RSSMac OS X Exploit Emerges After Patch
By Ed Oswald | Published October 3, 2006, 1:01 PM
Exploit code for a patched flaw in the Mac OS X operating system was discovered over the weekend, which allows an attacker to gain full system access through flaws in the core of the operating system. Apple provided a fix for the issue in a security update issued last week.
Researchers with Matasano Security, who are credited with discovering the flaw, said the malicious code appeared to be a zero-day exploit and may have been available on the Internet before Apple released its patch. Tuesday's news also highlights attackers' increasing focus on Mac OS X.
Whereas in the past, attacks have primarily been focused on Microsoft Windows, the increasing popularity of Apple has caused some hackers to re-focus their attention. Moreover, the Cupertino company's boasts that its operating system is "virus-free" may give cybercriminals extra impetus to attempt to hack Macs.
It should be noted that, on its own, the Mac OS X exploit does nothing malicious, only showing the attacker that they can gain the necessary user rights. Once the attacker has those rights, he or she can perform any action they want.
At the most risk are those with computers containing multiple user accounts, or those who use remote access features, Matasano said. Additionally, a user must be logged into their computer in order for an attacker to take advantage of the flaw.
Serves Apple right for being so...
"I am a Mac, I am unhackable and have no viruses"
Straight morons for that Ad campaign.
NOTE to Apple SE's: Don't fuc with hackers, you will lose in the end.
Score: 0
|...
The PC Rat hates to see anyone's computer attacked.
But Mac Snobs have been so smug about exploits
targeting Windows machines that it would seem the
elitists are getting their comeuppance !
As for "the increasing popularity of Apple", last that
your favorite rodent heard the Mac is still at around
3% (or less) of all desktop PC's. Apple's "increasing
popularity" is the iPod, and they're rapidly becoming
a ~music~ company rather than a computer company.
...
The Computer Rodent
...
Score: 0
|And supposedly I don't know what I'm talking about. I've been saying "Whereas in the past, attacks have primarily been focused on Microsoft Windows, the increasing popularity of Apple has caused some hackers to re-focus their attention. Moreover, the Cupertino company's boasts that its operating system is "virus-free" may give cybercriminals extra impetus to attempt to hack Macs." in my own way for a long time.
I agree with jbaltz69's statement; all Operating Systems are capable of being hacked, whether the hacker has physical access, or has to do it by remote.
A little lesson I learned early on in my career is, a computer only does what the user tells it to. Any program could be considered a virus, because the very definition of a virus describes how all programs act anyways.
Are they not all scripts, written by humans?
Some of them have different purposes, but in the end, the operating system is the mind of the computer, the processor is the brain of the computer, but neither could exist without each other.
Score: 0
|At least M$'s patches actually patch holes in their OS. Apple has to patch the patch before they can patch the (alleged) hole that may or may not exist in their OS :-) LMAO
That's what happens when you claim that Macs are virus free and have the most secure OS. You get people who never bothered hacking Macs suddenly getting the urge to hack an “unhackable OS” ;-)
Score: 0
|Dude.. even microsoft has had to patch patches. Don't say stuff like that, then you sound as silly as MacFans.
Score: 0
|Agreed.
Score: 0
|Some hack.
It requires that the attacker be logged into the machine. "IMPACT - Unprivileged attackers with local access can obtain root credentials."
The typical home user simply is not vulnerable whatsoever to this type of attack - they don't typically use remote access and most users would have root already - it is their computer after all. If an attacker already has access to your machine (which is what is required for the privilege escalation) you are screwed no matter what.
I don't think that OSX is bulletproof, no OS is. But this is not really news at all. Especially since it has already been patched.
The only newsworthy threat in the last year has been the WiFi hack.
Everyone needs to quit crying wolf when it comes to OSX exploits. I know all you windows users want the mac fanboys to experience your pain, but this isn't it. And if we keep crying wolf no one will react when there is a real threat.
Score: 0
|The article said "a user must be logged in" not "the attacker must be logged in" nor "the attacker must have local access".
The "crying wolf" reference implies there is no wolf, when clearly their is...I think you are just debating how big and bad the wolf is. However, many blind Mac fanatics would have you and themselves believe there is no wolf; and that even if their were, the house is too securely designed to be blown down.
Score: 0
|Your statement, while based on this article is completely wrong.
The article said "a user must be logged in" not "the attacker must be logged in" nor "the attacker must have local access".
Whoever wrote this article either doesn't understand the attack or is sensationalizing it (or both).
The attacker must have access. Read the original article. This type of attack is called priviledge escalation and requires the attacker to be logged into the machine.
Score: 0
|Bottom line is, all OSes are man made and will have errors in the code. Whether it be OS X, Windows XP, Linux, OpenBSD, etc. they can all be reverse engineered to find exploits.
Windows just looks less secure because everyone targets it, as other OSes get popular, such as OS X, hackers will turn away from Windows and start taking aim at OS X.
These are just my opinions, but they seem reasonable enough.
Score: 0
|the problem is your statement is too reasonable...let's get crazy and insane! :)
Score: 0
|The one thing i usualy complain about is tieing in uncessary processes into the core OS 9liek web broswer and media player)... especially ones that can access theinternet and automatically run scripts, does make Windows inherantly more vulnerable.
Score: 0
|*chuckles*
Score: 0
|and I quote... "Tuesday's news also highlights attackers' increasing focus on Mac OS X."
Wait till it gets as many users as Windows! and then see how many viri and hacks are discovered :)
Score: 0
|That's pretty unlikely to happen. I just would like more hackers to start hacking Mac OS X. And for Apple to stop lying to their customers.
Score: 0
|I though the same thing. Mac's have been out just as long as PC's and they haven't come close yet.
Score: 0
|after this, i cant help it wonder whats apple going to do its TV ads about ....
mac guy -"Hi, i'm a Mac, i've just been hacked"
pc guy -"i feel you brotha',... i feel you"
Score: 0
|Heh heh heh... That would be funny. =)
Although I'm a hardcore PC guy, and will continue to be for the next good while. It's sad to see that anyone would have to protect themselves againts 'evil do-er'.
Godspeed mac guys, welcome to the club. Hopefully one day we'll find something better. =)
Score: 0
|Yes because so many users are being hacked because of this. I was hacked by it this morning at least 17 different timeS!
Score: 0
|I'm not sure if your actualy being serious...
Score: 0
|Hmm. The first sentence sounds like sarcasm. The second sentence sounds like a complaint. I'm confused aswell.
Score: 0
|Mac humor.
Score: 0
|Must be.. =)
Confuse the heck out of people, and they won't know what to do. =P
Score: 0
|I'm only happy about this bcos it will be a humbling lesson for fanatical Mac users out there.
Their zealousness (EDIT: sorry, was a typo earlier) is akin to that of religious fanatics.
Score: 0
|"Their zealousy is akin to that of religious fanatics."
What the heck is "zealousy?"
Anyone who is happy about this because it "teaches us Mac users a lesson" is a moron. OS X is secure BY DESIGN. Mac users are often excited because Macs are fun and they want to share them.
Score: 0
|"zealousy" - An overly exagerated activity, often applied to religion fanatism.
OS X is secure BY DESIGN
Assuming you didnt read this off a magazine and unless you're a programmer, i would like to hear your definition of this, being that there's never been or ever will be "perfectly coded software".....
But based on your first post, i'm actually not surprised to see what "kind" of person buys a Mac.
Score: 0
|...as opposed to not secure by design... as if Windows is any less secure. Statistically speaking there are probably less car accidents on dirt roads than major highways, but...
Score: 0
|If OS X was secure by design, there would be no need to patch it because it is already secure.
You should never install any Mac OS X patches since it's already secure by design. And if you say, "It's secure because it was designed to be able patch any insecurities", then by that logic, Microsoft Windows XP is secure because it was designed to be able to patch any insecurities.
Score: 0
|Do you mean zealotry?
Score: 0
|http://en.wikipedia.org/wiki/Zealot
Score: 0
|I would bet the OP meant 'zealousness'. It's not hard to know what he meant, especially for someone so smart as yourself; that is... unless you are intentionally trying to be difficult.
Score: 0
|http://www.google.com/se....mozilla:en-US:official
See? I can do it to. Your point?
Score: 0
|"OS X is secure BY DESIGN."
Did you read the article?
Score: 0
|I think he means jealousy.
Score: 0
|Zealousy isn't a word. He meant zeal.
zeal
n.
Enthusiastic devotion to a cause, ideal, or goal and tireless diligence in its furtherance.
zeal·ous
adj.
Filled with or motivated by zeal; fervent.
zeal·ot
n.
One who is zealous, especially excessively so.
A fanatically committed person.
I learned that word in middle school.
EDIT: zealousness works, too.
Score: 0
|