• Welcome to the Off-Topic/Schweb's Lounge

    In addition to the Mac-Forums Community Guidelines, there are a few things you should pay attention to while in The Lounge.

    Lounge Rules
    • If your post belongs in a different forum, please post it there.
    • While this area is for off-topic conversations, that doesn't mean that every conversation will be permitted. The moderators will, at their sole discretion, close or delete any threads which do not serve a beneficial purpose to the community.

    Understand that while The Lounge is here as a place to relax and discuss random topics, that doesn't mean we will allow any topic. Topics which are inflammatory, hurtful, or otherwise clash with our Mac-Forums Community Guidelines will be removed.

Mac OSX Bug

Joined
Jun 6, 2006
Messages
1,153
Reaction score
94
Points
48
Your Mac's Specs
MacBook 2.0GHz White, 512MB RAM, 60GB HDD
I don't think there's a reason to shun .dmg entirely (after all, most software is packaged in .dmg these days). However, I will be vigilant about where the .dmgs I use are from!
 

Jem


Joined
Aug 16, 2006
Messages
245
Reaction score
10
Points
18
I like the bit in the BBC article that states:

Apple has yet to provide a fix for the DMG bug though a workaround is known which should stop computers falling victim.

And then doesn't elaborate at all on the workaround...
 
Joined
Feb 2, 2004
Messages
12,455
Reaction score
604
Points
113
Location
PA
Your Mac's Specs
MacBook
interesting, ill stay away from .dmg
That wouldn't be a wise thing to do... in fact, it would be a little silly IMO.
As was stated, the vast majority of downloadable software (shareware, freeware) for Mac OS comes in the .dmg format.
The article never elaborates on what this "code bug" is or does, nor does it describe what a "vulnerable" machine entails. It really doesn't say much of anything, really.
The most important line of the article I find is this:
Article said:
The bug has only been proved to work under laboratory conditions. No cases of it being exploited in the wild are known and no users are thought to be at risk.
The second-most important line is this:
Article said:
It urged users to avoid downloading DMG files, which bear a .dmg suffix, from unknown sources.
The bolded suggestions should be more or less common sense, anyway.:black:
 
Joined
Sep 24, 2006
Messages
2,766
Reaction score
232
Points
63
Location
Brooklyn, New York
Your Mac's Specs
15" 2014 MacBook Pro, i7 2.5Ghz, 16GB RAM, 512GB SSD; iPad 3, iPhone 6
I like the replies so far, I don't think there is any need for panic.

1stly, a whole bunch of stuff as to happen before there is any serious risk. You have to download a .dmg from an untrustworthy source. Then after executing it and mounting the new files, your machine is potentially vulnerable or unstable. So between you executing the .dmg and any restart someone has to attack your machine, meaning getting around your firewall, knowing your IP address etc.

Secondly, even with the most secure OS in the world, you cannot account for user flaws. Whenever people download shareware or freeware and want to install it and the OS asks for the root password, people happily give it. ANY of these programmes could potentially be dangerous and open the system's back door to intruders.
 
Joined
Jun 3, 2006
Messages
2,370
Reaction score
285
Points
83
Location
Denver Colorado
Your Mac's Specs
2.4 GHz intel core 2 duo MBP, iPhone 5, iPad 3
That wouldn't be a wise thing to do... in fact, it would be a little silly IMO.
As was stated, the vast majority of downloadable software (shareware, freeware) for Mac OS comes in the .dmg format.
The article never elaborates on what this "code bug" is or does, nor does it describe what a "vulnerable" machine entails. It really doesn't say much of anything, really.
The most important line of the article I find is this:The second-most important line is this:The bolded suggestions should be more or less common sense, anyway.:black:

I should have been more clear, my mistake. Ill stay away from .dmg when downloading from unknown sources.
 
Joined
Mar 9, 2004
Messages
9,065
Reaction score
331
Points
83
Location
Munich
Your Mac's Specs
Aluminium Macbook 2.4 Ghz 4GB RAM, SSD 24" Samsung Display, iPhone 4, iPad 2
The workaround is to turn off the 'open "safe" files after downloading' option in safari.

That stops dmg's from being accidently downloaded and launched without any user interaction.
 

Jem


Joined
Aug 16, 2006
Messages
245
Reaction score
10
Points
18
I like the replies so far, I don't think there is any need for panic.

1stly, a whole bunch of stuff as to happen before there is any serious risk. You have to download a .dmg from an untrustworthy source. Then after executing it and mounting the new files, your machine is potentially vulnerable or unstable. So between you executing the .dmg and any restart someone has to attack your machine, meaning getting around your firewall, knowing your IP address etc.

Hmmm... how sure of this are you? It sounds to me from the article, that what they are referring to is a buffer overrun style attack, possibly in expanding (if that's what it does) or mounting the dmg file. A cleverly coded buffer overrun can result in pre-defined code being executed directly without any further interaction being required.

You are implying that mounting a dmg could cause some kind of server to be temporarily installed and require someone to actively try to contact you at that moment. If a hacker can manage to run up a piece of code to do this, they can certainly manage to do a bit more than that!

However, it would require a privilege escalation style attack before I'd be overly concerned about it and I don't know of any way of escalating privileges myself under OS X (although my knowledge is not comprehensive enough to state this categorically...)

p.s. Aptmunich - thanks for that on the workaround, I guess that helps a little.
 
Joined
Sep 24, 2006
Messages
2,766
Reaction score
232
Points
63
Location
Brooklyn, New York
Your Mac's Specs
15" 2014 MacBook Pro, i7 2.5Ghz, 16GB RAM, 512GB SSD; iPad 3, iPhone 6
Hmmm... how sure of this are you? It sounds to me from the article, that what they are referring to is a buffer overrun style attack, possibly in expanding (if that's what it does) or mounting the dmg file. A cleverly coded buffer overrun can result in pre-defined code being executed directly without any further interaction being required.

You are implying that mounting a dmg could cause some kind of server to be temporarily installed and require someone to actively try to contact you at that moment. If a hacker can manage to run up a piece of code to do this, they can certainly manage to do a bit more than that!

However, it would require a privilege escalation style attack before I'd be overly concerned about it and I don't know of any way of escalating privileges myself under OS X (although my knowledge is not comprehensive enough to state this categorically...)

Well I am not certain at all, and neither is anyone else by the looks of it.

My point really is that any attack that requires the user to double click on something and then results in nothing more than a buffer over run, is hardly a major threat. I must admit I didn't know that some users had Safari set up to automatically execute DMG files as soon as they download.

The bottom line is no OS is entirely secure. If all the hackers and trouble makers who mess up WindowsXP every day turned their attention to OS X, then there might be something to worry about.
 

Jem


Joined
Aug 16, 2006
Messages
245
Reaction score
10
Points
18
Oh sure, I totally agree, no OS is entirely secure and no doubt as Apple gain market share so they will also gain at least a few exploits. Mind you I wouldn't down play a buffer overrun too much, they can be purposefully exploited to do nasty stuff like erasing files without the user even noticing.

OK they're not going to destroy your entire system but they could do enough to cause regular users serious data loss. My most serious concern would really be if they managed to locate an existing privilege escalation loophole and could exploit that through the buffer overrun. Then your system is broken wide open.

And therein lies one of the major advantages of OS X over Windows, in OS X you don't run as root so malicious code can't easily do much system-level harm without you authorizing it. :)
 
Joined
Nov 18, 2006
Messages
4,934
Reaction score
207
Points
63
Location
Anytown, USA
Your Mac's Specs
27" iMac 2.7GHz Core i5, iPhone 6, iPad Air 2, 4th gen Apple TV
And therein lies one of the major advantages of OS X over Windows, in OS X you don't run as root so malicious code can't easily do much system-level harm without you authorizing it. :)

Thankfully, Windows Vista will have this kind of required authorization as well. I've run RC 1 and 2 and I was kind of annoyed by always putting in my password, but appreciated the beefed up security.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top