoft definitely has something going on with .NET code though. The kind of security you can get there can't be compared with anything you can do on the software or even hardware level, with pure unmanaged code.

Nice to hear those Microsoft people are about to catch up with the Java sandbox model from 1997 ;)

Re:ASLR == Windows Feature Since 3.1

[Anonymous Coward]

You be glad to read that Leopard makes connecting to network shares a threaded operation, so the spinning beachballs in finder related to this issue should be far fewer. In theory.

I've never had any problems plugging a Firewire driving into a Mac. Sure that something's not dodgy at your end?

Sandboxing != Systrace

[plsuh]

Another new feature coming in Leopard is Sandboxing (systrace), which limits an application's access to the system by enforcing access policies for system calls

Folks,

Just FYI, the sandboxing in Leopard is not systrace. Systrace is vulnerable to race conditions -- see Robert Watson's paper "Exploiting Concurrency Vulnerabilities in System Call Wrappers" [lightbluetouchpaper.org]. I asked him about this at WWDC, and he told me that Leopard's sandboxing is based on a different technology and is not vulnerable to the same attacks.

--Paul

Re:ASLR == Windows Feature Since 3.1

[sith]

Seems like you might have some issues - I plug firewire drives into Tiger systems multiple times per day and have never had a crash. And even if it did, you'd get the multi-lingual "please restart" screen - I haven't seen OSX do a black screen panic since 10.1 ...

Also, if applications are "just vanishing" on launch, you may have disabled the little popup that tells you the 'application quit, wrote a crash log, and would you like to reopen it?' ...

Re:Woo!

[ergo98]

Microsoft definitely has something going on with .NET code though. The kind of security you can get there can't be compared with anything you can do on the software or even hardware level, with pure unmanaged code.

Such as?

Exactly as you stated, all modern systems have some sandboxing and security constraints. Everything that unmanaged code wants to do -- beyond simply spinning in its own little memory box -- requires the cooperation of the OS. Want to open a network socket? Ask the OS. Want to open a file in read mode? Ask the OS. Want to put something on the screen? Ask the OS. With completely unmanaged code, there is a framework for the finest granularity of security -- .NET didn't invent that.

Which is a funny comment, really, because .NET took the potential security advantages and just tossed them all in the dumpster. Extraordinarily few .NET developers have any comprehension of the security namespaces and framework...because they don't need to -- the overwhelming majority of .NET code runs with FullTrust.

Re:ASLR == Windows Feature Since 3.1

[Kadin2048]

When mac software crashes it usually just vanishes, with no user feedback at all. When the OS crashes it blackscreens (like, say, plugging in a firewire drive into Tiger, which they *still* haven't fixed) but I wouldn't say the information it gives is useful at all.. about as useful as a bluescreen.

Huh? When most Mac apps crash it produces that "The Application [ApplicationName] has quit unexpectedly" crashlog dialog box, where it shows you a trace and you can choose to type a friendly little note in and send it away to Apple. this thing [wikipedia.org].

I don't see it that frequently but I did find a pattern of actions that would repeatedly crash Aperture the other day, and it popped that thing up every time.

Don't know whether it only comes up for Apple applications or what (I don't think so; I remember getting it a few times when Vuescan crashed). Maybe it only comes up as a result of some types of faults, and not all of the fatal ones. But it seems to work fairly well for me.

Re:Woo!

[shmlco]

"DVD Player.app won't skip past things that the movie studios put on the DVD..."

True. In order to license the codecs and software needed to play DVDs legally a DVD Player has to honor the DVD player spec, which means honoring the stupid "operation not allowed" messages embedded in the DVDs.

Re:Woo!

[kestasjk]

Were you born yesterday? Seems you know absolutely nothing about OS X.

# Tagging Downloaded Applications Protect yourself from potential threats. Any application downloaded to your Mac is tagged. Before it runs for the first time, the system asks for your consent -- telling you when it was downloaded, what application was used to download it, and, if applicable, what URL it came from.

This was introduced by Microsoft in Windows XP SP2

# Application-Based Firewall Gain more control over the built-in firewall. Specify the behavior of specific applications to either allow or block incoming connections.

You guessed it; Microsoft, SP2 (it was available in third party firewalls before then of course)

# Library Randomization Defend against attackers with no effort at all. One of the most common security breaches occurs when a hacker's code calls a known memory address to have a system function execute malicious code. Leopard frustrates this plan by relocating system libraries to one of several thousand possible randomly assigned addresses.

As the GP said, this has been in lots of OSes for a long time, including Windows Vista.

# Signed Applications Feel safe with your applications. A digital signature on an application verifies its identity and ensures its integrity. All applications shipped with Leopard are signed by Apple, and third-party software developers can also sign their applications.

Again, Microsoft, SP2.

I'm guessing "Well, good ideas should be shared around and used by all kinds of companies", and I agree; but why does it apply to Microsoft security and other internal OS technologies, and workspaces, etc, and not stuff Apple makes?

Re:Woo!

[datapharmer]

Any application downloaded to your Mac is tagged. Before it runs for the first time, the system asks for your consent

Safari asks. Most modern browsers have security settings that can do this.

Application-Based Firewall

It is called Little Snitch. It works great.

The most common security breaches occurs when a hacker's code calls a known memory address to have a system function execute malicious code.

Nice feature, but if you were really concerned with security you would have memory encryption enabled anyhow. No problems with this when using encrypted memory.

A digital signature on an application verifies its identity and ensures its integrity.

Public Key signing anyone? This has been around for decades - even on OSX!

These are not things that weren't available on OSX. They weren't gaping holes. Apple just decided to make them easier for the average user by including them out of the box and beefing them up a bit where necessary (like the memory randomization).

Re:Woo!

[Holmwood]

Memory randomization, no, that was new as of Vista as parent suggests. And I'm amazed it took everyone that long, especially Microsoft whose OS's were absolutely being hammered by Malware.

File system snapshotting?

With the genius that Microsoft shows for marketing, they called the feature "Volume Shadow Copy". Steve Jobs foolishly called it "Time Machine". Everyone knows you want to label interesting features with unwieldy acronyms.

(that's sarcasm). http://en.wikipedia.org/wiki/Shadow_Copy [wikipedia.org] And yes, it's available on Win 2K and Windows XP (as of circa 2003), but wasn't included by default until Windows XP SP2.

So parent is right about memory randomization and wrong about filesystem snapshotting. 1/2. Is parent serious, I dryly ask.

Speaking as a BSD/Ubuntu/Win XP (that last for games, and certain legacy apps) fan -- in roughly that order -- Leopard will be the easiest to install, configure and use BSD going. And that's pretty tempting.

I just wish Apple permitted ordinary users to virtualize OS X on whatever hardware they wanted.

-Holmwood.

Re:Woo!

[naasking]

Microsoft definitely has something going on with .NET code though. The kind of security you can get there can't be compared with anything you can do on the software or even hardware level, with pure unmanaged code.

Of course, both of these statements are wrong. Lisp machines had finer grained authority management, as did earlier capability hardware (tagging down to the word level); we're talking technology from the 70s and 80s here which can surpass the capabilities of new millennium technology.

Typed Assembly Languages are "unmanaged code", ie. raw assembly, but are accompanied with a proof certificate proving various properties of the assembly code, including memory safety and beyond. This is more recent work under the banner of "proof carrying code". This counts as a software technique which is superior to .NET's managed code. Heck, .NET's managed code can't even express strongly typed function pointers, and must resort to ad-hoc delegate techniques in the VM (despite many researchers suggesting MS add them way back in the early design stages of .NET).

I like .NET to a certain extent, and I like Microsoft's Singularity project, but .NET is far from the true cutting edge in safety [blogspot.com]. Unfortunately, Java is no better off, and functional languages are only marginally better when it comes to security.

Re:Woo!

[shelterpaw]

Easy enough to write an applescript to bypass that, which I've done. It's ugly, but it works and you can add it to your dvd applescript menu:

tell application "DVD Player"
activate
set viewer full screen to true
try -- use try to bypass the FBI warning, menu's etc.
play dvd
set title to 1
set chapter to 1
end try
(* The following will wait for DVD's that refuse to bypass the intro's and jump to the beggining. Annoying!*)<br>
delay [3]
if title is not equal to 1 then
repeat until active dvd menu is equal to main
go to main menu
delay [15]
end repeat
go return to dvd
end if
(* The following will be used for odd dvd's like Questar Documentarys's they don't start with the standard title, they start with title 2 or something different. *)
delay [30]
set oddTitle to 2
-- check to see if we're still on the main menu page
if dvd menu active is equal to true then
repeat until dvd menu active is equal to false
set title to oddTitle
set oddTitle to oddTitle + 1
end repeat
end if
end tell

Re:Woo!

[Anonymous Coward]

I'm not so sure it is a kernel-level feature. You could implement stack randomization in the CRT's "_start" routine. You could implement heap randomization in the libc's "malloc". You can randomize addresses of statically allocated data in the dynamic linker, ld.so. None of these parts are in the kernel.

In my opinion it's better to keep this out of the kernel, even. It's better not to over complicate it.

Note that some software breaks when you introduce randomized memory addresses (two examples off the top of my head: clisp, gcc's precompiled headers). If you implement the changes in userland rather than in the kernel, you can still run this software by linking to a different set of routines. (This is done in OpenBSD's port of clisp, for example.)

Re:Woo!

[petermgreen]

you can't have a shadowed volume on XP, you can access them (including previous versions) from it but you can't have them on it. The volumes must be hosted on server 2003 or above.

Re:Woo!

[Anonymous Coward]

I'm frustrated enough with the subtle restrictions in iTunes & iPod

Mind telling us what those restrictions are? So far as I can tell, iTunes has no restrictions unless you choose to buy restricted (DRMed) content. My solution is to not buy DRMed content...

After one too many inappropriate trailers on DVD's that my family was unable to skip, DVD app is no longer in use.

You have the MPAA to thank for that, not Apple. Any company which wishes to create a DVD player (or DVD player app for a computer) through the normal, fully legal route has to sign up to enforce all the restrictions the MPAA wants to shove down your throat... one of which is that the player must honor disabling of navigation controls by the DVD. (That is, DVD authors can selectively disable navigation controls for specific content on the DVD.) The reason for this was originally just to force you to watch the copyright warning when you stick the disc in, but it's now also being used to force you to watch trailers. Once again, blame the MPAA (and content producers who abuse the feature) for this, not Apple: if Apple didn't go along, they wouldn't get a license for any of the IP involved in playing back a DVD, a CSS decryption key, and so forth.

You may have found other apps which play DVDs and do not enforce these restrictions. I am reasonably certain that all of these apps are not properly licensed, and are built on the technique of using the known methods for attacking CSS encryption. For obvious reasons, a big corporation like Apple is not going to do anything legally questionable like that.

By the way, something you may be interested in: in the past people have written patchers for DVD Player.app to hack it so navigation controls are always enabled. I have no idea whether they're still being updated for current versions.