Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

'Huge' Number of Mac Apps Open to Hijacking From Sparkle Updater Vulnerability

KALLT said:
@engram: This does not work if you have applications in sub-folders. Use this one instead, it also prints the Sparkle version (credit to an Ars commenter):
Code: 
find /Applications/ -path '*Sparkle.framework*/Info.plist' -exec echo {} \; -exec grep -A1 CFBundleShortVersionString '{}' \; | grep -v CFBundleShortVersionString

Anything below version 1.13.1 is potentially affected.


Edit:

Apparently, this one is even better, because it shows which applications actually connect via HTTP instead of HTTPS. This should narrow it down further:
Code: 
for i in /Applications/*/Contents/Info.plist; do defaults read "$i" SUFeedURL 2>/dev/null; done
Click to expand...
I ran that, but it just gave me a bunch of URLs. Do these URLS mean that the corresponding apps use HTTP for updating and are safe as a result?
 
so is Cyberduck...

I guess rule of thumb is not always keep apps up to date then since developer may not even know abut it yet. I go rid of uTorrent the moment they started severing up ad's in software.
 
So many... At least most of the ones I HAVE to use aren't below 1.13.1

  • A Better Finder Rename 10
  • Coda 2
  • CodeKit
  • Cyberduck
  • DaisyDisk
  • Dock Library
  • Evom
  • HandBrake
  • HipChat
  • ImageOptim
  • Kaleidoscope
  • Mailbox (Beta)
  • MAMP
  • Monotype SkyFonts
  • OpenEmu
  • Senuti
  • Sequel Pro
  • Sofortbild
  • SourceTree
  • StrongVPN Client
  • TeamViewer
  • TinyGrab
  • Transmission
  • Tunnelblick
  • UnRarX
  • Versions
  • Viscosity
  • VLC
  • Zeplin (Beta)
 
Mind that for those using these scripts that Sparkle framework might be masked (e.g. renaming Autoupdate.app inside Sparkle.framework to something else, for example in Duet display) or used in different paths than /Applications (e.g. in Library/PreferencePanes for Logitech Options, in /Library/ScriptingAdditions for XtraFinder, etc).

The good thing is that this vulnerability has only (?) recently been discovered so we should be careful from now on when checking and installing updates. Having old/abandoned/not-likely-to-suggest-updates software is not going to hurt you, you have to trust and do the fake update to get infected with something. What we need a list for apps that use Sparkle framework which update through HTTP. Nevertheless, I don't think that any application doing automatic updates in the background would/should use insecure HTTP and you would be naive to leave such an option on if it exists.
 
Last edited:
This sounds like a good 'cat & mouse' game

"Concern users should use a VPN or secured Wi-fi"

How do you know when u should if users don't know if it affects a given app if its not on the list?
 
jblagden said:
I ran that, but it just gave me a bunch of URLs. Do these URLS mean that the corresponding apps use HTTP for updating and are safe as a result?
Click to expand...
The apps that use HTTP and have not updated Sparkle are not safe. If the app uses HTTPS, it's safe.
 
jblagden said:
I ran that, but it just gave me a bunch of URLs. Do these URLS mean that the corresponding apps use HTTP for updating and are safe as a result?
Click to expand...

Those with an HTTP URL are at risk if they use the unpatched framework (which is difficult to tell, as some programs may have compiled the framework themselves). HTTPS mitigates this. The problem occurs when there is another URL within the XML/RSS feed to which this first URL links. Sparkle will attempt to load that other URL to present the patch notes and a man in the middle could potentially load something else through it if they hijack this. If the feed URL is itself on HTTPS then this will not be possible.
 
Last edited:
dannyyankou said:
*deletes uTorrent*
Click to expand...
You don't have to (permanently) delete apps, you just have to download updates to them manually from their makers website (and switch off auto-updating). If the act of updating one of the apps had already been the source of malware getting onto your computer then it is possible that the app is infected but it is equally possible that the app itself is fine and the malware placed its payload somewhere else. If you have been infected, the only save way would be to wipe your disk and restore from a backup made before this potential infection (the date of which you would have no way of knowing).

A good list would be one of app that are vulnerable and that offer auto-updating, because those are the only ones that would require immediate action.
 
Put things into perspective - this isn't going to affect many people who currently have apps that use Sparkle.

I'm not too concerned, and will still favour non AppStore over AppStore versions which in many cases have less functionality.

It's really a big song and dance: The chances of being affected by this vulnerability is very small.

This was proof of concept and I doubt anyone is ready for mass exploitation.

At most, this is a chance for fear mongering and how this is solid evidence that OSX should be locked down with MacAppStore!

Good news that the vulnerability is patched and will work its way into affected apps.
 
Last edited:
  • Like
Reactions: AdeFowler, Mr. Retrofire and Morod
pat500000 said:
OS X isn't safe no more. Another day, another victim on news. It's 187 murder on Apps....RIP apps.
(pours out little liquor on their apps.)
Click to expand...

The annoying thing is that network-related vulnerabilities always seem to be related to insecure connections and the reluctance to make the switch to HTTPS. If everyone would have just moved to HTTPS years ago, issues like these would simply not be there. It has to be said that Apple is pushing developers to do this. For instance, for iOS 9 and OS X 10.11 they introduced a new opt-out security policy that requires developers to adopt secure network connections. It turns out that this is still not enough and worse still, some big names like Google actively encouraged developers to opt out so that their own ad networks can continue to work.

It annoys me to no end that even developers of respected applications are now affected by this, purely because they did not adopt HTTPS, the vulnerability notwithstanding.
 
  • Like
Reactions: You are the One
KALLT said:
The annoying thing is that network-related vulnerabilities always seem to be related to insecure connections and the reluctance to make the switch to HTTPS. If everyone would have just moved to HTTPS years ago, issues like these would simply not be there. It has to be said that Apple is pushing developers to do this. For instance, for iOS 9 and OS X 10.11 they introduced a new opt-out security policy that requires developers to adopt secure network connections. It turns out that this is still not enough and worse still, some big names like Google actively encouraged developers to opt out so that their own ad networks can continue to work.

It annoys me to no end that even developers of respected applications are now affected by this, purely because they did not adopt HTTPS, the vulnerability notwithstanding.
Click to expand...
I agree. What I don't understand is why we need to continue to support those apps if they aren't pushing hard to go to HTTPS.
 
C DM said:
Isn't that below 1.13 and is therefore not patched?
Click to expand...

Transmission has not been updated since June 2014 (latest version is 2.84). You actually have to use the nightly builds to get decent Yosemite+ support. I looked at the “appcast” feed they are using and it seems that they are indeed on the red list: they load the patch notes through separate HTTP URLs within the feed. This is the big issue of the vulnerability.

Stella said:
This was proof of concept and I doubt anyone is ready for mass exploitation.
Click to expand...

Which is indeed a good thing. But it just goes to show that OS X does not work on fairy dust and that even Mac developers are lazy or negligent.
 
  • Like
Reactions: 997440, You are the One and Stella
jayducharme said:
I read about this earlier today. To me, this alert seemed a bit blown out of proportion. Many of the apps have already been patched, and many others don't seem to be affected. Plus (if I read it correctly), the attack involved downloading a dodgy file, clicking on a link and the attacker also needed to be on the same WiFi network as your computer.
Click to expand...

Nope. All I need to do is set up a wifi access point called "attwifi", "Google Starbucks", "TWCWiFi", etc., wait for your laptop to join it, and wait for your laptop to ask for a file that would look like any other update to one of the affected apps.
 
Stella said:
No one loves Vuze? :D
Click to expand...

You mean Azureus. ;-)

I don’t like it. It still reminds me of my Windows time (2008 and earlier) and it is even still written in Java. It comes with its very own installer, which is something I really do not like. You just never know what such a program installs once it asks for your credentials. uTorrent, which does the same thing, is known to have bundled the Spigot adware in its installer. If an application must use an installer, then it should use the one that is included with OS X.

I prefer Transmission because it is simply a very clean and lean app, does not require an installer and is completely open source.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back