Thursday, August 29, 2013

Unpatched Mac bug gives attackers “super user” status by going back in time

Exploiting the five-month-old "sudo" flaw in OS X just got easier.
Researchers have made it easier to exploit a five-month-old security flaw that allows penetration testers and less-ethical hackers to gain nearly unfettered "root" access to Macs over which they already have limited control.

The authentication bypass vulnerability was reported in March and resides in a Unix component known as sudo. While the program is designed to require a password before granting "super user" privileges such as access to other users' files, the bug makes it possible to obtain that sensitive access by resetting the computer clock to January 1, 1970. That date is known in computing circles as the Unix epoch, and it represents the beginning of time as measured by the operating system and most of the applications that run on it. By invoking the sudo command and then resetting the date, computers can be tricked into turning over root privileges without a password.

Developers of Metasploit, an open-source software framework that streamlines the exploitation of vulnerabilities in a wide array of operating systems and applications, recently added a module that makes it easier to exploit the sudo vulnerability on Macs. The addition capitalizes on the fact that all versions of OS X from 10.7 through the current 10.8.4 remain vulnerable. While the bug also affected many Linux distributions, most of those require a root password to change the computer clock. Macs impose no such restrictions on clock changes thanks to the systemsetup binary.

Mac users should realize that an attacker must satisfy a variety of conditions before being able to exploit this vulnerability. For one, the end-user who is logged in must already have administrator privileges. And for another, the user must have successfully run sudo at least once in the past. And of course, the attacker must already have either physical or remote shell access to the target machine. In other words: this exploit can't be used in the kind of drive-by webpage attacks that last year infected some 650,000 Macs with the Flashback malware. This doesn't mean it's a non-issue though, since the exploit can be used in concert with other attacks to magnify the damage they can do.

"The bug is significant because it allows any user-level compromise to become root, which in turn exposes things like clear-text passwords from Keychain and makes it possible for the intruder to install a permanent rootkit," HD Moore, the founder of the Metasploit project and the chief research officer at security firm Rapid7, told Ars. "I believe Apple should take this more seriously but am not surprised with the slow response given their history of responding to vulnerabilities in the open source tools they package."

Apple representatives didn't respond to an e-mail seeking comment for this post.

Saturday, August 24, 2013

Apple Allows Police new ability to disarm your phones from taking video

Apple has patented technology that would allow your cell phone camera to be disabled in certain locations. According to the patent application, it would be used in places like concert venues and movie theaters, but others worry that law enforcement will use it to prevent people from recording police activity.

"It presents a lot of problems." says attorney Carmen Roe. "I mean the first problem that comes to mind is the transparency we now have to what law enforcement is doing on our streets. "

She says government use of the technology would also violate the First Amendment, and well as deprive people access to their private property without a warrant.

"The technology exists." Says Juan Guevarra Torres with E-novvations Technology and Marketing." He says the technology wouldn't affect other brands. "I don't think it's possible. I think you would have to be able to control the operating system, hence only Apple products would be effected.

Tech bloggers disagree how it would work. Some say it would be an infrared signal that would disabled phones it detected that had the technology embedded in it, others think it would be like a mobile Wi-Fi hotspot. Regardless says Retired FBI Special Agent in Charge Don Clark, it's a bad idea. "We can develop in this country almost anything we want. We have the ability to do that but do we really want to?"