OS X Lion Raises Bar on Security, But Battery Firmware Vulnerability Surfaces

[munkery]

I don't really see this as anything major...

You need to be SU... that would first require social engineering (easy), but I was always under the impression that if you wanted to do battery firmware modifications you would have to do it on-location, not remote.

Anyone knowledgeable care to elaborate?

Apparently, this can be done remotely if the attacker achieves system level access.

Social engineering is easy if the target is unknowledgeable about safe computing practices but at least users can defend themselves from social engineering attacks if the user takes the time to learn some basic safe computing practices.

Malware that relies on little or no social engineering can not be defended against using safe computing practices even if the user has the knowledge.

 

[Hyper-X]

Windows sandboxing system is not as good as that in OS X and Linux. Chrome's sandbox in Windows is based on Windows sandbox system.

That doesn't mean that it is impossible. But, browser exploits haven't occurred in OS X in the wild prior to Safari being sandboxed because OS X offers less vectors to make malware profitable once past the browser.

As I stated earlier, many users currently use Sandboxie which appears to offer similar if not superior sandboxing capabilities as OSX Lion.

It is not relevant.

If a browser is going to fall to an exploit, whether it takes 5 or 30 seconds makes no difference. From what I remember, IE fell just as quickly. Both exploits were referred to being fairly immediate.

Both Safari (2 researchers 3 weeks) and IE (1 researcher 6 weeks) took six weeks in working hours to find and write the exploit. This is what is important because it determines the cost to the hacker in developing the exploit.

You can take your pick, whether it's been proven that the previous version of Safari's security was broken in 5 seconds or whether you want to talk about current events involving the lastest versions of Safari and IE(9), your point remains irrelevant because you're not comparing apples to apples. You can't fairly compare the latest release of Safari to IE8 which your links refer to. The exploits that occurred in IE8 is no longer possible under IE9 which has been out for quite some time and has proven to be the most effective browser against malware (until Safari proves otherwise).

Safari pre-Lion was no contest against IE9, the current version of Safari has yet to prove itself superior to IE9's latest offerings and AFAIK, pwn2own contests have not tested either browser. There's been no solid independent testing of the lastest Safari and no comparisons (head to head) have been made against IE9.

Software firewalls are ineffective against malware that corrupts processes in memory.

http://www.symantec.com/connect/articles/software-firewalls-made-straw-part-1-2

I didn't mention just software firewalls, most users have both hardware and software firewalls in place, many products out there already screen for malware that may affect memory but there hasn't been any significant threat that put Windows 7 at risk in that sense.

Bypassing anti-virus software is not that difficult.

http://www.exploit-db.com/download_pdf/17066

Discretionary access control (DAC = permissions) is easily bypassed in Windows 7 and this has been done in the wild (see #1 in the link).

That PDF is very old, I'd like to see more recent tests to support its effectiveness today. FWIW I haven't seen a single virus outbreak that went out of control that affected Windows 7 machines due to processes getting corrupted in memory. The closest thing I can come up with is tld-4 affecting an alleged 4+ million machines but it specifically targets the MBR and most enterprise-level systems don't use MBR configurations, in fact I haven't managed anything but GPT disks since Windows 2000. Even tld-4 has been patched for x64 systems by Microsoft and I'm still wondering how they got the numbers regarding infection and where the demographics pointed to. Many Windows users panicked and rushed to Kaspersky or Bitdefender's sites to download the TLD4 scan tool and showed up negative. We manage over 100,000 machines worldwide and none of the machines, not a single one, was affected by TLD-4, to include some hosts that weren't configured with GPT volumes and still on traditional MBR.

DAC is not easily circumvented in Windows 7, at least not by most users and I challenge you to define the term "easy", even Apple engineers have acknowledged how rock-solid Windows 7 is in that specific regard. While it's not entirely perfect, I've yet to see any situation that puts any user at risk of DAC related attacks. Link #1 (I'm assuming it's the one pointing to Symantec) is again a post from back in November 2010. Symantec has not been the leader nor authority on concise and accurate source of security risks and holes for a very long time.

Here, I'll put the ball in your court to explain to me or at least show me step by step what set of circumstances must occur for anyone to alter user permissions or permissions in general from the WAN. I'm willing to bet those circumstances have to be very specific and would have to involve specific user action (tricked) into granting elevated access in order to alter those permissions. On a managed system that's a non-issue since users don't have the ability raise their privileges, tricked or deliberate.

So again, my question is the overall risk involving not just the severity but the probability of it being out there to affect users. I'm not asking you specifically about this question, rather it's just out there just to say. I'm certain there's a viral disease out there that could possibly kill me in a day or so which points to a rather severe, catastrophic situation, but the probability of me encountering it is negligible. So the overall risk factoring both accounts would put the risk level at a very low status.

 

[munkery]

As I stated earlier, many users currently use Sandboxie which appears to offer similar if not superior sandboxing capabilities as OSX Lion.

The easiest way to defeat a sandbox is to use a privilege escalation exploit (bypass DAC) that can be leveraged from within the sandbox.

Sandboxie functions by limiting some but not all of the functions of win32k. Some functions have to be left in place or apps will not function.

http://vallejo.cc/?p=48#more-48

Various vulnerabilities exist to exploit win32k.

https://forums.macrumors.com/posts/13013889/ -> see #1 in the list in this link

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+

The exploits that occurred in IE8 is no longer possible under IE9 which has been out for quite some time and has proven to be the most effective browser against malware

IE 9 is affected by public and unpatched zero days.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2011/20110402

http://www.computerworld.com/s/arti...ers_exploit_Windows_7_and_IE9_says_researcher -> DLL hijacking has be known for 10 years and it still hasn't been fixed.

I didn't mention just software firewalls, most users have both hardware and software firewalls in place, many products out there already screen for malware that may affect memory but there hasn't been any significant threat that put Windows 7 at risk.

What type of firewall do you think is in a hardware firewall? Magic?

Hardware firewalls typically use a packet filter and NAT. The benefit of this is that it is stateful. But, all of this does nothing to prevent browser exploits.

Specialized hardware firewall appliances add an applicataion-layer firewall to those other features. Again, there are limits to that functionality.

http://www.symantec.com/connect/articles/software-firewalls-made-straw-part-1-2

Specialized hardware firewall appliances weren't really effective at preventing the Sony breach. Supposedly, the breach bypassed two of them.

That PDF is very old, I'd like to see more recent tests to support its effectiveness today.

http://funoverip.net/2011/04/100pc-...th-metasploit-browser-exploits-from-ms11-003/

DAC is not easily circumvented in Windows 7, at least not by most users. While it's not entirely perfect, I've yet to see any situation that puts any user at risk of DAC related attacks.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+ -> list of incidences of kernel mode driver vulnerabilities.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

 

[Hyper-X]

IE 9 is affected by public and unpatched zero days.

"This client-side vulnerability could allow an attacker to gain the ability to execute arbitrary code in the context of the current application. If the application is run as Administrator, the attacker may gain complete control of the target system."

The above mentions nothing significant, nothing specific. According to Vupen "if the applications are run as Administrator" states nothing but the obvious. It would be no different if it were to say "if apps were run as Root, the attacker may gain complete control..."

Again from the outside how is this supposed to happen? Under IE9 malware has the probability (you keep missing this important factor) of nearly none. You seem to suggest that IE9 has security as transparent as glass and that any threat that could affect Windows 7 is going to walk right through.

Vupen is known for making a lot of unsubstantiated claims about exploit vulnerabilities but doesn't disclose any specifics. Vupen has been wrong in the past regarding risk levels and such regarding their claims, until I see specific situations as to how this can occur to a typical user, I don't see this as any significant risk to anyone.

http://www.computerworld.com/s/arti...ers_exploit_Windows_7_and_IE9_says_researcher -> DLL hijacking has be known for 10 years and it still hasn't been fixed.

Insignificant. That has never happened in Windows 7 to where it matches the level of threat they claim. How many instances have this occurred out in the wild? How many Windows 7 machines are being affected by this? Anyone can find a flaw and claim how serious a problem it is however again, what's the probability of this occurring?

What type of firewall do you think is in a hardware firewall? Magic?

If you want to take this to a rude level, don't get upset with what I'm about to say. Pure software firewalls work differently from hard coded firmware, if you're saying Zonealarm is the same as Sonicwall then I guess it must be magic. The way how a pure software firewall interacts with data is very different from hardware firewalls, in the latter arbitrary access is very difficult if not impossible unless a user is able to gain write access to the router's firmware. A software firewall is more likely to be affected by outside influences as it requires a stable machine (equipment) and operating system in order for it to function correctly. Magic by your assessment.

Hardware firewalls typically use a packet filter and NAT. The benefit of this is that it is stateful. But, all of this does nothing to prevent browser exploits.

They can have NAT features especially on some home products but not all must have NAT features. NAT isn't the result of having a firewall, it's the result of having a router. Good firewalls incorporate rules much like how browsers incorporate basic risk controls to ensure the user doesn't put themselves in a bad situation. None of our machines will allow users to go to any booby trapped site and that's all managed at the firewall. That alone mitigates a lot of risks to any browser exploit.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

Again you seem to miss the question, how is a user supposed to put themselves in a position for this to happen? I can see how this can happen if you're sitting at the computer you intend on attacking and have clear access to the machine however this isn't the case in reality.

Explain how is this to occur, say for example my Windows 7 machine, I don't see how you're going to circumvent my system's UAC and alter the registry settings without me knowing. What am I supposed to do? Download some unknown app, visit an obviously booby trapped site so it can try and load something regardless of my browser and firewalls telling me that it's an untrusted site (assuming it even allows me to go to that site), etc. I don't see how any of what's posted above is going to have any affect on my machine unless I do something completely foolish. What am I supposed to do, click on the popup that says "Your machine is infected with 10 bazillion viruses, click here for a free scan. -THEBESTANTIVIRUS2011" ?

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.


http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+ -> list of incidences of kernel mode driver vulnerabilities.

Most of that is insignificant, while it may be an issue on the surface, most users won't be in any shape or form to be at risk of any exploitation regarding the Windows 7 kernel. Most of what's in that PDF was fixed back in Feb 2011 which leads me to believe that PDF was made very early in the year or created in 2010 then posted early in 2011, your choice.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

Irrelevant. Corporate systems are on GPT volumes if you read my prior post, tdl4 is overstated, its risk completely exaggerated. The issue with x64 systems was patched, patched systems are in no further danger of tdl4.

Systems affected by tld4 are easily remedied. Removal software are readily available on Kaspersky's site or you can download 32/64 bit version from BitDefender's site. Download, install, run, Windows Update, done. How bad is this threat? I have a file on my flash drive which has a copy of the tdl4 rootkit, after patch it's unable to do anything significant on any x64 system. Claims of how AV software being unable to detect are grossly inaccurate. MSE 2.1 found it, Kaspersky Ent 2011 detected it, AVG found it, don't know what else to say about it.

 

[Mr. Gates]

The idea of male-ware being stored on the battery to infect over and over again even if the OS is wiped and re-installed ...

That's the scary genius part

 

[Hyper-X]

The idea of male-ware being stored on the battery to infect over and over again even if the OS is wiped and re-installed ...

That's the scary genius part

Technically this isn't new. This can happen to any machine not just limited to Macs. I think this is just another one of those stories that might appear to have more substance as an internet post than it is a real-world risk to many people. Similar issues have been brought up regarding BIOS-ROM infections which could wreck havoc on many machines... "if" the right set of conditions are met.

I'm willing to bet that the "right set of conditions" aren't something easy to create for it to be something significant enough for people to start worrying about this stuff. Batteries have been around for a very long time with firmware and there hasn't been any history of any significant threat towards users.

 

[johanf]

Warning for OS X Lion!

With OS X Lion, Apple has unfortunately dropped Rosetta.
Your PowerPC applications will no longer be able to run.
With OS X Snow Leopard, such applications would run seamlessly.

Suddenly, some very expensive equipment you may own to your Mac, will become useless.

Example of such things are the Eye-one color calibrator, older scanners etc.

This is a really bad move of Apple and it will upset many professional users when they suddenly find out.

Apple - we don't want to put our expensive stuff in landfills. Please consider, for the protection of our common environment and economy, to fix Rosetta.

 

[franswa za]

battery, WHAT battery?

batting??

can't find the big one in my mac pro

only a small dime? sized one.......

it refuses to be formatted...

 

[JAT]

With OS X Lion, Apple has unfortunately dropped Rosetta.

What does that have to do with battery exploits?

 

[Sackvillenb]

"What am I supposed to do, click on the popup that says "Your machine is infected with 10 bazillion viruses, click here for a free scan. -THEBESTANTIVIRUS2011" ?"

That is hilarious.

 

[munkery]

Insignificant. That has never happened in Windows 7 to where it matches the level of threat they claim.

And that makes it ok?

If you want to take this to a rude level, don't get upset with what I'm about to say.

Sure corporate firewalls also include elements similar to AV software and intrusion detection systems. Those "rule" are not perfect. There is only so much that can be limited to the browser. For example, it is hard to defend from attacks that exploit the renderer.

http://bits.blogs.nytimes.com/2011/06/22/security-professionals-say-network-breaches-are-rampant/

http://www.sans.edu/research/security-laboratory/article/top-firewall-leaks -> #5 is the most interesting

Also, most users sitting at home are not behind a corporate firewall.

Explain how is this to occur, say for example my Windows 7 machine, I don't see how you're going to circumvent my system's UAC and alter the registry settings without me knowing.

Exploit browser to spawn a shell in the background that downloads and executes the UAC bypass exploit.

Again from the outside how is this supposed to happen?

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2011/20110402

 

[diamond.g]

And that makes it ok?



Sure corporate firewalls also include elements similar to AV software and intrusion detection systems. Those "rule" are not perfect. There is only so much that can be limited to the browser. For example, it is hard to defend from attacks that exploit the renderer.

http://bits.blogs.nytimes.com/2011/06/22/security-professionals-say-network-breaches-are-rampant/

http://www.sans.edu/research/security-laboratory/article/top-firewall-leaks -> #5 is the most interesting

Also, most users sitting at home are not being a corporate firewall.



Exploit browser to spawn a shell in the background that downloads and executes the UAC bypass exploit.



http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2011/20110402

Maybe I am not following, but wouldn't you have to be running IE9 as an admin in order for UAC to be bypassed? The default context for IE9 isn't admin, right?

 

[munkery]

Maybe I am not following, but wouldn't you have to be running IE9 as an admin in order for UAC to be bypassed? The default context for IE9 isn't admin, right?

Nope. Browser exploit to get user level access and then local privilege escalation (UAC bypass) to get system level access.

There are some direct remote roots that affect current Windows systems if running a web server.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100811

 

[Hyper-X]

And that makes it ok?

What I'm trying to say and have been trying to say that all of what you've said in this regard is being exaggerated and overstated. You're saying it as if it's happening all the time, right now, even to my machines, out in the common and its not.

Sure there may be a rogue disease a penguin in Antartica might have that might kill me in a few hours but where is this penguin to me, to other people, what's the probability of me encountering it, what kind of circumstances have to occur before this becomes a serious risk, etc.

As security professionals we can't simply prioritize every single thing people discover not just limited to operating system security holes and vulnerabilities. You need to pick and choose through priorities which ones are of the highest risks and you accomplish that through a proper risk assessment process, none of what you've stated fits in that category. It just seems to me that all you're after is to discredit Windows and advertise how wonderful OSX is. I understand what you're saying about how a 0day can end the world and such but that's not how you prioritize fixes. Severity of risks also include probability and the resulting risk level is what determines how severe the problem really is.

Sure corporate firewalls also include elements similar to AV software and intrusion detection systems. Those "rule" are not perfect. There is only so much that can be limited to the browser. For example, it is hard to defend from attacks that exploit the renderer.

No firewall is perfect, but that's stating the obvious, show me anything that is. Not sure what you're referring to about rules, rules can be very specific, can deal with anything above the physical layer. Each PDU whether it's a frame or packet can be controlled by those rules.

http://bits.blogs.nytimes.com/2011/06/22/security-professionals-say-network-breaches-are-rampant/

Old news. If this is news to you, then this pretty much ends the conversation on this subject. That article doesn't state what's actually happening. "Hacking" is a very broad term, if you're familiar with any basic information assurance training, it states that the single, largest security risk to your systems/network are users... specifically those with authorized access.

http://www.sans.edu/research/security-laboratory/article/top-firewall-leaks -> #5 is the most interesting

Actually it's not interesting. On corporate systems the structure in which AV is implemented is very different, the AV services are deployed from a remote server, data going in and out from firewalls often pass through a isolated environment having to go through very tough heuristic scanning. Even then most modern threats are without a predefined signature, it's been that way since Windows 2000 over 11 years ago.

Most modern managed systems do employ client-side software but it's very rare that it's needed. Nearly all of the threats are dealt with from a remote location before any compromised data is passed on to hosts on the network. We manage as a company over several hundreds of thousands of machines globally, and we've have yet to find a single circumstance which supports your claims. If it was that serious of an issue, we would've seen it at least once by now.

Many current "threats" (I can't call them viruses because nothing to my knowledge falls into the specific definition of a virus that has affected Windows 7 yet) don't work on Windows 7. Worms, trojans, the only ones I've seen as any potential hazard are ones that require user intervention. Have you heard of a worm or trojan outbreaks for Windows 7? I thought not. It may exist but not in any significant amount to stop the train and work on a countermeasure.

Also, most users sitting at home are not behind a corporate firewall.

Also nobody lives within a perfectly sanitary environment, within a radiation shield, eating the best nutritional foods. The main difference a corporate firewall has over a consumer-grade product is the features and options given to the administrator(s) with speed and reliability being secondary and tertiary. Also many corporate firewalls are standalone products, whereas consumer grade stuff are an all-in-one solution.

Exploit browser to spawn a shell in the background that downloads and executes the UAC bypass exploit.

You still haven't answered my question, what set of conditions must be met in order for this to happen? I have no issue subjecting any of my PC laptops for exploitation, I'd like to see this in action because I simply can't see how this happens. I can see how it can happen but that's very different from how this could affect me, if any, through typical use of my machines. Here I'll make it easy for you.

What do I need to do, give you my I.P. address so you can find my machine in the first place so you can exploit the browser?

Do I sit in front of my machine while this exploit randomly happens without my intervention?

Do I need to visit a boobytrapped website?

Do I need to be "tricked' into clicking on something I shouldn't be in order for this to work?

Does my machine need to be setup any differently in order for the exploit to occur?

Am I supposed to download and install something via IRC or any P2P client for this to occur?

 

[AidenShaw]

Sure there may be a rogue disease a penguin in Antartica might have that might kill me in a few hours but where is this penguin to me, to other people, what's the probability of me encountering it, what kind of circumstances have to occur before this becomes a serious risk, etc.

Very good post - "danger" is related to both the seriousness of a threat ("it will kill you tout suite) and the risk (probability) of encountering the threat.

My two favorite pastimes are skiing and scuba diving. Both involve a low probability of encountering quickly fatal situations. Training and skill have protected me from any consequences.

Two of my best dives ever involved dropping over the side of the boat into schools of hammerhead sharks. Fantastic experience - but very low probability of something bad happening.

 

[Hyper-X]

Very good post - "danger" is related to both the seriousness of a threat ("it will kill you tout suite) and the risk (probability) of encountering the threat.

My two favorite pastimes are skiing and scuba diving. Both involve a low probability of encountering quickly fatal situations. Training and skill have protected me from any consequences.

Two of my best dives ever involved dropping over the side of the boat into schools of hammerhead sharks. Fantastic experience - but very low probability of something bad happening.

Excellent analogy. Just severity in itself doesn't make it dangerous. For example a hammer, a cup of coffee can be considered critical/severe. Then you'd have to look at the probability of it affecting you in reality, and if you must, develop and implement controls to mitigate that risk to an acceptable level.

Risk: Starbucks Coffee
Severity: Catastrophic
Probability: Frequent
Initial Risk Level: Very High

Controls: No drinks allowed near work area, limit to break room only, drinks must be in closed containers with lids/caps.

Resulting Risk Level After Controls Implemented: Low to Insignificant.

 

[chrono1081]

*LTD*, you mad?

Wow, that was unnecessary . Too many people bash LTD because he likes Apple yet no one cares about the countless Apple haters on this forum making unjustified troll statements. (I wont name names to prevent me from getting in trouble but I can name at least 5 that are always posting drivel).

For Apple's sake and the sake of the product, shout outs for the person behind finding and talking about this severe security hole. How could have Apple missed this? Then again, OS X is now incredibly secure, mistakes happen.


But this needs to be addressed ASAP, or I know I'd honestly never buy an Apple laptop with this vulnerability - that's ofcourse to say, I wouldn't spend my well earned money on any other laptop if it's not a Mac, but with an issue like this, I would hold off until this is alleviated.

You do know this probably doesn't just affect Apple right? Not to mention the article states the hackers would first need to learn the password, then learn how to use the firmware, then develop an attack.

Here is a comparison of OS X to Windows:

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Much of the ability to turn these vulnerabilities into exploits is due to the insecurity of the Windows registry. Also, more easily being able to link remote exploits to local privilege escalation exploits in Windows is due to the Windows registry.

Mac OS X does not use an exposed monolithic structure, such as the Windows registry, to store system settings. Also, exposed configuration files in OS X do not exert as much influence over associated processes as the registry does in Windows.

Mac OS X Snow Leopard has contained only 2 elevation of privilege vulnerabilities since it was released; obviously, neither of these were used in malware.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+ -> list of incidences of kernel mode driver vulnerabilities.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

2) Windows has the potential to have full ASLR but most software does not fully implement the feature. Most software in Windows has some DLLs (dynamic link libraries = Windows equivalent to dyld) which are not randomized.

http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf -> article overviewing the issues with ASLR and DEP implementation in Windows.

Also, methods have been found to bypass ASLR in Windows 7.

http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf -> article describing bypassing ASLR in Windows 7.

Mac OS X has full ASLR implemented on par with Linux. This includes ASLR with position independent executables (PIE). DLLs in Windows have to be pre-mapped at fixed addresses to avoid conflicts so full PIE is not possible with ASLR in Windows.

3) Mac OS X Lion has DEP on stack and heap for both 64-bit and 32-bit processes. Third party software that is 32-bit may lack this feature until recompiled in Xcode 4 within Lion. Not much software for OS X is still 32-bit.

But, not all software in Windows uses DEP; this includes 64-bit software. See article linked in #2.

4) Mac OS X implements canaries using ProPolice, the same mitigation used in Linux. ProPolice is considered the most thorough implementation of canaries. It is known to be much more effective than the similar system used in Windows.

http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf -> article comparing ProPolice to stack canary implementation in Windows.

5) Application sandboxing and mandatory access controls (MAC) in OS X are the same thing. More specifically, applications are sandboxed in OS X via MAC. Mac OS X uses the TrustedBSD MAC framework, which is a derivative of MAC from SE-Linux. This system is mandatory because it does not rely on inherited permissions. Both mandatorily exposed services (mDNSresponder, netbios...) and many client-side apps (Safari, Preview, TextEdit…) are sandboxed in Lion.

Windows does not have MAC. The system that provides sandboxing in Windows, called mandatory integrity controls (MIC), does not function like MAC because it is not actually mandatory. MIC functions based on inherited permissions so it is essentially an extension of DAC (see #1). If UAC is set with less restrictions or disabled in Windows, then MIC has less restrictions or is disabled.

http://www.exploit-db.com/download_pdf/16031 -> article about Mac sandbox.

http://msdn.microsoft.com/en-us/library/bb648648(v=VS.85).aspx -> MS documentation about MIC.

https://media.blackhat.com/bh-eu-11/Tom_Keetch/BlackHat_EU_2011_Keetch_Sandboxes-Slides.pdf -> researchers have found the MIC in IE is not a security boundary.

6) In relation to DAC and interprocess sandboxing in OS X in comparison with some functionality of MIC in Windows 7 (see #5), the XNU kernel used in OS X has always had more secure interprocess communication (IPC) since the initial release of OS X.

Mac OS X, via being based on Mach and BSD (UNIX foundation), facilitates IPC using mach messages secured using port rights that implement a measure of access controls on that communication. These access controls applied to IPC make it more difficult to migrate injected code from one process to another.

Adding difficulty to transporting injected code across processes reduces the likelihood of linking remote exploits to local exploits to achieve system level access.

As of OS X Lion, the XPC service has also been added to implement MAC (see #5) on IPC in OS X. (http://developer.apple.com/library/...stemStartup/Chapters/CreatingXPCServices.html)

7) Windows has far more public and/or unpatched vulnerabilities than OS X.

http://www.vupen.com/english/zerodays/ -> list of public 0days.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker -> another list of public 0days.

http://m.prnewswire.com/news-releas...-vulnerability-in-microsoft-os-110606584.html -> article about 18 year old UAC bypass vulnerability.

8) Password handling in OS X is much more secure than Windows.

The default account created in Windows does not require a password. The protected storage API in Windows incorporates the users password into the encryption key for items located in protected storage. If no password is set, then the encryption algorithm used is not as strong. Also, no access controls are applied to items within protected storage.

In Mac OS X, the system prompts the user to define a password at setup. This password is incorporated into the encryption keys for items stored in keychain. Access controls are implemented for items within keychain.

Also, Mac OS X uses a salted SHA1 hash, which is still considered cryptographically secure. It is more robust than the MD4 NTLMv2 hash used in Windows 7.

http://www.windowsecurity.com/articles/How-Cracked-Windows-Password-Part1.html -> article about Windows password hashing.

Omg that post deserves a Pullitzer! Very informative!

 

[AidenShaw]

Omg that post deserves a Pullitzer! Very informative!

"Pullitzer" because it should be pulled from the forum for cheer-leading, sensationalism and detachment from reality?

Or did you mean Pulitzer - the award for journalism?

I hardly think that it qualifies for the latter....

 

[chrono1081]

"Pullitzer" because it should be pulled from the forum for cheer-leading, sensationalism and detachment from reality?

Or did you mean Pulitzer - the award for journalism?

I hardly think that it qualifies for the latter....

No I meant Pulitzer (corrected my spelling) because its very informative, not sensationalized in the least because it not only offers up facts, but backs them up as well, and because the poster took plenty of time out of his day to provide the rest of us with such a thorough run down of security between Mac and PC.

 

[MattInOz]

Excellent analogy. Just severity in itself doesn't make it dangerous. For example a hammer, a cup of coffee can be considered critical/severe. Then you'd have to look at the probability of it affecting you in reality, and if you must, develop and implement controls to mitigate that risk to an acceptable level.

Risk: Starbucks Coffee
Severity: Catastrophic
Probability: Frequent
Initial Risk Level: Very High

Controls: No drinks allowed near work area, limit to break room only, drinks must be in closed containers with lids/caps.

Resulting Risk Level: Low to Insignificant.

Your controls are not enforceable in practice without paying dedicated office police. Even then could you ban drinks being served in meetings or would you ban the laptop, either is just going cause a venue change.

A social exploit can serve you better.
Like having a stand for valuable equipment and a good keyboard.
Most people like the screen to sit higher if they are using a laptop replacement at their desk so will naturally put it on the stand. Or making sure equipment under the desk is towards the back (most desks slope to the front).

Using ceramic mugs or glass cups with a heavy base, nicer drinking experience and harder to knock over. Plus it's seen as one of those feel good eco measures.

And in all situations have an Admin Account on all computers and have admin privileges disable in main users.

You can't murder the risk it never works. I mean swimming with a school of recently killed Hammerhead sharks isn't going to be that much fun an might just have unforeseen other risks.

So really it's situation normal, be alert keep up with sensible good practice.

 

[AidenShaw]

it's still sensationalist

No I meant Pulitzer (corrected my spelling) because its very informative, not sensationalized in the least because it not only offers up facts, but backs them up as well, and because the poster took plenty of time out of his day to provide the rest of us with such a thorough run down of security between Mac and PC.

Go re-read the sub-thread about the battery security issue.

That's a case of an Apple security problem with potentially serious to catastrophic consequences (as in fire and explosion).

The discussion in that thread, however, is "not a big risk, because several levels of security have to be breached before the exploit can be executed".

That critical examination is missing when people discuss Munkery's criticism of Windows potential exploits. There are a lot of "if this, then this, then this, then a problem" without considering the issues behind the "if"s. Apple fans want to believe bad reports about Windows, and sometimes logic is left behind.

Back to the earlier analogy - being attacked by a hammerhead shark is a very serious, probably fatal experience. However, a couple of my best scuba dives started with back-flipping off the side of an inflatable Zodiac into the middle of schools of hammerheads. Munkery sensationalizes the severity of the consequences, but ignores or minimalizes the mitigating factors that make the actual risk from the vulnerability quite small. (As in, a single hungry hammerhead is more dangerous than a school of several hundred hammerheads.)

 

[munkery]

Actually it's not interesting. *On corporate systems the structure in which AV is implemented is very different, the AV services are deployed from a remote server, data going in and out from firewalls often pass through a isolated environment having to go through very tough heuristic scanning.*

http://www.sans.edu/research/security-laboratory/article/top-firewall-leaks -> Sans Institute - this is about corporate firewalls

http://funoverip.net/2011/04/100pc-...th-metasploit-browser-exploits-from-ms11-003/

We manage as a company over several hundreds of thousands of machines globally.

http://bits.blogs.nytimes.com/2011/06/22/security-professionals-say-network-breaches-are-rampant/

Have you heard of a worm or trojan outbreaks for Windows 7?

Stuxnet, TDL-4, .......

http://www.computerworld.com/s/article/9216654/Windows_7_s_malware_infection_rate_climbs_XP_s_falls

Do I sit in front of my machine while this exploit randomly happens without my intervention?

This is possible in Windows 7 if running a web server.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100811

Do I need to visit a boobytrapped website?

If you're a security researcher, then you know a maliciously crafted website is required for a browser exploit.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2011/20110402

 

[cmaier]

Go re-read the sub-thread about the battery security issue.

That's a case of an Apple security problem with potentially serious to catastrophic consequences (as in fire and explosion).

The discussion in that thread, however, is "not a big risk, because several levels of security have to be breached before the exploit can be executed".

That critical examination is missing when people discuss Munkery's criticism of Windows potential exploits. There are a lot of "if this, then this, then this, then a problem" without considering the issues behind the "if"s. Apple fans want to believe bad reports about Windows, and sometimes logic is left behind.

Back to the earlier analogy - being attacked by a hammerhead shark is a very serious, probably fatal experience. However, a couple of my best scuba dives started with back-flipping off the side of an inflatable Zodiac into the middle of schools of hammerheads. Munkery sensationalizes the severity of the consequences, but ignores or minimalizes the mitigating factors that make the actual risk from the vulnerability quite small. (As in, a single hungry hammerhead is more dangerous than a school of several hundred hammerheads.)

I think this is an unfair characterization. There were lots of posts on the thread that read something like "how exactly is Lion security better than Windows. It seems they only just caught up to what Windows already does."

Munkery gave some detailed information about how the mechanisms being discussed are actually superior (or at least arguably so) than in Windows.

To now say "well, that's nice, but in practical terms it makes no difference" is all well and good, but Munkery was reacting to an earlier meme.

 

[AidenShaw]

I think this is an unfair characterization. There were lots of posts on the thread that read something like "how exactly is Lion security better than Windows. It seems they only just caught up to what Windows already does."

Munkery gave some detailed information about how the mechanisms being discussed are actually superior (or at least arguably so) than in Windows.

To now say "well, that's nice, but in practical terms it makes no difference" is all well and good, but Munkery was reacting to an earlier meme.

Let me fix this:

but Munkery was over-reacting to an earlier meme​

As we've hit upon in the last few posts, the severity of an exploit is mitigated by the likelihood that one will run across the exploit. Munkery focussed on the former, and ignored the latter.

 

[cmaier]

Let me fix this:

but Munkery was over-reacting to an earlier meme​

As we've hit upon in the last few posts, the severity of an exploit is mitigated by the likelihood that one will run across the exploit. Munkery focussed on the former, and ignored the latter.

From what I saw he mainly just posted details of types of attacks that relate to the particular types of protections we were talking about (address randomization, sandboxing, etc.), and didn't really comment at all on whether or not such attacks were likely in the wild. But whatever.