Hacker to Apple: Watch those downloads

cyko95cyko95
Posted:
in macOS edited January 2014
Saw this over at shortnews.com, anyone think it's valid?

-----

Hacker to Apple: Watch those downloads



According to the BugTraq mailing list, Russell Harding has posted full instructions online for how to fool Apple's SoftwareUpdate feature to allowing a hacker to install a backdoor on any Mac running OS X.\tÂ*

The exploit fools SoftwareUpdate which updates the OS X Mac Operationg system. The program downloads and installs the updates over the web without authentication.\tÂ*

There are no patches for this exploit as of yet, although a company representative stated that Apple is 'actively investigating' the report.

-----
«1

Comments

  • Reply 1 of 32
    jonathan brisbyjonathan brisby Posts: 318member
    Hum... sounds like another disgrunted PC user who would like to imagine he has control over Apple's secret code. BTW, the software update server IS secure and the software only answers to THAT server. Another thing about this.... if the concept is so 'clever' wouldn't this have been heavily exploited on the PC side with Windows update? (which downloads a new patch per day!!!) Even if a very lucky booby managed to figure some such hack out... how does that threaten me? We run Norton Antivirus, we have NO sensitive data on the computer, we have up to date software and we watch the network like hawks. To answer your question... my take is this is not valid, or if it IS, the Jaguar build will refine the problem out of existence. (I'm not stressing). Also simply turning OFF automatic updates for the next few days can help ya out too...
  • Reply 2 of 32
    thuh freakthuh freak Posts: 2,664member
    doesn't software update require authentication before it installs anything? Also, doesn't it only update existing programs (therefore requiring that some1 already acquired the `backdoor`)? Or am i just misunderstanding how the earth revolves?
  • Reply 3 of 32
    cyko95cyko95 Posts: 391member
    <strong>(which downloads a new patch per day!!!)...</strong>[/QUOTE]

    That still amazes me about Apple. Just a couple months ago I switched my career from an ISP Network Admin to Graphic Artist. When I was an admin, the first thing I did every morning was updates. Anti-Virus, application, and of course OS. And you could pretty much guarantee that at least an hour of my day when to that as well as defragging and scan disking. Given, I didn't have to sit there for it to start, but as we all know the "occasional" reboot had to be done on a number of any of these tasks. Heck, I had a routine down when updating and maint. the systems to allow for less reboot time if I did it in a certain order.



    Now that I do graphic work, I use a Mac, of course. The first thing I do when I come to work now, is plug in my iBook, open the lid, and check my email. Boy thats tough. Given, i'm not running a LAN of servers anymore, but i'm not running Winblows anymore either.



    Just to note, I still run a XP Pro box, and Win98 box at home. The Win98 box is for my 5 year old to play games on, and the XP box is my Internet Sharing and solitare server. =)
  • Reply 4 of 32
    123123 Posts: 278member
    Jonathan Brisby:



    &lt;&lt;&lt;

    BTW, the software update server IS secure and the software only answers to THAT server.

    &lt;&lt;&lt;



    Unfortunately, "only answers to THAT server" dosn't exist. Someone in control of a router between you and the server (network admin, ISP etc.) can easily direct all outgoing SoftwareUpdate traffic to some box of his own. This box inserts an Apple IP address into all returned packets.





    &lt;&lt;&lt;

    Even if a very lucky booby managed to figure some such hack out... how does that threaten me? We run Norton Antivirus, we have NO sensitive data on the computer

    &lt;&lt;&lt;



    I don't think it matters what you have installed or if you have any sensitive data on your computer. Apple doesn't sell a different OS to companies that have sensitive data on their systems.



    thuh Freak:



    &lt;&lt;&lt;

    doesn't software update require authentication before it installs anything?

    &lt;&lt;&lt;



    He is talking about authentication of origin, not user authentication. SoftwareUpdate must be able to make sure that it's not accepting data from any other server than Apple's. Usually you would do this by including a public key into every copy of the updater software. Then a challenge mechanism would be used (The updater picks some random string, encrypts it with the public key and sends it to the server, the update server uses its private key to decrypt the message and sends the string back in plaintext. If the two strings match, it can be assumed that the server on the other side knows the private key and therefore is the official update server.)





    &lt;&lt;&lt;

    Also, doesn't it only update existing programs (therefore requiring that some1 already acquired the `backdoor`)

    &lt;&lt;&lt;



    I think SU can also install new files. Anyway, you wouldn't call your backdoor program "BACKDOOR.app". You'd call it iPhoto 1.1.2, request admin permissions and then install whatever you like.



    123



    [ 07-10-2002: Message edited by: 123 ]</p>
  • Reply 5 of 32
    pevepeve Posts: 518member
    is this a hoax?

    if not - how bad is this?
  • Reply 6 of 32
    smirclesmircle Posts: 1,035member
    Originally posted by peve:

    [quote]is this a hoax?

    if not - how bad is this?<hr></blockquote>



    It is not a hoax and it is potentially devastating. Apple f u c k e d up here big time - while our arch-enemy did much better with the windows update mechanism.
  • Reply 7 of 32
    123123 Posts: 278member
    peve,



    MIM (man in the middle) attacks can be carried out at any point between you and the Apple Server. You can also run the attack from a box that is in the same subnet as the victim's.



    Not only does Russell describe how the attack is done, he also provides all neccessary tools on his homepage to carry it out. This is what makes it really serious.



    123
  • Reply 8 of 32
    spotbugspotbug Posts: 361member
    Apple needs to sign (as in public key, digital signatures) all their updates. No way to spoof that (without real super-computer power).



    Let's see... this would require a new version of Software Update which would check the signature after downloading an update but before installing it.
  • Reply 9 of 32
    123123 Posts: 278member
    [double]



    [ 07-10-2002: Message edited by: 123 ]</p>
  • Reply 10 of 32
    hotboxdhotboxd Posts: 125member
    hmm, well a little while ago my software update program appeared all on it's own while I was online, asking to download some updates. it's never done that before, I wonder if i just got haxored or something. <img src="graemlins/hmmm.gif" border="0" alt="[Hmmm]" />
  • Reply 11 of 32
    ebbyebby Posts: 3,110member
    I have always manually downloaded and installed all updates, and I don't see why apple couldn't post the updates on their site. I have never heard of anyone having a problem downloading files directly from apple's website. <img src="graemlins/oyvey.gif" border="0" alt="[No]" /> This "software update" program is slow, and unnecessary. Netscape is fine for me. (and more reliable.)
  • Reply 12 of 32
    applenutapplenut Posts: 5,768member
    [quote]Originally posted by Ebby:

    <strong>I have always manually downloaded and installed all updates, and I don't see why apple couldn't post the updates on their site. I have never heard of anyone having a problem downloading files directly from apple's website. <img src="graemlins/oyvey.gif" border="0" alt="[No]" /> This "software update" program is slow, and unnecessary. Netscape is fine for me. (and more reliable.)</strong><hr></blockquote>



    don't agree and haven't experienced a word you said
  • Reply 13 of 32
    cyko95cyko95 Posts: 391member
    [quote]Originally posted by Ebby:

    <strong>I have always manually downloaded and installed all updates, and I don't see why apple couldn't post the updates on their site. I have never heard of anyone having a problem downloading files directly from apple's website. <img src="graemlins/oyvey.gif" border="0" alt="[No]" /> This "software update" program is slow, and unnecessary. Netscape is fine for me. (and more reliable.)</strong><hr></blockquote>



    Actually I do mine manually as well, but you can go to the website and download them there as well. The software update is just a bit easier to get to for most folks.
  • Reply 14 of 32
    smirclesmircle Posts: 1,035member
    Originally posted by Ebby:

    [quote]I have always manually downloaded and installed all updates, and I don't see why apple couldn't post the updates on their site. <hr></blockquote>



    They do offer the updates via ftp as well. However, the exploit mentioned above would work as well if you get your downloads via netscape. The only solution is digitally signing the files and having the installer check that signature.
  • Reply 15 of 32
    jonathan brisbyjonathan brisby Posts: 318member
    Believe me, I'm quaking in my boots! Mean scary hacker gonna update my software with nasty stuff. Get real. I feel like I'm watching channel 142 and the station ID just came on and said "You are watching Sci-Fi" (in that hot babes voice). If a glitch exists, Apple will fix it. Windows update is NOT better. IT is slow, buggy etc. etc. etc. I don't think I'm too worried about this...and like I said earlier...just TURN THE BLASTED THING OFF!
  • Reply 16 of 32
    pevepeve Posts: 518member
    [quote]Originally posted by Jonathan Brisby:

    <strong>Believe me, I'm quaking in my boots! Mean scary hacker gonna update my software with nasty stuff. Get real.</strong><hr></blockquote>



    i'm not hysterical - i'm only conserned.



    [quote](...)If a glitch exists, Apple will fix it.<hr></blockquote>



    'think so too.



    [quote]Windows update is NOT better. IT is slow, buggy etc. etc. etc.



    does the m$ updater have the same problem or do they use other technology?



    [QUOTE]I don't think I'm too worried about this...and like I said earlier...just TURN THE BLASTED THING OFF!<hr></blockquote>



    yeah.

    and jagwire is comming.
  • Reply 17 of 32
    undotwaundotwa Posts: 97member
    This security flaw won't affect 99.99% of you guys. Only get scared if you have someone on your LAN likely to do this to you. Don't loose sleep.
  • Reply 18 of 32
    lowb-inglowb-ing Posts: 98member
    1. It's no hoax.



    2. Just turn automatic update off 'till there's a fix and you'll be fine.



    3. Windows is not better. there have already been one or two vulns in xp's auto update function reported so far, but they've been fixed by now. M$ makes shure these things are handled descreetly.
  • Reply 19 of 32
    jimmacjimmac Posts: 11,898member
    What a crock!



    Don't run scared like little lemmings. That's what they want!



    Software Update has always worked fine for me.



    Just watch nothing will come of this. If it does it will finaly give NAV something to do.
  • Reply 20 of 32
    mactechmactech Posts: 31member
    [quote]Originally posted by undotwa:

    <strong>This security flaw won't affect 99.99% of you guys. Only get scared if you have someone on your LAN likely to do this to you. Don't loose sleep.</strong><hr></blockquote>



    Exactly, you have to be on the same subnet, not just upstream. This would be a tough one to do. If you are so worried, you can create a HOSTS file pointing directly to the IP address and not use your DNS servers to take you there.

    For the really paranoid, just wait a few days and download them directly from apple's web site, provided no one has hacked it.
Sign In or Register to comment.