For those who think Macs are the most secure...

Mr_Oink

23n1th wrote: »

Why? I don't see much wrong with windows now-a-days, other than some people don't seem to be able to use it properly.

Indeed - they have a special name: "MCSE"

free4440273

Mr_Oink wrote: »

Indeed - they have a special name: "MCSE"

:rotfl::rotfl::rotfl::T

jayme1

in the modern age where almost all your data is stored on your phone this quote worries me far more than the browser exploits:

Earlier today, Charlie Miller (of Pwn2Own/Safari fame) showed me an iPhone 4 exploit that steals the victim’s address book via a rigged web site. Miller said the latest batch of patches from Apple does not fix the issue.

basically mobile phones are becoming an increasingly valuable target, one of the reasons I feel is because most people (myself, for a time, included) if their was a dodgy link use my 'no viruses written for them' mobile phone to visit a site I thought might not be 100% safe.

as we have seen from the android malware apps over the past few weeks hackers will target your phone, manufacturers need to take an active role at quickly patching exploits, although google (who make android) have demonstrated they have to ability to remotely push pathes and fix the exploits without the need for the manufacturer to be involved (very good as the manufacturers are notoriously bad at providing updates).

but apple and it's iOS platform is also becoming more of a target and whereas it's app store is locked down so it should be much harder for malware apps to be abe to infect devices, exploits such as above (and the still open never to be fixed PDF exploit in 3.1.3) have shown that the users data is available to be taken right from safari.
the fact apple know about these exploits and still havent fixed then (or refuse to in the case of the PDF exploit) at this moment in time slightly worries me.

also the fact that apple would require the device to be connected to itunes and the user download a 700MB file to patch the exploit, whereas google can push a 77KB update to patch an exploit over the air (which could be done over wifi or would cost less then 1p to the user), well I can see which is better for the end user.

basically your smart phone is the next very big important data rich target for the criminals and the phone manufacturers have to step up and quickly and efficiently patch known exploits.

23n1th

jayme1 wrote: »

...
the fact apple know about these exploits and still havent fixed then (or refuse to in the case of the PDF exploit) at this moment in time slightly worries me. ...

This is nothing new with apple, sometimes they even deny they exist.

Mr_Oink

23n1th wrote: »

This is nothing new with apple, sometimes they even deny they exist.

To be fair to Apple (much that it pains me), the PDF issue *usually* rotates around Adobe and how they 'do' PDF (Notwithstanding Foxit reader on Windows & Evince on Linux have both had vulnerabilities discovered in recent times).

That said, there were at least 175 Mac OS vulnerabilities listed by Apple in 2010 - many of which were serious flaws. Statistically it does not compare to Windows at around 170,000. However, I'm sure any system user, be it WinLinMacNix, really cares about numbers when their data is stolen.

Apples denial with issues in general is usually quite funny. I seem to recall some hardware/screen issue they tried to hush up last year - but I struggle to find the article at the moment.

My own view is this - never have a false sense of security about the system you use. Keep it up to date, keep it locked down. Just having an uncommon operating system that is thought to be secure is little to no security at all.

Chimpofdoom

hmm.. at the end of the day, no OS is 100% secure. You can continually update the security, but hackers will continually find ways around it.

The only secure computer is the one that isn't connected to the internet.

*puts on a tin foil hat*

Mr_Oink

Chimpofdoom wrote: »

hmm.. at the end of the day, no OS is 100% secure. You can continually update the security, but hackers will continually find ways around it.

The only secure computer is the one that isn't connected to the internet.

*puts on a tin foil hat*

Ha ha ha!
What about *local* users exploiting it - internet or not......

psssssssssPOP. (Sound of can of worms opening)......

Mr_Oink

Oh look - the ever secure Mac and how Apple took 8 months to fix a vulnerability.....

VSR Security Advisory
http://www.vsecurity.com/

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Advisory Name: Apple HFS+ Information Disclosure Vulnerability
Release Date: 2011-03-22
Application: Apple OS X kernel (XNU)
Versions: All versions <= xnu-1504.7.4
Severity: Medium
Author: Dan Rosenberg <drosenberg (at) vsecurity (dot) com>
Vendor Status: Patch Released [2]
CVE Candidate: CVE-2011-0180
Reference: http://www.vsecurity.com/resources/advisory/20110322-1/

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


Product Description

---

From [1]:

"Beneath the appealing, easy-to-use interface of Mac OS X is a rock-solid,
UNIX-based foundation that is engineered for stability, reliability, and
performance. The kernel environment is built on top of Mach 3.0 and provides
high-performance networking facilities and support for multiple, integrated
file systems."


Vulnerability Overview

---

On June 30th, VSR identified a vulnerability in HFS+, a filesystem implemented
in the OS X XNU kernel. HFS+ is the default filesystem in use on many
installations of the Mac OS X operating system. By exploiting this
vulnerability, an unprivileged user with local access to a machine using HFS+
may be able to read raw filesystem data, bypassing file permissions and
resulting in information disclosure.


Vulnerability Details

---

Users may interact with the filesystem using the standard ioctl interface.
HFS+ features an ioctl called F_READBOOTSTRAP that allows unprivileged users to
read raw data from an HFS+ filesystem. The ioctl intends to ensure that this
data is restricted to the first 1024 bytes, where bootstrap information is
stored. However, due to an integer overflow in the code that attempts to
enforce this restriction, it is possible for an unprivileged user to use this
ioctl to read large portions of filesystem data outside of this byte range,
leading to an information disclosure vulnerability.

The vulnerable check reads as follows, in bsd/hfs/hfs_readwrite.c:

if (user_bootstrapp->fbt_offset + user_bootstrapp->fbt_length > 1024)
return EINVAL;

If a user provides values for the fbt_offset and fbt_length members such that
their sum overflows and wraps around to an integer less than 1024, portions of
filesystem data outside the intended range will be read and returned to the
user.


Proof-of-Concept Exploit

---

VSR has developed a proof-of-concept exploit [3] to both demonstrate the
severity of this issue as well as allow users and administrators to verify the
existence of the vulnerability. The exploit leverages the integer overflow to
read arbitrary amounts of filesystem data at a negative offset from the end of
the filesystem.


Versions Affected

---

Testing was performed on Darwin Kernel Version 10.4.0, xnu-1504.7.4~1, but
review of older source code suggests that all versions of OS X may be affected.


Vendor Response

---

The following timeline details Apple's response to the reported issue:

2010-07-01 Apple was provided a draft advisory
2010-07-02 Apple acknowledges receipt of advisory
2010-07-22 Request for confirmation of issue
2010-07-25 Apple confirms issue under investigation
2010-09-02 Request for status update
2010-09-02 Apple confirms fix is being tested
2010-10-13 Request for status update
2010-10-14 Apple confirms fix is planned for undetermined date
2010-11-16 Request for status update
2010-11-16 Apple confirms ship date is set for early 2011
2011-01-18 Request for status update
2011-01-18 Apple confirms ship date for early April
2011-03-21 Apple publishes fix

Apple's advisory may be obtained at:
http://support.apple.com/kb/HT4581

prosaver

:rotfl:

Hammyman wrote: »

A warning to those who buy Macs on the basis that they're more secure....it was the first to fall at pwn2own and this was AFTER Apple had released two patches to fix 60 vulnerabilites on the day of the contest to make sure it wouldn't fall first, if at all.

http://www.zdnet.com/blog/security/safarimacbook-first-to-fall-at-pwn2own-2011/8358

Safari/MacBook first to fall at Pwn2Own 2011

VANCOUVER — A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple’s Safari browser to win this year’s Pwn2Own hacker challenge.

VUPEN co-founder Chaouki Bekrar lured a target MacBook to a specially rigged website and successfully launched a calculator on the compromised machine.

The hijacked machine was running a fully patched version of Mac OS X (64-bit).

In an interview with ZDNet, Bekrar said the vulnerability exists in WebKit, the open-source browser rendering engine. A three-man team of researchers spent about two weeks to find the vulnerability (using fuzzers) and writing a reliable exploit.

VUPEN won a $15,000 cash prize and an Apple MacBook Air 13″ running Mac OS X Snow Leopard.


Bekrar said the Safari exploit was “somewhat difficult” because of the lack of documentation regarding 64-bit Mac OS X exploitation. ”We had to do everything from scratch. We had to create a debugging tool, create the shellcode and create the ROP (return oriented programming) technique,” he explained.

“The main difficulty was doing this on our own, without the help of any documentation,” he said.

He said the creation of a reliable exploit was “much more difficult” than finding the vulnerability.

“There are many WebKit vulnerabilities. You can run a fuzzer and get lots of good results. But it’s much more difficult to exploit it on x64 and to make your exploit very reliable,” he said.

Bekrar’s winning exploit did not even crash the browser after exploitation. Within five seconds of surfing to the rigged site, he successfully launched the calculator app and wrote a file on the disk without crashing the browser.

The exploit bypassed ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention), two key anti-exploit mitigations built into Mac OS X.

“The victim visits a web page, he gets owned. No other interaction is needed.”

is that what you do all day :rotfl:
well done
apple a international company and you know more ..
yeah ..fool

debitcardmayhem

prosaver wrote: »

:rotfl:
is that what you do all day :rotfl:
what a a.r.se
apple a international company and you know more ..
yeah ..fool

Your avatar reminds me of the guy in that film, what was it ?
Oh I remember now Friday Night Fever:rotfl: