Month Of Apple Bugs: January 2007

[TheBobcat]

-TheBobcat

Who has said OSX is completely impervious?

I never said anyone said such things in such terms, but you have to admit that through Apple's advertising slogans such as "114,000 Viruses? Not on a Mac." while true, are basically suggesting that the reason for this is solely OSX's superior security systems ie. the graphic they show with it of the Finder Icon as a padlock. The slogan isn't "Compute the way relativly few others do, and stay out of the sights of hackers."

This leads to the conundrum of, how do you push these valid selling points, while not acting smug. I do not know how to solve this, but I think that directly attacking PC's such as the Get a Mac campaign is the wrong direction to go in as far as viruses go.

I believe its the smugness of the Mac Fan's and even Apple itself that have really inspired many to find as many bugs and hacks as they can and reveal them to the public.

Does OSX have superior security and is inherently more secure than Windows? Yeah, definitely.

Is Apple and many of its Mac Users smug about the lack of viruses? Yes.

Is that the reason for the recent myriad of people trying to expose all different kinds of hacks on OSX and the Mac hardware? I think so.

 

[SeaFox]

So if it happens to Microsoft its all fine and dandy. But oh no, someone wants to do it to Apple. The end is near!

That's right. It's sort of like having a stiff limb or back. It bothers you at first, but after awhile you get used to it and soon you don't even feel the pain anymore. It's considered normal. So is the pain of Windows "security".

If the guy is just out to get attention with false reports then shoot him down. If he is documenting legitimate issues and Apple has been ignoring them then Apple has been failing you the customer by ignoring these issues.

In case you missed the point of this "Month of Apple Bugs" they are supposed to include all previously unknown exploits in the MacOS. Maybe Apple has knowledge about them from their own research, but this guy has certainly not submitted the info to Apple previous to this. They haven't had an opportunity to ignore them after his timely notification.

This is going to be an exercise in PR, and how fast Apple can patch the bugs once they're made public. The "researcher's" goal is to illustrate that Apple is no more secure than any other OS by showing a bunch of bugs in it. It's somewhat of a false dichotomy, the question isn't "is this OS secure or not?" where the common knowledge is "Windows is not because of all these bugs and OSX is because it is free of venerabilities." The question is really "Is this OS more secure than Windows". The answer will depend on the severity of the bugs shown and how many Apple is able to patch.

Apple has already won part of the battle because even if a new venerability is shown every day that will still be a better track record than Windows has.

If Apple wants to play with the big boys then it should expect to get the same treatment...

So when is the "Month of Windows Bugs"? Oh, wait. There wont be one! Because that's not newsworthy.

Apple was doing so good for so long partly because it was more fun to attack 95% of the market. Now Apple is some what of a media darling, getting good publicity and is riding a wave of good profits.

As a result, it is now cool/fun/desirable to find bugs and try and release viruses for its platforms. Even though some of the "bugs" are very obscure and nigh on impossible to really work out in the wild.

I would argue that it is not significantly more desirable to "get" an OSX machine now than it was one year ago. The hot commodity right now is Vista venerabilities. Remember that the hackers are in it for profits, and since over 90% of computers are Wintels that means the most bang for the buck is still starting bot-nets of Redmond's best.

I'm not saying that I think the guy is a god for doing this, and anyone who does this I will always doubt their real motivation, but sometimes people need to do this to get companies to take action and fix real problems. Best thing for Apple is to suck it up, patch what is legit, debunk the rest and hope the security experts side with them.

Part of me is actually looking forward to this, because I think Apple does sit on security issues. I want to see Apple bust out the midnight oil and patch these as soon as they come out every day. I want this month to blow by and this guy to be left with nothing to show for it but making OSX more secure. I know that's what he claims he's doing but this task seems pretty daunting and looks to be more likely a Microsoft-thought up FUD campaign.

-TheBobcat
Who has said OSX is completely impervious?

Artie McStrawman, of course.

 

[gerardrj]

Bugs != Vulnerabilities

BUGS != VULNERABILITIES

A bug means the code does not operate in manner that you'd expect and is perhaps documented.

When you click on a button in the GUI and the expected action does not occur, that is a bug. There is no associated security risk with that bug.
Mac OS X and the associated Apps have lots of bugs. I could name 30 right now but it doesn't get me, Apple or you anywhere. Apple knows about them and they'll be fixed in due time.

Just in the way of example:
In the Mac OS X Server Admin application, when looking at a server's log files, there is a "filter" window that acts much like the search function in iTunes or Mail. However, when you enter text in the search field all log entries disappear. This is a bug. It has zero security risk. I've informed Apple of it. I'm slightly annoyed they didn't fix it in the last patch of that App, but I'll live.

 

[AidenShaw]

BUGS != VULNERABILITIES

Please reread the main post, where it says:

...the Month of Apple Bugs will be January 2007, where each day will feature a previously undocumented security hole in Apple's OS X operating system or in Apple applications that run on top of it​

So, apparently they'll be ignoring crappy coding - and concentrating on the issues that are in fact VULNERABILITIES.

 

[SeaFox]

BUGS != VULNERABILITIES

A bug means the code does not operate in manner that you'd expect and is perhaps documented.

I think we all know that when there is discussion of a "Month of Apple Bugs" the idea is to trot out venerabilities, or do you seriously think this guy is going to reveal that a certain setting in System Preferences does not retain its value between restarts?

"Bugs" is the term used for venerabilities in the media all the time. Kinda like how people in this thread keep calling the Black Hats "hackers". A hacker does not break into computer systems or do malicious stuff. They are more academically curious and rig devices to perform functions they were not normally designed to do. The term that should be used is "cracker" as any Slashdotter would tell you.

 

[SeaFox]

Please reread the main post, where it says:

...the Month of Apple Bugs will be January 2007, where each day will feature a previously undocumented security hole in Apple's OS X operating system or in Apple applications that run on top of it​

I missed the "or in Apple applications" part. I guess we'll be seeing a lot of Safari and iTunes-based exploits. This just in: Connecting your computer to a global unregulated network might be hazardous to your privacy and computer's health!

I wonder what this says about our security researcher? I'm sure he came up with his month's worth of bugs before announcing it, could he not find enough exploits in just the Mac OS to cover his little reign of terror?

 

[ifjake]

bring it.



I'm actually curious to know if Apple isn't preemptively turning up the security with Leopard or not. Let's head this thing off at the pass.

 

[patrick0brien]

I never said anyone said such things in such terms,

-TheBobcat

Well sure you did, look at the quote. Please be cautious of blanket statements, I'm hopeful you don't want to be guilty of a similar thing you are railing against.

Look, I'm not trying to be confrontational, but as you say, the facts are facts. I see nothing in Apple's advertising that is actually smug - it's people's interpretation of it. Also, I'm beginning to see that there is a misunderstanding of the definition of 'smug' itself.

Now, we could argue the conclusion Apple is attempting to draw, but then, we'd be arguing opinion wouldn't we.

If Apple's fans are smug, well then, we can't help that. But then, Apple fans don't have a monopoly on smugness.

Additionally, there is indeed a grain of truth to the 'Security through Obscurity" term, but a small one.

It is stated fact that OS X is designed from the ground up with strong security in mind - it is based on a foundation of intent to be attached to a network with long uptimes.

Windows grew into the network - ergo the security issues it has today.

This attempt by 'hackers' is a sign that Apple is getting their attention. It will be telling to see Apple's behavior as a result.

 

[e12a]

Although I like Apple,

IMO, if you're going to advertise that Macs are virtually virus free (some people associate this with security), go ahead and let him do it. See how many he finds.

If he finds 30, that's OK. Apple will patch them up.
What about Window's gazillion that are being fixed on a weekly basis.

 

[karlfranz]

I am so sick of f@#ktards like this guy and all his ilk. I guess I dream of a utopian society where these imbecils, whether they claim their activities are for "good" or "evil", would redirect their focus toward more beneficial purposes.

It's idiots like these that ruin it for everybody and also the reason why (after almost 20 years) I'm no longer interested in developing software applications for a living.

I remember a day when one could write program to serve a particular goal and that was it. Nowadays 95% of the effort spent in writing an application is devoted to plugging up security holes to prevent these cretins from taking advantage of technology for their nefarious goals. They've taken all the fun out of it for me and countless others who simply refuse to develop software anymore because of the liabilities involved. I didn't spend 5 years studying computer engineering to learn the intricacies of computer security (for which I have absolutely no interest).

Sometimes I wish they would enact laws that would criminalize those involved in hacking, spyware, spamming, phishing, and writing viruses.

BTW: All this crap is the main reason that I abandoned the Windows platform and went back to the Mac OS (after a 15 year absence). Now these idiots are starting to play more on our hallowed turf. Can't we just throw them all in a pit and set them ablaze?

-

 

[gnasher729]

That was ONE of the MoKB vulnerabilities that ended up being a little less extreme than at first thought. However, there were 9 others, and a couple of them also had arbitrary code execution in their description.

"Arbitrary code execution in their description" doesn't mean arbitrary code execution is actually possible.

What happens usually is that first someone finds out how to crash a program or some component of an operating system. That alone is obviously a reason to fix the problem; programs are not supposed to crash. At that point, the developer fixing the problem will in some cases see that arbitrary code execution is obviously impossible. In other cases he can either write that arbitrary code execution _may_ be possible, or he will have to investigate further. But nobody pays him to investigate further, and it would be better for everyone concerned if he goes on to the next problem!

So "possible execution of arbitrary code" usually just means that the developer did not waste his time to check how severe a problem was that he just fixed.

 

[Hak]

Question of credibility

I don't really thing that such action is anything else than attracting the media attention to some bunch of incompetent security researchers!!

Why do i say that? Well i am sorry but this 'LMH' is just a big lier, who only knows spreading fuds around mac security for his own benefit.

I mean saying that you found a security bug in a software is rather easy to do, prove that your claim is correct is another story. And this is where 'LMH' is incompetent, or maybe i could also say a lier.

Remember the 'Months of kernel bug'. 'LMH' came very exited (to the point where he was near to make a hole in his pan) to the media to say them he found a security bug in OS X that could trigger a remote attack. This security bug was related to disk images, and 'LMH' made the statement that a corrupted disk image could trigger a remote attack , a memory corruption, or whatever else an attacker could do remotely.

The point is that the only thing that 'LMH' discovered was that a disk image corrupted in a certain way could kernel panic OS X and from this, he conluded that triggering a kernel panic equals to a security bug. However he did not bother to verify wether indeed such bug could really trigger a remote attack.

Being so incompetent or just a lier, someone else bothered to check wether or not this bug was really a security bug or just a bug that the only thing that it can do to the user is crashing his/her computer.

Alastair did go through a detailed analysis of the bug described by 'LMH' and concluded this:

"

So, what have we learned:

- It is not a memory overwrite bug.

- It is not exploitable, except in that you can kernel panic a machine if you can persuade a user to double-click a damaged dmg file.

- It is not, therefore, possible to use this bug for privilege elevation or to execute arbitrary code in the kernel.

"

I would really advise all of you to read the analysis of the bug:

http://alastairs-place.net/2006/11/dmg-vulnerability/#more

The other disk image bug described by 'LMH' is also explained

http://alastairs-place.net/

So now why should i/we believe anything coming fron this guy? Because this is the problem, how can we believe so-called security researchers when they lie to us for their own benefit?

And the other problem is that a lot of them get so exited because they found a bug in OS X (media love such guys) to the point where they do not bother any more to check if what they discovered is really what they think it is.

In the case of 'LMH', its a lie, that's how i call it. Saying that he discovered a security bug when he did not even check wether it was really the case or not, is a lie.

In conclusion, what is the credibility of this guy for this 'Months of Apple bugs'? I would be glad that some people wish to improve the security of a given software. But it is really the aim here, or is it just fud, .......plain fud? This guy already lied, why won't he do it again?

So for me what he says now is just a plain media attraction procedure (manipulated by a third party or not), in other words ....... ********!!!!

When Alastair wrote his article to explian the disk image bug and to prove that what 'LMH' said was wrong, i submitted the news related to the Alastair4 article to macrumors but it did not get publised. What i want to say is that people believe easily wrong information but which sounds exiting. When it comes to say the truth, well that's another story, its a much more difficult task to spread it.

How many web sites covered the disk image bug described by 'LMH'? Plenty of them!!!!

How many of them did cover the Alastair' article which says the TRUTH?
Well, you could count them in your fingers!!!!!

 

[USMaC]

I don't see why Apple would really be against this. It will hopefully find ways they can improve their already stellar OS. It's like when you are writing an English paper and give it to a peer to evaluate. They proof read, find mistakes, give suggestions, and your paper better because of it.

But normally your peer would give the paper back to you with the suggestions before pointing out the flaws to your professor.

 

[puuukeey]

maybe if you don't want this, you shouldn't get some emo kid to spit at pc users. or maybe its the current political strategy: alienate your foes, solidify your base

Trust a mac
Viruses
http://www.apple.com/getamac/viruses.html

 

[longofest]

Story Updated

Update: IDG/MacWorld provides additional information.

Apple enthusiasts and security researchers have been at odds since last August, when David Maynor and Jon Ellch claimed to have discovered a flaw that affected Apple’s wireless device drivers. They played a video at the Black Hat conference demonstrating how this flaw could be used to run unauthorized code on a MacBook. However, their claims have been slammed because the demonstration used a third-party wireless card rather than the one that ships with the MacBook, and because the two hackers still have not published the code used in their attack.

LMH said the Apple community’s negative response to Maynor and Ellch’s claims played a role in the decision to launch the Month of Apple bugs.

“I was shocked with the reaction of some so-called ‘Apple fans,’” he said. “I can’t understand why some people react badly to disclosure of issues in their system of choice. … That helps to improve its security."

However, Apple doesn't seem to mind the effort. An Apple spokesman simply replied "We always welcome feedback on how to improve security on the Mac."

 

[CrazyWingman]

How many viruses have YOU had?

I hope I can get this posted before everyone writes off this thread as a useless flamewar.

I have a question for everyone, though: How many viruses have you had on your personal machine?

I ask because since I first connected to the internet many years ago (mid-late 90's), I have *never* had a virus installed on my machine. I once downloaded a Doom WAD that my virus scan caught when I unzipped. The only ad/spyware I've ever had installed on my machine was Kazaa, but since that was only on my Windows partition, my normally-booted Debian was still fine.

I spent four years at college with my machine always on, always connected, always with some open services (ssh, apache, samba, occasional ftp), at a static IP on a class A network. Never once did that machine get infected.

Sure, I had a friend (didn't we all?) who left an insecure service open, and had it hacked by some script kiddie. I've even seen the awful reboot-Windows-NT-30-seconds-after-it-boots bug swarm a network. But none of this has ever happened to my machine.

So, the point of my question is to find the cause of all the hand-wringing here. Have all of your machines really had viruses on them? Are you just worried that there will be a virus so nasty one day that you won't be able to avoid it? Are you just worried for the n00bs who will wrongly accuse their computer of being vulnerable, rather than their security practices?

Don't get me wrong. I'm not saying my machine is invulnerable. And, I'm not saying that there aren't other people who are at a much higher risk of being attacked. I'm just suggesting that for the common, reasonably well-informed user most of these bugs won't matter at all.

 

[mkrishnan]

No, CW, I agree with you... I haven't really negatively been impacted by a virus on a personal computer since I had my Amiga. I did run across a couple of Windows viruses in the Win95 era that were caught by virus checker. And I've been affected at the corporate level (e.g. Outlook blackouts). And I've had to use adware infested shared Windows PCs before. But that's about it. Viruses are more of a non-issue for me on my Mac than elsewhere, but still a non-issue....

 

[matti503]

I hope there will be a Month of Vista Bugs too. If not, this seems a little biased.

In my opinion, Apple should fix bugs faster, or they'll end up like MS in 2002. MS is still healing from the bad publicity they got, 'cause their OS was like a fishnet.

At least nobody gets junkmail 'cause of OS X. I get 30 viagra ads in week and they all seem to come from people that exist.

 

[bilbo--baggins]

Anyone willing to make Apple aware of genuine security risks is very welcome as far as I'm concerned. If it's just anti-Apple propoganda then I think they would need to do a lot more than highlight the odd obscure security risk to even begin to scratch at OS X's gleaming record.

 

[puuukeey]

CW: Are you just worried that there will be a virus so nasty one day that you won't be able to avoid it?

exactly. I back up. but my one laptop is my work, play, hobby, social life, teacher, entertainer, library, stereo, and a musical instrument

I spend an awful lot of time *creating* (not just surfing) on my laptop. upwards of 12 hrs a day. so losing just one week can set me back eons. losing my art would be like losing a child. (ok maybe a step child)

 

[Hak]

Hypocrisy

“I was shocked with the reaction of some so-called ‘Apple fans,’” he said. “I can’t understand why some people react badly to disclosure of issues in their system of choice. … That helps to improve its security."

What a hypocrite!!!!

He is himself not professional by spreading fud about mac security. David Maynor and Jon Ellch NEVER NERVER proved that the security issue that they showed could work on a mac system with a built-in wifi card. Like them, 'LMH' NEVER NEVER proved that the disk image bug could trigger a remote attack. And so now he has some pity for Maynor and Jon Ellch NEVER and he feels that he needs to spread more fuds or what?

Why people should believe someting which is not proved or verified? This is the question, why people should believe unverified statements? Neither him nor Maynor and Jon Ellch NEVER provided any evidence that the security issues they were talking about were true or not. And now he comes to say us that somehow that's fine just believe the fud that we say. In which planet does this make any sense?

So i should believe now from this guy who does not even have the courage to give his real name that anyone saying something against a bunch of unprofessional security "researchers" are mac fans, right? So someone comes up with a security issue related to the mac, people ask him/her to prove it, and the only thing that he/she says is that no!!!!! guys you are just mac fans!!!! Why bother to make properly my job, you are just mac fans? Right?

Miserable

 

[macnews]

CW - people buy macs because of the lack of virus and spyware. Notice I said lack, not abscense. And yes, I have been affected at work by virus and spyware systems. I run a lab of computers and in the late 90's early 2000's it was difficult to keep the system's patched and free of all the crap that slowed them down.

As to the month of bugs guys - I seriously question there "reporting" abilities. There are some VERY serious security bugs for OSX BUT most require physical access to the machine. The majority of the time, this isn't mentioned or is about as noticable as small legal print in an advertisment.

Do I have a problem with these guys finding security issues? No.

Do I have a problem just releasing it to the public? Yes, but there is an interesting point about how companies react to this type of stuff. MS used to be much worse about responding to security issues and some accuse Apple of the same now. So I can somewhat see the point but...

Do I trust these guys? No, they are not a professional security research firm, nor have they acted in a professional manner in the past. To not release what they did/how they did it goes completely against the "we are just trying to help" mantra they keep repeating. Plus, they also don't fully disclose until pressured - i.e. using a 3rd party wireless card. Yes, some may use it but truly not an issue for 99.99% of mac users thus mitigating the seriousness of their claim but the failure to mention hurts their credibility.

Do I think they will find a bug a day? Possible. But I think it will be a case of mixed half truths. I'm betting over 90% will require local access to the machine and/or use third party apps be they software or hardware.

Either way, you can bet the media and CNet will have a field day announcing how Mac OSX isn't "quite secure as some people might think" (watch for that direct quote). I know I will have to spend at least an hour on the phone with my Dad who just bought a new 20" Imac because he was sick of virus and spyware on his 2 year old windows machine, which had replaced a 1 year old windows machine - now that is longevity

 

[eightball0]

A lot of the responses here make me embarrassed to be a Mac user. The fact is that publishing security bugs makes us all safer and keeping them secret puts us all at risk.

Recently, hacking has become a for-profit sport. For-profit hackers dig around for security bugs and keep them to themselves so they can exploit them for profit. (How can they profit? Let's say a CEO uses a particular application on his laptop. Knowledge of security bugs in that application provides a for-profit hacker with a vector for corporate espionage).

Publicising hacks puts for-profit hackers on notice: they can't use those security bugs secretly. It also puts corporate IT shops on notice: if an application has security bugs, they can remove it from vulnerable places (such as the CEO's laptop). It lets us decide if we want to put ourselves at risk.

Don't be naive: whether or not security bugs are publicised, they still exist, and for-profit hackers still know about them.

Apple has been inadequately responsive to security bugs. Here's a report from Secunia showing that Apple has 10% unpatched security advisories. Many of these bugs are in the Mach kernel--and the source code is available, so for-profit hackers certainly have the opportunity to skim through the code and find these bugs.

Remember that there are fewer hackers looking at OS X than at other operating systems. The true number of security bugs is likely far higher--especially since Apple does not have as large a security team as Microsoft and other vendors. Worse, they have not developed a secure code checkin process as Microsoft has developed for its operating system.

Publicising these bugs will only help Apple improve their products. They need to show the same commitment to security that Microsoft has shown (often unsuccessfully, but they are moving in the right direction).

It's only a matter of time before the viruses on Windows make their way to OS X. Apple has been coasting on luck. Hopefully, Leopard is a step in the right direction, but I'm not hopeful. Microsoft finally fixed Windows security in Vista, adding many UNIX-style security features that will dramatically reduce the problems users face. It would be a shame if a drop in Windows security bugs coincided with an increase in bugs by Apple.

 

[eightball0]

I can't find any links to this right now, but I do recall reading security researchers on the Internet complaining that Apple is very slow to patch bugs that they submit to Apple. (You could argue that since I'm not providing a link that I'm making this up, but hopefully you trust me.)

Releasing bugs publicly may be the best way to light a fire under Apple's derriere. This worked for Microsoft--after complaining for years that it was unfair and dangerous for security researchers to disclose bugs before Microsoft fixed them, they finally increased the number of people working on Windows security.

I hope Apple responds in the same way.

 

[MacinDoc]

A lot of the responses here make me embarrassed to be a Mac user. The fact is that publishing security bugs makes us all safer and keeping them secret puts us all at risk.

Reporting them to Apple immediately on discovery would make us all safer. Waiting weeks or months to release them, and then releasing them to the public before releasing them to Apple (and in a month-long publicity stunt to boot) puts us all at increased risk. How long has this hacker been sitting on this information? Months? That's given potential crackers months to work on exploits, and Apple can't start working on fixes until the bugs are reported. Make no mistake, the way this is being done, it's not for the benefit of Apple or Mac users.

Publicising these bugs will only help Apple improve their products. They need to show the same commitment to security that Microsoft has shown (often unsuccessfully, but they are moving in the right direction).

If Apple shows the same commitment to security as Microsoft, then we are all in trouble. I hope that Apple's commitment to security will be much better than Microsoft's has been to date.

Microsoft finally fixed Windows security in Vista, adding many UNIX-style security features that will dramatically reduce the problems users face.

That remains to be seen. Why do you think Microsoft released Vista to corporate clients first, with everyone else waiting for 2 months to get it? Corporate clients can be trusted to report bugs to Microsoft, instead of publishing them for all to see. This gives Microsoft an opportunity to fix the bugs before they can be exploited, and avoids the media circus created by sensationalization of the bugs. But until the public release of Vista, its supposed increase in security remains unproven.

Remember that there are fewer hackers looking at OS X than at other operating systems.

Based on what evidence? It seems that hackers looking for bugs in OS X have been media darlings of late. Finding a vulnerability of OS X seems to be the best way to get publicity and make a name for yourself.

Anyway, even if OS X only had 3% of all crackers trying to exploit its vulnerabilities, shouldn't it have 3% of all viruses? On last count, how many OS X viruses were there in the wild? And how many Windows viruses?