News, info, and opinion by Mac users, for Mac users.

October 3, 2006

security

Exploit does not put the “X” in “Mac OS X”

Posted Oct. 3, ’06, 8:00 AM PT by Dan Moren
Category | Security

Not so pwnedI’m not sure I even understand why this was a story. It’s merely yet another set-piece in the continuing production of “Macs are not Invulnerable” (music by Andrew Lloyd Webber). The headline, “Exploit released for Mac OS X flaw,” is not inaccurate, but it does commit the sin of omission, though it’s quickly rectified in the first paragraph:

The code takes advantage of a weakness in core parts of Mac OS X and could let a person with limited privileges gain full system access. Apple provided a fix for the error-handling mechanism of the kernel last week, but the exploit appears to have been authored before then. [Emphasis added]
The researcher who was credited by Apple for discovering the flaw says that the exploit was apparently written before the problem was patched, though it didn’t appear until this past weekend.

I’ve braced myself for the call of trumpets heralding the latest act of this full-cast song and dance extravaganza, and while I’m hoping against hope that every major news organization will not pick this up by the end of the week, I’m ready with my “break-in case-of-emergency hot air defense kit.”

Let’s count the ways this exploit is nothing to worry about:

1. The user must be logged in (locally or remotely) for it to function. Assuming you have good firewall security, strong passwords, and trust your family members and/or co-workers, the risk is pretty minimal.
2. The exploit, as it was released, did nothing more than prove that it had gained access to the root account, what’s termed as “privilege escalation.” Worrying? Yes; privilege escalation should always be a source for concern, but in this case, it’s heavily mitigated by #1.
3. Oh yeah, Apple has a patch available.

Look, the usual boilerplate applies: no operating system is completely invulnerable. One should always practice safe computing (strong passwords, don’t open unknown attachments, patch regularly). But as for this latest “exploit,” there’s no need to get your kernel in a twist.


3 Comments

Walt French said:

Well, full disclosure works both ways. Plain and simply, one can translate the exploit into the following warning: once a user logs in to your machine -- in a computing workgroup or remotely -- he can take over the machine and do whatever he chooses. The vulnerability applies to those with OSX versions prior to 10.4 -- there's a bunch of 'em out there -- and to those who haven't applied the latest patches -- probably, fewer.

Attachments have not much of anything to do with this, although that advice is of course good.

October 3, 2006 10:41 AM
Grady said:

"nothing more than prove that it had gained access to the root account"

uhhhhh... that's pretty much the most one can possibly do.

October 3, 2006 7:31 PM
eieioblr said:

This exploit has been used on shared hosting mac os x servers, where hackers have ssh limited accounts.

They got root access on those servers.

But that's not the only 0-day tool used actually...

October 4, 2006 1:51 AM

Leave a comment

 



Visit other IDG sites: