Major Mac Computer Security Flaw Found

bobross · Sep 2, 2009

Very interesting -

leading Mac researcher Dino Dai Zovi has unveiled a new attack at the chic Black Hat security conference in Las Vegas. The new technique allows hackers to take control of OS X machines and steal data from them that is supposed to be encrypted.

All the technique needs is access to the memory. A few lines of code will give the attacker access to the root memory, which is then written to establish a TCP connection, allowing the hacker to download malicious files and control the computer remotely. Mr. Zovi demonstrated how the attack can be used to hijack Apple’s Safari browser, stealing encrypted data from a user’s bank accounts.

He states, “There is no magic fairy dust protecting Macs. Writing exploits for [Microsoft] Vista is hard work. Writing exploits for Mac is a lot of fun.”

see link

bobross · Sep 2, 2009

Oh, forgot to ask, does anyone know if the improved security with SL addresses this matter?

Nethfel · Sep 2, 2009

That article is a short blip of the highlights, and more fear tactics then anything (heck, considering how much appears to near about be straight pulls from Reuters, it could arguably be called plagiarism). If you read the full Reuters article ( Mac flaw could let hackers get scrambled data | Technology | Reuters ) that appears to have been used as reference for the article in your link you'd find that this persons attack ONLY works on already victimized machines.

The technique that Dai Zovi unveiled on Wednesday -- dubbed "Machiavelli" -- only works on machines that have already been victimized. It can take control of Apple's Safari browser, stealing encrypted data from a user's bank accounts.

If a machine is already infected (like through an illegal download or getting that well known "video plugin" or potentially some other method) then it'd be easy for any hacker who has control of that virus/trojan/etc. to be able to do many things on a system - especially if the user installed the trojan/virus/etc. using his/her administrator password, which means that now their machine is not only infected, but the malicious software also has full administrative access.

Now, if this guy had created a hack with a few lines of code that worked on non-victimized machines, then I think it would be a much more major issue. Has a fix been made? No idea - I do know I had security patches for Leopard just a couple days before the SL leopard release, but I don't know what they did, nor do I know if SL would make that sort of an attack more difficult.

But as I've said before, once a machine has been victimized, if the malicious code was handled right, the system is already an open door for publishing private information. And this is true for Windows as well as OSX.

bobross · Sep 2, 2009

Thank you for the clarification. That was very precise, informative and to the point. I'm a little embarrassed I didn't look deeper into it myself before posting.

Nethfel · Sep 2, 2009

That's ok - honestly, I missed the link the first time through the article myself, and caught it after reading the comments at the bottom of the page. Being vigilant, like what you have read and brought forth, is definitely not a bad thing.

People need to be aware that no matter how beautiful an OS is, it's still written by humans, and can and will contain flaws - the moment we disregard that fact is the moment that we begin a downward path into serious risk and potential trouble for both our computers as well as our lives (as so much of our lives are online now, gaining access to our private info could allow for easy theft of identities, property, etc.).

I love my Mac, but I know OSX isn't perfect, and I won't pretend that what that researcher did isn't a potential concern, but the fact that it requires a already victimized system moves it a little lower on the concern scale.

god0fgod · Sep 2, 2009

The only thing I'm worried about is malware being downloaded by simply visiting infected websites. That happens with Windows. I'm not worried about malware which I have to download with notice because I'm not stupid.

cwa107 · Sep 2, 2009

god0fgod said:
The only thing I'm worried about is malware being downloaded by simply visiting infected websites. That happens with Windows. I'm not worried about malware which I have to download with notice because I'm not stupid.

None of the exploits that have been discovered has ever evolved into an "in the wild" threat before Apple has patched it.

And again, we're talking one or two exploits versus the thousands that effect Windows.

As it stands today, there are a couple of trojans that one might encounter. One type is included with pirated Apple software (iWork '09 and Snow Leopard). The other is disguised as a video codec.

In both cases, the user has to willfully install the software. With even a modicum of common sense, one can easily avoid these threats.