Feeds

Beware of Macs in enterprise, security consultants say

OS X in the age of espionage malware

Beginner's guide to SSL certificates

Black Hat Apple may have built its most secure Mac operating system yet, but a prominent security consultancy is advising enterprise clients to steer clear of adopting large numbers of the machines.

At a talk last week at the Black Hat security conference in Las Vegas, researchers from iSec Partners said large fleets of Macs are in many ways more vulnerable than recent versions of Windows to so-called APTs. Short for advanced persistent threats, APTs are usually the work of state-sponsored hackers who go to great lengths to infiltrate government and corporate networks with malware that steals classified information and proprietary data.

iSec's recommendation is premised on the assumption that a small percentage of employees in any large business or government organizations will be tricked into installing malicious software, no matter what platform they use. The problem with Macs stems from the OS X server that administrators use to push updates to large numbers of machines. The server's authentication routine is “inherently insecure,” making it trivial for a single infected OS X computer to compromise others, said iSec CTO Alex Stamos.

“With a large enterprise, you have to assume that people are going to get tricked into installing malware,” he told The Reg. “You can't assume that you'll never have malware somewhere in a network. You have to focus on parts where a bad guy goes from owning Bob the HR employee to become Sally the domain admin.”

At the heart of the Mac server's insecurity is a proprietary authentication scheme known as DHX that's trivial to override. While Mac servers can use the much more secure Kerberos algorithm for authenticating Macs on local networks, Stamos and fellow iSec researchers Paul Youn, Tom Daniels, Aaron Grattafiori, and William "BJ" Orvis found it was trivial to force OS X server to resort back to Apple's insecure protocol.

To demonstrate the threat, they developed a proof-of-concept that runs on a Mac connected to a local area network. It waits to be contacted by a machine running OS X server and then quickly copies all its authentication credentials. Next, it contacts other Macs on the network and pretends to be the administrator machine, and when they respond it is able to steal valuable data.

“If we go into an enterprise with a Mac and run this tool we will have dozens or hundreds of passwords in minutes,” Stamos said. He also faulted the OS X server for its lack of “channel binding” that ties an authentication handshake between two machines to the rest of the transaction that follows.

The iSec research comes 19 months after sophisticated hackers exploited a variety of security flaws in Windows machines to infiltrate the networks of Google and dozens of other companies. In response, the search engine reportedly phased out internal use of the Microsoft platform, mostly in favor of OS X.

Like many other researchers, Stamos praised a variety of advanced security protections built into Lion, the latest version of OS X. Among them is a design that isolates different application processes into their own sandbox that is separated from sensitive parts of the OS to minimize the damage that can be done by attackers. Apple engineers have made it simple for even small third-party developers to sandbox their applications. Windows sandboxing, by contrast, is so hard that it can usually be implemented only by large software manufacturers such as Adobe, Stamos said.

But Stamos said the defenses aren't enough to protect large organizations, even as they're looking for ways to resist against the types of attacks that ransacked Google or more recent APTs that afflicted at least 70 organizations for as long as 28 months.

“Our suggestion is for enterprises not to do that,” Stamos told The Reg. “Macs are fine as long as you run them as little islands, but once you hook them up to each other, they become much less secure.” ®

Update

In the comments section to this article, Stamos has responded to what he says is “lot of misunderstanding of our research.” It also includes a link to the slides for the iSec talk.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.