[ insider_reports_insider ]
Mac OS X Receives Unwanted Attention
David Utter
Staff Writer
2006-11-22
 Insider Reports RSS Feed
A zero-day exploit that takes advantage of the way Mac OS X handles disk image (.dmg) files provided an exclamation point to the growing belief that security researchers are spending more time on the platform.
 | | "The Consequences of Advertising.." |  |
The exploit described by SecurityFocus comes from a recent post by the security researchers behind the Month of Kernel Bugs blog. To compromise a Mac, the user must be enticed into clicking a link in Safari to a malformed image.
Should this happen, the exploit corrupts memory and could lead to the execution of arbitrary code on the now-compromised system. Safari users can avoid this worry by deactivating the preference permitting "safe" files from being opened after download.
Enabling that preference by default is not a smart choice by Safari's developers. While it does provide convenience for Mac users who expect a completely seamless experience on their machines, this latest bug could turn what a person thinks is an innocent download into serious kernel issues, as cited by Washington Post security blogger Brian Krebs:
Sounds like an innocuous enough bug, to be sure, but the crash report generated after I used Safari to click on the file indicated that the exploit had indeed resulted in a "kernel panic," which in most cases means that if someone wanted to use the exploit to install malicious code, they could do so regardless of the security settings or precautions already present on the machine.
Apple regularly provides security updates for OS X, but due to the company having a far smaller market share than Windows in the operating system market, it does not receive the same level of attention from either the media or attackers.
That could be changing, as the underlying code to Mac OS X hails from FreeBSD, a freely available operating system that formed the core for Apple CEO Steve Jobs NeXT operating system which in turn led to the development of Mac OS X.
Security researchers have a comfort level with Unix-type systems that run on Intel-based hardware. Maybe Mac OS X users should ask for a similar comfort level from Apple when problems like the disk image flaw become known. At least Microsoft blogs about the security issues they confront.
---
Tag: Mac OS X
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
