13 ms·

Google discloses three severe vulnerabilities in Apple OS X

351 points by bhauer 12y ago

mc32 12y ago
Does anyone know if they only research os and os environment bugs or also cisco juniper os bugs as well for example?
- deleted 12y ago
  [deleted]
- jpetra 12y ago
  This is from the Project Zero announcement post: "We're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers." http://googleonlinesecurity.blogspot.com/2014/07/announcing-project-zero.html http://googleonlinesecurity.blogspot.com/2014/07/announcing-...
- adr_ 12y ago
  https://code.google.com/p/google-security-research/issues/list?can=1 https://code.google.com/p/google-security-research/issues/li... They haven't published Cisco bugs, but they do have a pretty broad scope.
- xaqfox 12y ago
  I also wonder if they publish proof of concepts for security bugs they refuse to fix (e.g. in Android 4.3).
  - giovannibajo1 12y ago
    They said they also investigate on Android, but they haven't yet published a single vulnerability for it, as far as I can tell.
    - ikonst 12y ago
      Right on their blog, though it's a guest post but they don't seem to have anything against it: http://googleprojectzero.blogspot.com/2015/01/exploiting-nvmap-to-escape-chrome.html http://googleprojectzero.blogspot.com/2015/01/exploiting-nvm...
      - giovannibajo1 12y ago
        Yes, it's a guest post. What I said is that, while in theory they said they will research all major OSs (including Android, which is by far the most common mobile OS), they have yet to publish a single vulnerability as a result of their research.
        patrickaljord 12y ago
        Maybe they do publish them but they are all fixed before the 90 windows passes so they don't have to be disclosed their. You still go to git.chromium.org and aosp's git see the daily security/improvement patches that go there.
        giovannibajo1 12y ago
        The disclosure window is typically for fixes released to end-users, not just fixed by vendors. This is also what was enforced with MS last round, where they had a fix ready but couldn't get it to pass QA and being released before the 90-days window expired.
  - Oletros 12y ago
    Was the security bug discovered by Project Zero team?
  - chc 12y ago
    These bugs appear to be for Yosemite, so they might only look at bugs present in the latest version of the software.
  - izacus 12y ago
    I doubt they're wasting time with bugs in OS X 10.5 either.
cheald 12y ago
Tech journalists insisting on calling these "zero-days" (which, to its credit, CNet changed, though Ars and ZDNet are guilty of it) is really kind of irritating. A zero-day is, by definition, an exploit that the vendor has had zero days to react to. It's not just an unpatched vulnerability with a proof of concept exploit available for it. Apple has been aware of these issues since October.
- arjunnarayan 12y ago
  This is correct. Strictly speaking, its a 90 day.
  - cyphunk 12y ago
    I disagree with this interpretation. It remains 0 day until it is patched or has a work around (disabling the service). Further still the date aging starts begins when the bug is disclosed publicly, or broadly if not publicly. Internal disclosure doesn't count. It remains 0day even if you share it with a friend. The measurement of days has to do with its usefulness (to an attacker) and that begins to diminish after wide disclosure. Then again, the term is also completely irrelevant.
    - cheald 12y ago
      Do you have a source for that definition? Because every definition of zero-day I've ever seen has to do with the days it has been known to the vendor. > A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application or operating system, one that developers have not had time to address and patch. It is called a "zero-day" because the programmer has had zero days to fix the flaw (in other words, a patch is not available) http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack
      - cyphunk 12y ago
        I don't have a source as reliable as Wikipedia. I base my definition on how it is used in the field of reverse engineering which I've been in for a long time. In any case, people can stick with the wiki definition. Not important.
pbreit 12y ago
I'm assuming they communicate these privately to the vulnerable party prior to publicizing?
- iancarroll 12y ago
  They gave them 90 days to publish a fix.
  - sigzero 12y ago
    And that fix in the latest beta. So it is coming.
- Oletros 12y ago
  Yes, they do, 90 days before disclosing them
  - Oletros 12y ago
    It seems that someone is pissed off
- jafingi 12y ago
  Yes. Google releases it after a 90-day grace period. So Apple has known about it for a while.
- deleted 12y ago
  [deleted]
- rosser 12y ago
  FTFA: "The vulnerabilities were reported to Apple back in October but the flaws have not been fixed. After 90 days, details of vulnerabilities found by Project Zero are automatically released to the public -- which is what happened this week."
FireBeyond 12y ago
I will be curious, as a litmus test, to see how perception of this varies in the community to the Microsoft release. That was a mixed bag - with support on both sides of the aisles, some decrying Patch Tuesday, some in support. What will happen here? Will Google be lauded for consistency, or castigated for not "working more closely" with Apple (for varying definitions of "working closely", up to and including potentially delaying disclosure around arbitrary timelines)?
- cheald 12y ago
  I'm wholly in support of Google here. Apple has a history of letting known vulnerabilities persist for years (ie, http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix-finfisher-trojan-hole/ http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix...) without fixes.
  - dzhiurgis 12y ago
    Google is exploiting MS and Apple update release processes. Both were published days before update schedule.
    - FireBeyond 12y ago
      That's an interesting counterpoint, and one I hadn't considered. Definitely worthy of note (especially when you combine it with the 'zero Android vulnerabilities found' - which isn't to imply it's an actively nefarious project, but that everything should be taken with an objective eye).
    - icantthinkofone 12y ago
      This is not true and was disavowed elsewhere. Wish I had the link.
olssy 12y ago
From what I can tell one of the exploits allows for code execution with root privileges, another for accessing kernel-space memory and the third will crash the machine. Are any of these things not already doable when someone has physical access to the machine?
- cheald 12y ago
  They aren't remote code execution exploits as best as I can tell. But, it's a short leap from an exploitable root escalation to total compromise of a machine. Until these are patched, any executable you download and run could potentially be a dropper for much nastier stuff. You could combine one of these with the recently-disclosed Flash exploits, for example, and you have a drive-by root exploit ready for deployment via ad networks to millions of people.
- tptacek 12y ago
  They're not doable from random programs downloaded from the Internet, except via these flaws.
IBM 12y ago
It's fixed in the latest beta. http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...
geofft 12y ago
How is it possible in 2015 that major kernels are vulnerable to arbitrary code execution via null pointer dereference? Leave aside memory safety, input validation, actually caring about the quality of your work, whatever. mmap_min_addr stopped a ton of attacks back in like 2007-10 when Linux had a local privilege escalation-of-the-month (and RHEL, which hadn't enabled it yet for backwards-compatibility concerns, got hit more frequently). It's not a particularly aesthetically-pleasing solution, but it's an effective one. Are there legacy apps on OS X that require mapping the zero page? Executable? That Apple cares about supporting? I've run into two things on Linux that need to map the zero page: versions of MIT Scheme from before 2009 (because the compiler was doing something super weird), and Wine, when running certain DOS / Windows 3.1 apps. Anything of that era probably stopped working on OS X when they killed Classic. Even Carbon has been dead for three years. https://wiki.debian.org/mmap_min_addr https://wiki.debian.org/mmap_min_addr https://access.redhat.com/articles/20484 https://access.redhat.com/articles/20484
- mmarks 12y ago
  >> Even Carbon has been dead for three years. <<< With regard to only this point, probably half if not more of the the top 15 grossing games on the Mac AppStore Games page today are either Carbon Apps or at minimum require the Carbon framework.
  - daniel02216 12y ago
    And a bunch of those are using Wine, which requires mapping code at the zero page, so they're compiled with a special load command that allows them to map the zero page. On Yosemite, 64-bit binaries aren't allowed to do this.
    - geofft 12y ago
      Whoa, seriously? I didn't realize Wine for OS X was real enough to be usable for anything, let alone be admitted to the app store and make it to the top. That's pretty awesome. Although every time I go "I didn't realize X on Y worked", it seems like games are the rationale, and not very surprisingly, since they exercise a relatively small part of the API surface apart from OpenGL. (Mono, some HTML 5 things as mobile apps, and Humble Bundle's asm.js collection all come to mind.) Can OS X take a cue from iOS and require a special Apple-signed entitlement to do this (unless root overrides it in a config file), or is it not worth the trouble? Also, does Wine actually require this in general? My understanding was that Wine needed this for legacy Windows apps that themselves map the zero page, but recent-ish apps designed for XP or later shouldn't do that, right?
glasshead969 12y ago
Looks like the latest 10.10.2 beta has them fixed. Users with access to public beta program should see the update. http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...
BigChiefSmokem 12y ago
I have a serious question. I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?
- slouch 12y ago
  Most of these Apple computers are owned by Google users.
  - epistasis 12y ago
    And a large percentage of Google devs are Apple users. Edit: for the apparent doubter of this, see any number of articles about Google's 40,000 macs that they use as dev machines, for example: https://www.usenix.org/conference/lisa13/managing-macs-google-scale https://www.usenix.org/conference/lisa13/managing-macs-googl... http://www.theregister.co.uk/2013/11/27/google_mac_support/ http://www.theregister.co.uk/2013/11/27/google_mac_support/
    - HeavenFox 12y ago
      Google Engineers mostly use their beefy workstations with a Google-flavored Ubuntu installed to code. Most engineers have Mac laptops though (at least my team), even though their use is quite limited (you cannot store code there, so mostly you have to ssh or remote desktop to your workstation) Source: worked there once
      - gst 12y ago
        Did you use an IDE via X11 forwarding? Or did you just use Vim / Emacs?
        KerrickStaley 12y ago
        Usually NX or the like.
        12y ago
bluthru 12y ago
I don't get why Apple wouldn't be motivated to fix this ASAP for their own safety.
- tedunangst 12y ago
  Safety from what? The devs responsible probably believe (quite reasonably) that if there's untrusted code running local root exploits on their machine, they've already lost most of the battle.
- alwillis 12y ago
  It’s coming soon and is already available to testers: http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...
Pinn2 12y ago
I have a huge ego and like more money. Is HackerOne the best way to feed both?
franciscop 12y ago
Sidenote: please do not publish re-posts, reference the original source whenever possible: http://www.zdnet.com/article/googles-project-zero-reveals-three-apple-os-x-zero-day-vulnerabilities/ http://www.zdnet.com/article/googles-project-zero-reveals-th...
cyphunk 12y ago
Is it 0day or is it not. "0day" is not an important word except that the media has started using it. For those of us working in the field, it's just a fun term, not a legal term. It is used to distinguish the risk of a bug, not the ethical handling of it. It has always been in relation to risk. The risk is greatest when it is a. unknown to anyone but a few b. unknown by a wide enough audience to effect its application c. unfixable or as yet unpatched. Some in the field call bugs fitting any one of these qualification 0days, other's not. But nearly no one in the field uses this term to quantify the ethical handling of a bug (as in: age starting from moment vendor knows about bug). Consider what a 1day is. A "1day" bug is one that looses value because it is likely that some systems have now been patched such that you as an attacker are not guaranteed that every system you touch with your exploit will fall. A 365day is likely useless, depending on the target platform. Hence, the entirety of its meaning has to do with risk, not procedure or ethics. It is fine if you read Wikipedia's definition and decide the meaning is otherwise. After all, language changes. But if anyone in the future wants to understand the etymology of the meaning behind "0day" they should consider that the meaning appears to have changed (in the minds of many that actually don't even work in the field of reverse engineering).
uniformlyrandom 12y ago
> Google's Project Zero security team revealed the existence this week of three vulnerabilities with high severity that have yet to be fixed in Apple's OS X operating system. I feel like somebody is trying to execute some kind of buffer overflow attack against my brain.
pronoiac 12y ago
Does anyone know how far back the bugs go? Mavericks, Snow Leopard?

351 points by bhauer 12y ago

mc32 12y ago

Does anyone know if they only research os and os environment bugs or also cisco juniper os bugs as well for example?

deleted 12y ago
[deleted]
jpetra 12y ago
This is from the Project Zero announcement post: "We're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers." http://googleonlinesecurity.blogspot.com/2014/07/announcing-project-zero.html http://googleonlinesecurity.blogspot.com/2014/07/announcing-...
adr_ 12y ago
https://code.google.com/p/google-security-research/issues/list?can=1 https://code.google.com/p/google-security-research/issues/li... They haven't published Cisco bugs, but they do have a pretty broad scope.
xaqfox 12y ago
I also wonder if they publish proof of concepts for security bugs they refuse to fix (e.g. in Android 4.3).
- giovannibajo1 12y ago
  They said they also investigate on Android, but they haven't yet published a single vulnerability for it, as far as I can tell.
  - ikonst 12y ago
    Right on their blog, though it's a guest post but they don't seem to have anything against it: http://googleprojectzero.blogspot.com/2015/01/exploiting-nvmap-to-escape-chrome.html http://googleprojectzero.blogspot.com/2015/01/exploiting-nvm...
    - giovannibajo1 12y ago
      Yes, it's a guest post. What I said is that, while in theory they said they will research all major OSs (including Android, which is by far the most common mobile OS), they have yet to publish a single vulnerability as a result of their research.
      - patrickaljord 12y ago
        Maybe they do publish them but they are all fixed before the 90 windows passes so they don't have to be disclosed their. You still go to git.chromium.org and aosp's git see the daily security/improvement patches that go there.
        giovannibajo1 12y ago
        The disclosure window is typically for fixes released to end-users, not just fixed by vendors. This is also what was enforced with MS last round, where they had a fix ready but couldn't get it to pass QA and being released before the 90-days window expired.
- Oletros 12y ago
  Was the security bug discovered by Project Zero team?
- chc 12y ago
  These bugs appear to be for Yosemite, so they might only look at bugs present in the latest version of the software.
- izacus 12y ago
  I doubt they're wasting time with bugs in OS X 10.5 either.

cheald 12y ago

Tech journalists insisting on calling these "zero-days" (which, to its credit, CNet changed, though Ars and ZDNet are guilty of it) is really kind of irritating. A zero-day is, by definition, an exploit that the vendor has had zero days to react to. It's not just an unpatched vulnerability with a proof of concept exploit available for it. Apple has been aware of these issues since October.

arjunnarayan 12y ago
This is correct. Strictly speaking, its a 90 day.
- cyphunk 12y ago
  I disagree with this interpretation. It remains 0 day until it is patched or has a work around (disabling the service). Further still the date aging starts begins when the bug is disclosed publicly, or broadly if not publicly. Internal disclosure doesn't count. It remains 0day even if you share it with a friend. The measurement of days has to do with its usefulness (to an attacker) and that begins to diminish after wide disclosure. Then again, the term is also completely irrelevant.
  - cheald 12y ago
    Do you have a source for that definition? Because every definition of zero-day I've ever seen has to do with the days it has been known to the vendor. > A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application or operating system, one that developers have not had time to address and patch. It is called a "zero-day" because the programmer has had zero days to fix the flaw (in other words, a patch is not available) http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack
    - cyphunk 12y ago
      I don't have a source as reliable as Wikipedia. I base my definition on how it is used in the field of reverse engineering which I've been in for a long time. In any case, people can stick with the wiki definition. Not important.

pbreit 12y ago

I'm assuming they communicate these privately to the vulnerable party prior to publicizing?

iancarroll 12y ago
They gave them 90 days to publish a fix.
- sigzero 12y ago
  And that fix in the latest beta. So it is coming.
Oletros 12y ago
Yes, they do, 90 days before disclosing them
- Oletros 12y ago
  It seems that someone is pissed off
jafingi 12y ago
Yes. Google releases it after a 90-day grace period. So Apple has known about it for a while.
deleted 12y ago
[deleted]
rosser 12y ago
FTFA: "The vulnerabilities were reported to Apple back in October but the flaws have not been fixed. After 90 days, details of vulnerabilities found by Project Zero are automatically released to the public -- which is what happened this week."

FireBeyond 12y ago

I will be curious, as a litmus test, to see how perception of this varies in the community to the Microsoft release. That was a mixed bag - with support on both sides of the aisles, some decrying Patch Tuesday, some in support. What will happen here? Will Google be lauded for consistency, or castigated for not "working more closely" with Apple (for varying definitions of "working closely", up to and including potentially delaying disclosure around arbitrary timelines)?

cheald 12y ago
I'm wholly in support of Google here. Apple has a history of letting known vulnerabilities persist for years (ie, http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix-finfisher-trojan-hole/ http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix...) without fixes.
- dzhiurgis 12y ago
  Google is exploiting MS and Apple update release processes. Both were published days before update schedule.
  - FireBeyond 12y ago
    That's an interesting counterpoint, and one I hadn't considered. Definitely worthy of note (especially when you combine it with the 'zero Android vulnerabilities found' - which isn't to imply it's an actively nefarious project, but that everything should be taken with an objective eye).
  - icantthinkofone 12y ago
    This is not true and was disavowed elsewhere. Wish I had the link.

olssy 12y ago

From what I can tell one of the exploits allows for code execution with root privileges, another for accessing kernel-space memory and the third will crash the machine. Are any of these things not already doable when someone has physical access to the machine?

cheald 12y ago
They aren't remote code execution exploits as best as I can tell. But, it's a short leap from an exploitable root escalation to total compromise of a machine. Until these are patched, any executable you download and run could potentially be a dropper for much nastier stuff. You could combine one of these with the recently-disclosed Flash exploits, for example, and you have a drive-by root exploit ready for deployment via ad networks to millions of people.
tptacek 12y ago
They're not doable from random programs downloaded from the Internet, except via these flaws.

IBM 12y ago

It's fixed in the latest beta. http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

geofft 12y ago

How is it possible in 2015 that major kernels are vulnerable to arbitrary code execution via null pointer dereference? Leave aside memory safety, input validation, actually caring about the quality of your work, whatever. mmap_min_addr stopped a ton of attacks back in like 2007-10 when Linux had a local privilege escalation-of-the-month (and RHEL, which hadn't enabled it yet for backwards-compatibility concerns, got hit more frequently). It's not a particularly aesthetically-pleasing solution, but it's an effective one. Are there legacy apps on OS X that require mapping the zero page? Executable? That Apple cares about supporting? I've run into two things on Linux that need to map the zero page: versions of MIT Scheme from before 2009 (because the compiler was doing something super weird), and Wine, when running certain DOS / Windows 3.1 apps. Anything of that era probably stopped working on OS X when they killed Classic. Even Carbon has been dead for three years. https://wiki.debian.org/mmap_min_addr https://wiki.debian.org/mmap_min_addr https://access.redhat.com/articles/20484 https://access.redhat.com/articles/20484

mmarks 12y ago
>> Even Carbon has been dead for three years. <<< With regard to only this point, probably half if not more of the the top 15 grossing games on the Mac AppStore Games page today are either Carbon Apps or at minimum require the Carbon framework.
- daniel02216 12y ago
  And a bunch of those are using Wine, which requires mapping code at the zero page, so they're compiled with a special load command that allows them to map the zero page. On Yosemite, 64-bit binaries aren't allowed to do this.
  - geofft 12y ago
    Whoa, seriously? I didn't realize Wine for OS X was real enough to be usable for anything, let alone be admitted to the app store and make it to the top. That's pretty awesome. Although every time I go "I didn't realize X on Y worked", it seems like games are the rationale, and not very surprisingly, since they exercise a relatively small part of the API surface apart from OpenGL. (Mono, some HTML 5 things as mobile apps, and Humble Bundle's asm.js collection all come to mind.) Can OS X take a cue from iOS and require a special Apple-signed entitlement to do this (unless root overrides it in a config file), or is it not worth the trouble? Also, does Wine actually require this in general? My understanding was that Wine needed this for legacy Windows apps that themselves map the zero page, but recent-ish apps designed for XP or later shouldn't do that, right?

glasshead969 12y ago

Looks like the latest 10.10.2 beta has them fixed. Users with access to public beta program should see the update. http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

BigChiefSmokem 12y ago

I have a serious question. I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?

slouch 12y ago
Most of these Apple computers are owned by Google users.
- epistasis 12y ago
  And a large percentage of Google devs are Apple users. Edit: for the apparent doubter of this, see any number of articles about Google's 40,000 macs that they use as dev machines, for example: https://www.usenix.org/conference/lisa13/managing-macs-google-scale https://www.usenix.org/conference/lisa13/managing-macs-googl... http://www.theregister.co.uk/2013/11/27/google_mac_support/ http://www.theregister.co.uk/2013/11/27/google_mac_support/
  - HeavenFox 12y ago
    Google Engineers mostly use their beefy workstations with a Google-flavored Ubuntu installed to code. Most engineers have Mac laptops though (at least my team), even though their use is quite limited (you cannot store code there, so mostly you have to ssh or remote desktop to your workstation) Source: worked there once
    - gst 12y ago
      Did you use an IDE via X11 forwarding? Or did you just use Vim / Emacs?
      - KerrickStaley 12y ago
        Usually NX or the like.
        12y ago

bluthru 12y ago

I don't get why Apple wouldn't be motivated to fix this ASAP for their own safety.

tedunangst 12y ago
Safety from what? The devs responsible probably believe (quite reasonably) that if there's untrusted code running local root exploits on their machine, they've already lost most of the battle.
alwillis 12y ago
It’s coming soon and is already available to testers: http://www.imore.com/latest-os-x-10102-beta-kills-google-disclosed-vulnerabilities-dead http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

Pinn2 12y ago

I have a huge ego and like more money. Is HackerOne the best way to feed both?

franciscop 12y ago

Sidenote: please do not publish re-posts, reference the original source whenever possible: http://www.zdnet.com/article/googles-project-zero-reveals-three-apple-os-x-zero-day-vulnerabilities/ http://www.zdnet.com/article/googles-project-zero-reveals-th...

cyphunk 12y ago

Is it 0day or is it not. "0day" is not an important word except that the media has started using it. For those of us working in the field, it's just a fun term, not a legal term. It is used to distinguish the risk of a bug, not the ethical handling of it. It has always been in relation to risk. The risk is greatest when it is a. unknown to anyone but a few b. unknown by a wide enough audience to effect its application c. unfixable or as yet unpatched. Some in the field call bugs fitting any one of these qualification 0days, other's not. But nearly no one in the field uses this term to quantify the ethical handling of a bug (as in: age starting from moment vendor knows about bug). Consider what a 1day is. A "1day" bug is one that looses value because it is likely that some systems have now been patched such that you as an attacker are not guaranteed that every system you touch with your exploit will fall. A 365day is likely useless, depending on the target platform. Hence, the entirety of its meaning has to do with risk, not procedure or ethics. It is fine if you read Wikipedia's definition and decide the meaning is otherwise. After all, language changes. But if anyone in the future wants to understand the etymology of the meaning behind "0day" they should consider that the meaning appears to have changed (in the minds of many that actually don't even work in the field of reverse engineering).

uniformlyrandom 12y ago

> Google's Project Zero security team revealed the existence this week of three vulnerabilities with high severity that have yet to be fixed in Apple's OS X operating system. I feel like somebody is trying to execute some kind of buffer overflow attack against my brain.

pronoiac 12y ago

Does anyone know how far back the bugs go? Mavericks, Snow Leopard?