The impossible has happened: MacOS X worm/malware spreads via iChat

[Urban Ranger]

Originally posted by Fve Crathva
It's also worth reiterating that the Windows access control list system is more flexible and powerful than UNIX permissions.

You can use selinux to further fine tune permissions on a GNU/Linux box.

[Fve Crathva]

They should have called it ntlinux.

SP

[Asher]

Originally posted by Agathon
Besides, Windows is so full of holes it doesn't matter.

It only takes 1 hole to screw up a system.

this just in:

http://news.com.com/OS+X+flaw+exposes+Macs/2100-1002_3-6041685.html?tag=nefd.top

OS X flaw exposes Macs
By Joris Evers
Staff Writer, CNET News.com
Published: February 21, 2006, 2:59 PM PST

update A serious flaw in Mac OS X could be a conduit for attackers to install malicious code on computers running the Apple Computer software, experts warned Tuesday.

The security problem is the third to surface for the operating system in the past week. It exposes Mac users to risks that are more familiar to Windows users: Visiting a malicious Web site using Apple's Safari Web browser could result in a rootkit, a backdoor or other malicious software being installed on the computer without the user noticing anything, experts said.

"This could be really bad," the SANS Internet Storm Center, which tracks network threats, said Tuesday. "Attackers can run shell scripts on your computer remotely just by visiting a malicious Web site."

Apple is developing a patch for the flaw, a company representative told CNET News.com. "We're working on a fix so that this doesn't become something that could affect customers," the representative said, but could not give a delivery date for the update.

Word of the new vulnerability comes after the recent discovery of a Trojan horse and a worm that target Mac users. The operating system had not been in the security crosshairs previously.

The new problem, discovered by Michael Lehn and first reported by Heise Online, lies in the way Mac OS X processes archive files. An attacker could embed malicious code in a ZIP file and host that on a Web site. The file and the embedded code would run when a Mac user visits the site using the Safari browser, experts said.

"Essentially, the operating system is executing commands that come in the metadata for ZIP files," said Alfred Huger, senior director of engineering at Symantec. "That is exacerbated by the problem that Safari will automatically open the file when you encounter it on the Web."

The issue may go beyond archive files, SANS said in updated notes on its Web site. "The attacker doesn't need to send a ZIP archive; the shell script itself can be disguised to practically anything," the note said.

The culprit appears to be the Mac OS Finder, the component of the operating system used to view and organize files, according to the SANS posting. A malicious file can be masked to look innocent--for example, like a JPEG image--yet it will run and execute when opened, SANS said.

This occurs because the operating system assigns an identifying image for the file based on the file extension, but decides which application will handle the file based on file permissions, SANS said. If the file has any executable bits set, it will be run using Terminal, the Unix command line prompt used in Mac OS X, SANS said.

There are no known attacks that take advantage of the flaw, experts said. However, proof-of-concept code that demonstrates the security vulnerability is publicly available online and could be tweaked for use in cyberattacks. "The skill level required to exploit it is very low. Pretty much anyone can do it," Huger said.

In the Windows world, such flaws are often exploited to install spyware or ad-serving software on vulnerable PCs. While such insidious software may be rare for the Mac, there are back doors and rootkits for the operating system, Huger said. "I think you'd likely see those installed with this type of vulnerability," he said.

The vulnerability is rated "extremely critical" by security monitoring company Secunia. Symantec also rates it "fairly high risk," Huger said. "If you have a Mac and use Safari, it is something you should remediate immediately," he said.

Mac OS X users can protect themselves by disabling the "Open safe files after downloading" option in Safari. In addition, users should be cautious when surfing the Web, the Apple representative said. "Apple always advises Mac users to only accept files from vendors and Web sites that they know and trust."

Users of alternative browsers such as Firefox and Camino on the Mac are not exposed to the Web-based attack vector, experts said.

[Verto]

ZOMFG MACS SUCK WINDOWS FOREVAR!!!!

[Agathon]

The security problem is the third to surface for the operating system in the past week. It exposes Mac users to risks that are more familiar to Windows users: Visiting a malicious Web site using Apple's Safari Web browser could result in a rootkit, a backdoor or other malicious software being installed on the computer without the user noticing anything, experts said.

Only if the user is running as admin, and only if that user has automatic extraction of downloads set to "on".

And the so-called second vulnerability was addressed by Apple in a patch six months ago.

[Asher]

That doesn't really matter, does it? The biggest viruses and worms against Windows happen months or years after it's fixed.

Remember "Code Red"? That happened six months after MS fixed it as well.

You have a lot of excuses. This is a gaping security hole, unpatched. This comes after an iChat vulnerability (or what should be a vulnerability -- Apple is not considering it one) permits malware to spread quickly. Apple is getting a lot more attention now, and as such the bad guys are paying more attention too. The writing is on the wall.

[Agathon]

[quote]That doesn't really matter, does it? The biggest viruses and worms against Windows happen months or years after it's fixed.

Remember "Code Red"? That happened six months after MS fixed it as well.[/quoted]

Well it's absolutely obvious isn't it... any sentence containing "Microsoft fixed it" is an oxymoron.

And as for yourself, you are the plain variety for posting this ****.

[Asher]

Originally posted by Agathon
Well it's absolutely obvious isn't it... any sentence containing "Microsoft fixed it" is an oxymoron.

And as for yourself, you are the plain variety for posting this ****.

There was nothing wrong with Microsoft's patch, it just so happens that not everybody runs at the latest patch levels. So dismissing vulnerabilities as fixed doesn't mean they're not important.

[Agathon]

Where's UR when you need someone to filter out the real howlers from the otherwise endless morass of dull garbage in Asher's posts?

[DaShi]

Too busy insulting other posters to avoid discussing issues, I'd imagine.