Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Black Hat Apple may have built its most secure Mac operating system yet, but a prominent security consultancy is advising enterprise clients to steer clear of adopting large numbers of the machines.

At a talk last week at the Black Hat security conference in Las Vegas, researchers from iSec Partners said large fleets of Macs are in many ways more vulnerable than recent versions of Windows to so-called APTs. Short for advanced persistent threats, APTs are usually the work of state-sponsored hackers who go to great lengths to infiltrate government and corporate networks with malware that steals classified information and proprietary data.

“With a large enterprise, you have to assume that people are going to get tricked into installing malware,” he told The Reg. “You can't assume that you'll never have malware somewhere in a network. You have to focus on parts where a bad guy goes from owning Bob the HR employee to become Sally the domain admin.”

At the heart of the Mac server's insecurity is a proprietary authentication scheme known as DHX that's trivial to override. While Mac servers can use the much more secure Kerberos algorithm for authenticating Macs on local networks, Stamos and fellow iSec researchers Paul Youn, Tom Daniels, Aaron Grattafiori, and William "BJ" Orvis found it was trivial to force OS X server to resort back to Apple's insecure protocol.

To demonstrate the threat, they developed a proof-of-concept that runs on a Mac connected to a local area network. It waits to be contacted by a machine running OS X server and then quickly copies all its authentication credentials. Next, it contacts other Macs on the network and pretends to be the administrator machine, and when they respond it is able to steal valuable data.

“If we go into an enterprise with a Mac and run this tool we will have dozens or hundreds of passwords in minutes,” Stamos said. He also faulted the OS X server for its lack of “channel binding” that ties an authentication handshake between two machines to the rest of the transaction that follows.

The iSec research comes 19 months after sophisticated hackers exploited a variety of security flaws in Windows machines to infiltrate the networks of Google and dozens of other companies. In response, the search engine reportedly phased out internal use of the Microsoft platform, mostly in favor of OS X.

Like many other researchers, Stamos praised a variety of advanced security protections built into Lion, the latest version of OS X. Among them is a design that isolates different application processes into their own sandbox that is separated from sensitive parts of the OS to minimize the damage that can be done by attackers. Apple engineers have made it simple for even small third-party developers to sandbox their applications. Windows sandboxing, by contrast, is so hard that it can usually be implemented only by large software manufacturers such as Adobe, Stamos said.

But Stamos said the defenses aren't enough to protect large organizations, even as they're looking for ways to resist against the types of attacks that ransacked Google or more recent APTs that afflicted at least 70 organizations for as long as 28 months.

“Our suggestion is for enterprises not to do that,” Stamos told The Reg. “Macs are fine as long as you run them as little islands, but once you hook them up to each other, they become much less secure.” ®

Update

In the comments section to this article, Stamos has responded to what he says is “lot of misunderstanding of our research.” It also includes a link to the slides for the iSec talk.

Agentless Backup is Not a Myth