Snow Leopard security - The good, the bad and the missing
Vista lessons not learned
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Apple Engineers missed a key opportunity to implement an industry-standard technology in their latest operating system that would have made it more resistant to hacking attacks, three researchers have said.
Known as ASLR, or address space layout randomization, the measure picks a different memory location to load system components each time the OS is started. While Microsoft has had it implemented since the roll-out of Windows Vista, the analogous protection in Snow Leopard, which went on sale Friday, suffers from a crucial deficiency: It fails to randomize core parts of the OS, including the heap, stack and dynamic linker.
That means that attackers who identify buffer overflows and similar bugs in OS X components have a much better chance of causing the vulnerability to execute malicious code that compromises the machine. The halfhearted attempt at implementing ASLR has been a chief complaint of security researchers since Leopard, Snow Leopard's predecessor. Many had hoped it would be made more robust in the new version.
"ASLR is really only useful if EVERYTHING is randomized," Charlie Miller, co-author of The Mac Hacker's Handbook, wrote in an email to The Register. "If there is anything that is not randomized, it defeats the purpose mostly. This is a major shortcoming of Apple, and I'm disappointed they didn't take this opportunity to implement full ASLR."
Dino Dai Zovi, who also co-authored the Mac-hacking book, and fellow researcher Rich Mogull, CEO of Surosis, agreed that there is no discernible improvement in Snow Leopard's implementation of ASLR compared with Leopard.
"Randomizing the location of dyld is no small task, but Apple had a perfect opportunity to make the change with Snow Leopard since so many other important parts of the operating system were being updated," Mogull wrote here. "With dyld in place, an attacker has a roadmap to continue their exploitation and potentially take over your system."
What's more, as applications built for Snow Leopard proliferate, it may make it harder for Apple to add the feature later on, Dai Zovi said.
"The concern among many people in the security community is when will that change and how quickly," he said in an interview.
Not that the new OS hasn't improved some security offerings. One, called DEP, has been greatly expanded in Snow Leopard. It prevents shellcode and similar data that is supplied by a user from being executed by the OS. Had OS X had the protection over the past two Pwn2Own hacking contests neither of Miller's winning exploit entries would have worked.
One possible weakness with the new DEP offering: several parts of the Safari browser remain both writable and executable, a shortcoming that may make it easier for attackers to strike at one of the most targeted Apple applications.
QuickTime has also been mostly rewritten from scratch. While the jury is still out on how big an improvement the new code base contains, Miller said a vulnerability that works in the most recent version of Leopard doesn't work in the QuickTime for Snow Leopard. Another improvement: Several highly targeted OS X components, including the H.264 video codec, now come with sandboxing, which tightly restricts the types of activities they can carry out.
Apple has made additional changes, including expanded menu options in its firewall and Safari plug-ins that run as separate processes. While Mogull said the latter should make it harder to exploit buggy add-ons, Dai Zovi worried that the change might allow attackers to repeatedly crash them unbeknownst to the user.
And as reported earlier, Snow Leopard comes with new malware protection that in some cases warns users if they are about to install a malicious file. The feature is extremely limited at the moment, but it wouldn't be surprising to see Apple expand the offering over time.
No doubt, all the new features will be used and abused over the coming weeks and months, as researchers and hackers put them through their paces. As they report their results, we'll bring them to you here first. ®
COMMENTS
Security...
... has nothing to do with technology and everything to do with people. Others have pointed this out, but there seem to be far too many people missing it.
Every security system has the exact same weakness: human beings. *We* are the weakest link in the chain.
Now, I could bang on about how I've never had a single virus, trojan, etc. on ANY computer I've ever owned—and I've been using computers since the days when CP/M was still considered trendy. Why? Because, until the early '90s, just *getting* a virus or trojan was hard enough. But even with the rise of the Internet, the trick is *education*.
I've been writing code since 1981; I know intimately how computers work. I suspect many readers of El Reg are in a similar position. We don't "get" how people can be so "stupid". In fact, they're not being stupid. They're being *ignorant*, which isn't the same thing. The trick is to *educate* those users, instead of just swearing at them.
*
On a completely separate point: ASLR is, by definition, just another form of "security by obscurity". Either this is a Good Thing, or it's a Bad Thing. You don't get to have it both ways. Which is it?
*
On another completely separate point: Apple don't compete in the corporate sector. Microsoft do. (GNU / Linux tends to do well as a server OS too.) Therefore, pointing out that Microsoft has something like "90%" of "the market" is misleading. Microsoft have 90% of the *total* computer market, but at least 60% of that market is PCs sitting in office blocks the world over.
These market share statistics are missing something. That something is *context*.
Apple's focus is, and always has been, on the high-end *consumer* computing sector. Microsoft's share in that sector is rather lower. Strip away all that corporate stuff and Apple's share of their *target* market is actually pretty high—by my own research, I'd pin it at around 30-40% or so.
Apple's main rival in this sector is Sony, not Microsoft. Microsoft don't make home or office computers. They just sell some *components* for such computers. Like Broadcom, NVidia, AMD and Intel.
@Some maths
..unless the writer used the xkcd random number generator
http://xkcd.com/221/
or the dilbert random number generator
http://clipmarks.com/clipmark/4905F106-063A-401C-8631-392E2E49652A/
Some maths
It makes no difference how many times you randomise a number, at any given time the number will be equally random within the given scope.
In simple terms: If you have an OS component (X say) subject to buffer overflows etc. and you always load it into the same memory location then an exploit has a probability of 1 of finding that location.
However, say you have 10 possible locations (I know the number is much bigger, but hey this is simplified) on startup component X gets loaded into a random location. There is a 1 in 10 chance that any location you guess contains component X.
If you reboot then component X goes into a random location giving a 1 in 10 chance that any location you now guess contains X. However, if X is in space 1 and you reboot, there is still a 1 in 10 chance that component X goes into space 1 - so a reboot does not necessarily change the location of X. It probably will, but it might not. So at any given time X is in an equally random location, regardless of whether the computer is restarted or not.
So, assuming randomising component memory location is a Good Thing then it will be equally as good for your Apple you never restart as your Windows PC you also never restart.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
