Google discloses three severe vulnerabilities in Apple OS X

http://www.cnet.com/news/google-team-finds-three-severe-vulnerabilities-in-apple-os-x/

by bhauer • 12 years ago

351 133 12 years ago

cnet.com

mc32• 12 years ago

Does anyone know if they only research os and os environment bugs or also cisco juniper os bugs as well for example?

jpetra• 12 years ago

This is from the Project Zero announcement post:

"We're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers."

http://googleonlinesecurity.blogspot.com/2014/07/announcing-...

adr_• 12 years ago

https://code.google.com/p/google-security-research/issues/li...

They haven't published Cisco bugs, but they do have a pretty broad scope.

xaqfox• 12 years ago

I also wonder if they publish proof of concepts for security bugs they refuse to fix (e.g. in Android 4.3).

giovannibajo14• 12 years ago

They said they also investigate on Android, but they haven't yet published a single vulnerability for it, as far as I can tell.

Oletros5• 12 years ago

Was the security bug discovered by Project Zero team?

chc• 12 years ago

These bugs appear to be for Yosemite, so they might only look at bugs present in the latest version of the software.

izacus• 12 years ago

I doubt they're wasting time with bugs in OS X 10.5 either.

cheald6• 12 years ago

Tech journalists insisting on calling these "zero-days" (which, to its credit, CNet changed, though Ars and ZDNet are guilty of it) is really kind of irritating.

A zero-day is, by definition, an exploit that the vendor has had zero days to react to. It's not just an unpatched vulnerability with a proof of concept exploit available for it.

Apple has been aware of these issues since October.

arjunnarayan• 12 years ago

This is correct. Strictly speaking, its a 90 day.

cyphunk4• 12 years ago

I disagree with this interpretation. It remains 0 day until it is patched or has a work around (disabling the service). Further still the date aging starts begins when the bug is disclosed publicly, or broadly if not publicly. Internal disclosure doesn't count. It remains 0day even if you share it with a friend. The measurement of days has to do with its usefulness (to an attacker) and that begins to diminish after wide disclosure. Then again, the term is also completely irrelevant.

gojomo3• 12 years ago

As a term, it's prone to confusion. Many use 'zero-day' to refer to vulnerabilities that are publicly-known before a patch is available. That is, the figurative 'zero day' counter starts from public disclosure, not disclosure-to-vendor.

Because bugs can't be fixed in zero time, and most readers are interested in the practical matter of whether there is a window of unpatched widespread vulnerability, this public-disclosure-focused definition may in fact be more useful.

cheald6• 12 years ago

vulnerabilities that are publicly-known before a patch is available

We already have a term for that, though: "unpatched vulnerabilities". Using the term "zero-day" erroneously communicates to the reader that Google surprised Apple et al with this thing out of the blue, and just handed crackers the tools to start exploiting it without giving Apple time to develop countermeasures.

spyder• 12 years ago

I don't think 'zero-day' has anything to do with public knowledge. A hacker can find a vulnerability and exploit it without publicly revealing it and it would be still a zero-day, because the vendor had zero days to fix it.

dingaling• 12 years ago

That is, the figurative 'zero day' counter starts from public disclosure, not disclosure-to-vendor.

And which derives from its original usage in the late 1990s warez scene. A 0-day licensing crack was one available on the same day a new product hit the market. Many reputations were built on achieving this.

BryantD• 12 years ago

I agree that tech journalists are at fault here. It might also help if Google wasn't calling this Project Zero.

cheald6• 12 years ago

Heh, I think that's valid. Though IIRC Project Zero is called that because their mission is specifically to eliminate zero-days - that is, find and disclose them to vendors before the bad guys start using them.

darkarmani• 12 years ago

I think you are confused with "zero-day exploit". They are calling it a "zero-day vulnerability," but i'm not sure what that even means.

pbreit• 12 years ago

I'm assuming they communicate these privately to the vulnerable party prior to publicizing?

iancarroll• 12 years ago

They gave them 90 days to publish a fix.

sigzero• 11 years ago

And that fix in the latest beta. So it is coming.

Oletros5• 12 years ago

Yes, they do, 90 days before disclosing them

Oletros5• 12 years ago

It seems that someone is pissed off

jafingi• 12 years ago

Yes. Google releases it after a 90-day grace period. So Apple has known about it for a while.

rosser• 12 years ago

FTFA: "The vulnerabilities were reported to Apple back in October but the flaws have not been fixed. After 90 days, details of vulnerabilities found by Project Zero are automatically released to the public -- which is what happened this week."

FireBeyond2• 12 years ago

I will be curious, as a litmus test, to see how perception of this varies in the community to the Microsoft release.

That was a mixed bag - with support on both sides of the aisles, some decrying Patch Tuesday, some in support.

What will happen here? Will Google be lauded for consistency, or castigated for not "working more closely" with Apple (for varying definitions of "working closely", up to and including potentially delaying disclosure around arbitrary timelines)?

cheald6• 12 years ago

I'm wholly in support of Google here. Apple has a history of letting known vulnerabilities persist for years (ie, http://krebsonsecurity.com/2011/11/apple-took-3-years-to-fix...) without fixes.

dzhiurgis• 12 years ago

Google is exploiting MS and Apple update release processes.

Both were published days before update schedule.

olssy• 12 years ago

From what I can tell one of the exploits allows for code execution with root privileges, another for accessing kernel-space memory and the third will crash the machine. Are any of these things not already doable when someone has physical access to the machine?

cheald6• 12 years ago

They aren't remote code execution exploits as best as I can tell. But, it's a short leap from an exploitable root escalation to total compromise of a machine. Until these are patched, any executable you download and run could potentially be a dropper for much nastier stuff. You could combine one of these with the recently-disclosed Flash exploits, for example, and you have a drive-by root exploit ready for deployment via ad networks to millions of people.

tptacek• 12 years ago

They're not doable from random programs downloaded from the Internet, except via these flaws.

IBM• 12 years ago

It's fixed in the latest beta.

http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

geofft9• 12 years ago

How is it possible in 2015 that major kernels are vulnerable to arbitrary code execution via null pointer dereference?

Leave aside memory safety, input validation, actually caring about the quality of your work, whatever. mmap_min_addr stopped a ton of attacks back in like 2007-10 when Linux had a local privilege escalation-of-the-month (and RHEL, which hadn't enabled it yet for backwards-compatibility concerns, got hit more frequently). It's not a particularly aesthetically-pleasing solution, but it's an effective one.

Are there legacy apps on OS X that require mapping the zero page? Executable? That Apple cares about supporting?

I've run into two things on Linux that need to map the zero page: versions of MIT Scheme from before 2009 (because the compiler was doing something super weird), and Wine, when running certain DOS / Windows 3.1 apps. Anything of that era probably stopped working on OS X when they killed Classic. Even Carbon has been dead for three years.

https://wiki.debian.org/mmap_min_addr

https://access.redhat.com/articles/20484

mmarks• 12 years ago

> Even Carbon has been dead for three years. <<<

With regard to only this point, probably half if not more of the the top 15 grossing games on the Mac AppStore Games page today are either Carbon Apps or at minimum require the Carbon framework.

daniel02216• 12 years ago

And a bunch of those are using Wine, which requires mapping code at the zero page, so they're compiled with a special load command that allows them to map the zero page.

On Yosemite, 64-bit binaries aren't allowed to do this.

mzs• 12 years ago

https://code.google.com/p/google-security-research/issues/de...

That was a kernel null dereference, it really has nothing to do with creating a mach-o that puts code in the first page and there are valid reasons to do it, SheepShaver and BasilliskII come to mind.

geofft9• 12 years ago

Right, the null pointer gets dereferenced in the kernel, but (assuming I'm understanding the report right) the means of exploitation is to create a userspace memory mapping with something mapped at address zero, and cause the kernel to read from that address / run code at that address instead of faulting when it tries to dereference NULL. The PoC code is userspace and does this:

         //map NULL page
         vm_deallocate(mach_task_self(), 0x0, 0x1000);
         addr = 0;
         vm_allocate(mach_task_self(), &addr, 0x1000, 0);
         char* np = 0;
         for (int i = 0; i < 0x1000; i++){
           np[i] = 'A';
         }

Am I misinterpreting this?

Re SheepShaver and Basilisk II, those are non-Mac apps, and at least on Linux, there's no requirement for an emulator (like qemu) to map address zero in the host to offer a usable zero page in the guest; it's a convenience depending on how you write the emulator, but it's by no means needed. I don't think this is true of other host platforms either, but I'm less familiar with those.

Animats2• 12 years ago

How is it possible in 2015 that major kernels are vulnerable to arbitrary code execution via null pointer dereference?

Because they're monolithic, bloated, and written in C.

(Rust guys, please don't screw up. We need a win there.)

microtonal2• 12 years ago

(Rust guys, please don't screw up. We need a win there.)

While it's true that Rust would help here, it is very unlikely that a Rust kernel project would get as far as e.g. Linux and let alone replace it.

Of course, rewriting and existing kernel stepwise would be interesting, if possible.

denim_chicken• 12 years ago

Such naivety.

istvan__2• 11 years ago

Unfortunately Rust itself has limited space to secure a kernel. We need a major change in operating systems to have a safer environment that is not trivial to exploit.

My list goes as:

- kernel memory and userspace memory is hardware separated as it was originally with some early architectures

More about it here: http://phrack.org/issues/64/6.html#article

- microkernels

Having a formally verified ring0 execution block and everything else is running in a less privileged space, this would allow kernels to protect themselves against bad drivers and other parts of the operating system that can be used as attack surface today

- safe userland

this is I guess where Rust could help the most, having a memory safe low level language

microcolonel2• 11 years ago

I'm setting up a system with SeL4.

None of the systems you're suggesting have formal proofs of correctness, and this one not only has such proofs, but is written in C.

josephpmay• 12 years ago

Could this be solved by writing an operating system in Rust?

geofft9• 11 years ago

Yes, mostly, although that's a fairly big undertaking, and any code you have that uses unsafe blocks, or legacy C code (think proprietary drivers), or the like is going to be a weakness. mmap_min_addr is a mitigation measure, by saying, OK maybe we'll dereference NULL sometimes, but we're going to make totally sure that there's nothing mapped there, and certainly nothing that userspace put there. So if we do dereference null, it's just a crash, not execution of userspace-provided code in kernelspace.

And it's the sort of thing that you can turn on in an existing kernel. Rewriting the whole kernel in Rust is a major (but worthwhile) project; adding this restriction is, in its simplest form, just adding `if (addr < 4096) return -EFAULT` to the page-allocation routine. As another commenter pointed out, OS X does have this restriction for 64-bit binaries now.

glasshead969• 12 years ago

Looks like the latest 10.10.2 beta has them fixed. Users with access to public beta program should see the update.

http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

BigChiefSmokem2• 12 years ago

I have a serious question.

I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?

slouch• 12 years ago

Most of these Apple computers are owned by Google users.

epistasis• 12 years ago

And a large percentage of Google devs are Apple users.

Edit: for the apparent doubter of this, see any number of articles about Google's 40,000 macs that they use as dev machines, for example: https://www.usenix.org/conference/lisa13/managing-macs-googl... http://www.theregister.co.uk/2013/11/27/google_mac_support/

notatoad2• 12 years ago

Google's ads are so pervasive that they make money for just about every minute you use the internet. If your computer is infested with viruses you might turn it off and go outside, therefore it's in Google's best interests to invest in general computer security.

stevenh• 12 years ago

Google makes money off of ads.

A common monetization method used by malware distributors is to secretly replace legitimate ads that get loaded on the machine (such as Google's) with their own.

Doing this on every single web page visited by that machine for the rest of its existence, and multiplying that by hundreds of thousands of other infected machines out there, and multiplying THAT by the dozens of different black hat groups doing this simultaneously, it adds up to a lot of lost money for Google.

BigChiefSmokem2• 12 years ago

I understand the ad thing but that idea applies to all software companies (because they want their own browsers and operating systems used by users), not just Google.

To me it feels like they're throwing their competitors under the bus in this way as opposed to running slander campaigns or witty commercials like Samsung, Microsoft, and Apple do. I'm not saying this is their intention but that is the way it comes off and it cannot be good for their reputation.

A non-profit organization funded by the entire tech industry would have more credibility.

rtpg• 12 years ago

good PR?

Not everything has to be directly linked to selling ads, Google is a group of people. Some companies plant trees, Google has this, I guess.

tedunangst3• 12 years ago

Project Zero appears to be generating mostly negative PR for Google (and MS and Apple). From a wider public perception standpoint, it's almost lose-lose all around.

joncp• 12 years ago

Maybe it's their way of fighting the Man. They're compelled, almost by force, to cooperate with the US and other governments in spying on their users. This seems like a way to offset that ethical load by taking away some of the tools those bad actors use as weapons. I know I'd do it if I were in their shoes.

GFK_of_xmaspast• 11 years ago

They are The Man.

ratsbane• 12 years ago

"Don't be evil" means that sometimes you should do things for the good of the community without expectation of direct rewards. Maybe I'm idealistic and naive but I think that Google tries to live up to that.

pjmlp6• 11 years ago

Were they following that when they closed all < 4.4 Android bugs?

Too• 12 years ago

They get a valid excuse for reverse engineering their competitors products so they can copy their technology.

Oletros5• 12 years ago

Sometimes is difficult to catch the sarcasm, because it is sarcastic, isn't?

geofft9• 12 years ago

I can think of a few:

1. Google uses Mac OS and Windows internally, they're a big enough company that even untargeted malware that hits a small percentage of systems costs them money (not to mention targeted malware), and they're also a big enough company that the amortized cost of Project Zero, across all employees, is affordable.

2. The top-notch researchers who find vulnerabilities in their server stack (Linux, etc.) also like looking at different OSes occasionally, and this is a way of recruiting and keeping them at Google, which leads to them disclosing and fixing Linux security issues internally while waiting on an external response.

3. They're unhappy with their software vendors not taking security and vulnerability response seriously, and they're trying to shift the popular consensus / Overton window on how seriously people should care and what the industry-standard response to reports should be.

bluthru• 12 years ago

I don't get why Apple wouldn't be motivated to fix this ASAP for their own safety.

tedunangst3• 12 years ago

Safety from what? The devs responsible probably believe (quite reasonably) that if there's untrusted code running local root exploits on their machine, they've already lost most of the battle.

alwillis• 12 years ago

It’s coming soon and is already available to testers: http://www.imore.com/latest-os-x-10102-beta-kills-google-dis...

Pinn2• 12 years ago

I have a huge ego and like more money. Is HackerOne the best way to feed both?

franciscop• 12 years ago

Sidenote: please do not publish re-posts, reference the original source whenever possible: http://www.zdnet.com/article/googles-project-zero-reveals-th...

cyphunk4• 12 years ago

Is it 0day or is it not. "0day" is not an important word except that the media has started using it. For those of us working in the field, it's just a fun term, not a legal term. It is used to distinguish the risk of a bug, not the ethical handling of it. It has always been in relation to risk. The risk is greatest when it is a. unknown to anyone but a few b. unknown by a wide enough audience to effect its application c. unfixable or as yet unpatched. Some in the field call bugs fitting any one of these qualification 0days, other's not. But nearly no one in the field uses this term to quantify the ethical handling of a bug (as in: age starting from moment vendor knows about bug).

Consider what a 1day is. A "1day" bug is one that looses value because it is likely that some systems have now been patched such that you as an attacker are not guaranteed that every system you touch with your exploit will fall. A 365day is likely useless, depending on the target platform. Hence, the entirety of its meaning has to do with risk, not procedure or ethics.

It is fine if you read Wikipedia's definition and decide the meaning is otherwise. After all, language changes. But if anyone in the future wants to understand the etymology of the meaning behind "0day" they should consider that the meaning appears to have changed (in the minds of many that actually don't even work in the field of reverse engineering).

uniformlyrandom• 12 years ago

Google's Project Zero security team revealed the existence this week of three vulnerabilities with high severity that have yet to be fixed in Apple's OS X operating system.

I feel like somebody is trying to execute some kind of buffer overflow attack against my brain.

pronoiac• 11 years ago

Does anyone know how far back the bugs go? Mavericks, Snow Leopard?

Google discloses three severe vulnerabilities in Apple OS X

Related Stories