Feeds

Latest QuickTime Exploit targets both Macs and PCs

Equal opportunity pwner

Internet Security Threat Report 2014

A US-based security researcher has published a single piece of code that can remotely compromise both PCs and Macs as long as they are running Apple's QuickTime media player.

The exploit is at least the fourth to target a newly discovered security flaw in the way QuickTime interacts with servers that stream audio and video. Up until now, the exploits have only targeted machines running Windows operating systems, but Lorenzo Hernandez, the researcher who prefers to go by the name Larry, says his exploit also targets Tiger and Leopard versions of OS X running on both Intel-made processors or older machines that use the PowerPC chip.

"Our intention was to provide a highly educational exploit," Larry told El Reg. "We are trying to expose and show exploitation techniques for OS X."

Apple, which has yet to patch the vulnerability in QuickTime's real time streaming protocol response header, has not responded to requests for comment.

The exploit, which is published here, first analyzes the bowels of a user's machine to determine the OS it is running. It then unleashes a payload that is tailored to the specific platform. In order for the exploit to work, an attacker would have to trick a user into clicking on a booby-trapped link, or playlist.

"Apple software is exceedingly informative when it comes to versioning information, and this is a security risk because it helps to automate exploitation," said Larry, CEO of Wyoming-based security services company called Subreption.

He provides a detailed write up (here) that concludes that the latest version of OS X lacks several common sense measures that would make it less vulnerable to miscreants.

For one thing, there's no heap randomization, which makes it easy to find a relatively static address located in dynamically allocated memory. For another, Leopard doesn't implement memory protection enforcement. Finally, Leopard for PowerPC doesn't implement a non-executable stack, making them susceptible to stack-based buffer overflows.

Since Saturday, at least three other exploits targeting the same flaw have been published. A Tuesday posting by Errata Security's David Maynor said there were indications there are exploits in the wild, but that he had so far been unable to confirm those suspicions.

WabiSabiLabi, an online marketplace for security exploit code, said recently that QuickTime proof-of-concept code it has listed for more than a week exploits a different vulnerability in the popular media player.

Researchers have been chiming in about the vulnerability over the past few days, often offering conflicting analyses of exactly how effective the attacks are when used in combination with specific browsers. Most agree that Firefox is vulnerable, particularly if QuickTime is selected as the default media player.

Window Snyder, Mozilla's security chief said Wednesday her team was looking into the matter.

Internet Explorer and Opera are believed to be more resistant to attacks, although some researchers speculate those browsers could also be used. Email-based attacks featuring attachments with hostile XML code that open a connection to malicious servers are also possible.

Larry's exploit is the first in recent memory to seamlessly cross the chasm between PCs and Macs. Most of the attacks we recall tend to pick one platform or the other. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.