SoftwareUpdate DNS Spoof, Poisoning Exploit
Resolution
The issue described below was addressed and take resolved by Apple July 12th 2002 by adding checksums to downloads. Update to current version of Mac OS X via the software updates or visit AppleCare Document 75304
Information
Anonymous writes “I have recently been forwarded a mail from a reliable source which highlights a possible security issue with Software Update. I have not tested it myself, but both the source of the mail and the person who forwarded it are reliable and have always helped me to keep up to date with a Unix workstation…
The mail read as follows:
————————————–
MacOS X SoftwareUpdate Vulnerability.
————————————–
Date: July 6, 2002
Version: MacOS 10.1.X and possibly 10.0.X
Problem: MacOS X SoftwareUpdate connects to the SoftwareUpdate Server via HTTP with no authentication, leaving it vulnerable to attack.
————————————–
http://www.cunap.com/~hardingr/projects/osx/exploit.html
————————————–
Summary
Mac OS X includes a software updating mechanism “SoftwareUpdate”. Software update, when configured by default, checks weekly for new updates from Apple. HTTP is used with absolutely no authentication. Using well known techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to trick a user into installing a malicious program posing as an update from Apple.
Impact
Apple frequently releases updates, which are all installed as root. Exploiting this vulnerability can lead to root compromise on affected systems. These are known to include Mac OS 10.1.X and possibly 10.0.X.
Solution/Patch/Workaround
There is currently no patch available. Hopefully the release of this information will convince apple they need, at the very least, some basic authentication in SoftwareUpdate.
An exploit for this vulnerability has been released to the public for testing purposes. It is distributed as a Mac OS X package which includes DNS and ARP spoofing software. Also, it includes the cgi scripts, and apache configuration files required to impersonate the Apple SoftwareUpdatesServer.
SecureMac’s View
This has been a known issue for quite some time, we received many emails notifying us of the method Apple uses for software updates. This is something Apple needs to address to verify the software which is being installed is from their server. Checksums would work fine for this method. Keep your computer physically secure, disable remote access and this will not be a issue for you.
