Feeds

Beware of Macs in enterprise, security consultants say

OS X in the age of espionage malware

Security for virtualized datacentres

Black Hat Apple may have built its most secure Mac operating system yet, but a prominent security consultancy is advising enterprise clients to steer clear of adopting large numbers of the machines.

At a talk last week at the Black Hat security conference in Las Vegas, researchers from iSec Partners said large fleets of Macs are in many ways more vulnerable than recent versions of Windows to so-called APTs. Short for advanced persistent threats, APTs are usually the work of state-sponsored hackers who go to great lengths to infiltrate government and corporate networks with malware that steals classified information and proprietary data.

iSec's recommendation is premised on the assumption that a small percentage of employees in any large business or government organizations will be tricked into installing malicious software, no matter what platform they use. The problem with Macs stems from the OS X server that administrators use to push updates to large numbers of machines. The server's authentication routine is “inherently insecure,” making it trivial for a single infected OS X computer to compromise others, said iSec CTO Alex Stamos.

“With a large enterprise, you have to assume that people are going to get tricked into installing malware,” he told The Reg. “You can't assume that you'll never have malware somewhere in a network. You have to focus on parts where a bad guy goes from owning Bob the HR employee to become Sally the domain admin.”

At the heart of the Mac server's insecurity is a proprietary authentication scheme known as DHX that's trivial to override. While Mac servers can use the much more secure Kerberos algorithm for authenticating Macs on local networks, Stamos and fellow iSec researchers Paul Youn, Tom Daniels, Aaron Grattafiori, and William "BJ" Orvis found it was trivial to force OS X server to resort back to Apple's insecure protocol.

To demonstrate the threat, they developed a proof-of-concept that runs on a Mac connected to a local area network. It waits to be contacted by a machine running OS X server and then quickly copies all its authentication credentials. Next, it contacts other Macs on the network and pretends to be the administrator machine, and when they respond it is able to steal valuable data.

“If we go into an enterprise with a Mac and run this tool we will have dozens or hundreds of passwords in minutes,” Stamos said. He also faulted the OS X server for its lack of “channel binding” that ties an authentication handshake between two machines to the rest of the transaction that follows.

The iSec research comes 19 months after sophisticated hackers exploited a variety of security flaws in Windows machines to infiltrate the networks of Google and dozens of other companies. In response, the search engine reportedly phased out internal use of the Microsoft platform, mostly in favor of OS X.

Like many other researchers, Stamos praised a variety of advanced security protections built into Lion, the latest version of OS X. Among them is a design that isolates different application processes into their own sandbox that is separated from sensitive parts of the OS to minimize the damage that can be done by attackers. Apple engineers have made it simple for even small third-party developers to sandbox their applications. Windows sandboxing, by contrast, is so hard that it can usually be implemented only by large software manufacturers such as Adobe, Stamos said.

But Stamos said the defenses aren't enough to protect large organizations, even as they're looking for ways to resist against the types of attacks that ransacked Google or more recent APTs that afflicted at least 70 organizations for as long as 28 months.

“Our suggestion is for enterprises not to do that,” Stamos told The Reg. “Macs are fine as long as you run them as little islands, but once you hook them up to each other, they become much less secure.” ®

Update

In the comments section to this article, Stamos has responded to what he says is “lot of misunderstanding of our research.” It also includes a link to the slides for the iSec talk.

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.