SecureMac, Inc.

Computer security news. Just for Macs.

Get the latest computer security news for Macs and be the first to be informed about critical updates. Industry news, security events and all you need right at your fingertips. Malware threats change daily, so keep up to date on the latest developments to help ensure your privacy and protection. You can never be too safe.

SoftwareUpdate DNS Spoof, Poisoning Exploit

Posted on July 6, 2002

Resolution

The issue described below was addressed and take resolved by Apple July 12th 2002 by adding checksums to downloads. Update to current version of Mac OS X via the software updates or visit AppleCare Document 75304

Information

Anonymous writes “I have recently been forwarded a mail from a reliable source which highlights a possible security issue with Software Update. I have not tested it myself, but both the source of the mail and the person who forwarded it are reliable and have always helped me to keep up to date with a Unix workstation…
The mail read as follows:
————————————–
MacOS X SoftwareUpdate Vulnerability.
————————————–

Date: July 6, 2002
Version: MacOS 10.1.X and possibly 10.0.X
Problem: MacOS X SoftwareUpdate connects to the SoftwareUpdate Server via HTTP with no authentication, leaving it vulnerable to attack.

————————————–

http://www.cunap.com/~hardingr/projects/osx/exploit.html

————————————–

Summary

Mac OS X includes a software updating mechanism “SoftwareUpdate”. Software update, when configured by default, checks weekly for new updates from Apple. HTTP is used with absolutely no authentication. Using well known techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to trick a user into installing a malicious program posing as an update from Apple.

Impact

Apple frequently releases updates, which are all installed as root. Exploiting this vulnerability can lead to root compromise on affected systems. These are known to include Mac OS 10.1.X and possibly 10.0.X.

Solution/Patch/Workaround

There is currently no patch available. Hopefully the release of this information will convince apple they need, at the very least, some basic authentication in SoftwareUpdate.

An exploit for this vulnerability has been released to the public for testing purposes. It is distributed as a Mac OS X package which includes DNS and ARP spoofing software. Also, it includes the cgi scripts, and apache configuration files required to impersonate the Apple SoftwareUpdatesServer.

SecureMac’s View

This has been a known issue for quite some time, we received many emails notifying us of the method Apple uses for software updates. This is something Apple needs to address to verify the software which is being installed is from their server. Checksums would work fine for this method. Keep your computer physically secure, disable remote access and this will not be a issue for you.

Join our mailing list for the latest security news and deals