Design, Code, Business, FileMaker, Simplicity, and more.

Mac OS X Trojan Threat

Saturday, April 9th, 2005

In keeping track of the pulse of the Mac OS X Security updates, I recently found c/o Wishingline.com which found a security bug c/o Security Focus, a recent discovery of a possible exploit in OS X whereby a user can gain Admin access. I’ve quoted the post below:

The Bug
The bug involves an application gaining root privileges by not having to explicitly authenticate itself due to the 5 minute sudo authentication window — you don’t have to re-authenticate within a 5 minute period of authenticating as an admin user. There’s also a problem related to where the authentication attempts are logged being readable by all users on the system, not just admin users.
The Fix

Fire up the Terminal application - this one is all command-line.

  • Open up the sudoers file in a new window via: sudo pico /etc/sudoers.
  • Go to the Defaults section of the file and add the following bits:

    Defaults:ALL !syslog
    Defaults:ALL logfile=/var/log/secure.log
    Defaults:ALL timestamp_timeout=0
    Defaults:ALL tty_tickets

    Adding these items will change where authentication attempts are logged, the sudo timeout will be set to zero instead of the 5-minute default and the password grace period will be set to a local tty session and not globally.

  • Save the file and run the next command to verify your changes: sudo visudo -c.

You can now rest a little more securely. Let’s hope Apple does something about this in one of the upcoming updates (10.3.9 or Tiger).
Update

I meant to reiterate that this is not an active problem in any way at this point in time. There’s no need to panic or overreact…

OS X Insecurity

Sunday, March 6th, 2005

I stumbled across this whitepaper, written by Angelo Laub, which discusses some of the insidious things that can be done to unwitting users of Mac OS X. Laub speaks of possibilities of nefarious uses of Single-User Mode and FireWire when booting an OS X machine, disguised executables, and more. Any time you can run a Unix Terminal prompt, any determined and well-educated hacker can engineer their way unto your system.

I have oodles of faith in Apple on the notes of security. No operating system is perfect, OS X certainly isn’t, but it works well and doesn’t have the myriad of inter and intra application communication tools that make Windows far more daunting in securing. Nonetheless, the paper is worth a read, if even for educational purposes only.

New PeachPit Book: Visual Quickstart to OS X Server

Friday, February 25th, 2005

Slashdot recently reported that Peachpit Press has put out a new book on installing, managing, and maintaining an installation of OS X Server aptly titled Mac OS X Server 10.3 Panther : Visual QuickPro Guide (Visual Quickpro Guide) (link to Amazon). Mary Norbury-Glaser writes a review for Slashdot, viewable in full here, and quoted below:

PeachPit Press labels Mac OS X Server 10.3 Panther as intended for those readers with intermediate to advanced OS X Server experience, but this is not accurate. The step-wise instruction provided by Regan and White is richly documented with screenshots, so even those new to OS X Server can follow this book. Intermediate or advanced server admins will find some nice “tips and tricks” to add to their arsenal of tools, and if they’re preparing to set up their first OS X Server or XServe, they’ll find this book a handy companion to “pre-lab” with and to use as a follow along guide.

In less than 20 pages, Chapter 1 takes the reader through planning his or her OS X Server deployment with an overview of partitioning options, various methods of installation and a tour of post-install logs. This is Regan’s “20-pages-of-prep/20-minutes-to-install” chapter; concise, exact and representative of the pace and caliber of the chapters that follow.

Chapter 2, “Server Tools”, covers the aftermath of the install; how to use the Server Administration software that comes with OS X Server to configure the server. The authors walk through language choices, network interfaces, administrator account setup, directory service and service startup options. The Server Admin and Workgroup Manager tools are also discussed in detail; how to customize Server Admin preferences, how to use Workgroup Manager preferences (resolve DNS, use SSL for sharing, show system users and groups) and how to add users to the local database. The Server Admin tool is the most used utility in OS X Server. It offers a well-designed GUI to manage all your services as well as preferences and advanced options. If you’re upgrading from AppleShare IP, you’ll want to look at the section on using the AppleShare IP Migration tool to ease the transition to OS X Panther Server. An overview of the Macintosh Manager follows, for support of Mac OS 9 user preferences. The chapter concludes with a brief introduction to additional server tools: MySQL Manager, using Server Monitor, the RAID Admin Tool, the Network Image Utility, the QTSS (QuickTime Streaming Server) Publisher and the QuickTime Broadcaster (the last two are discussed in greater detail in Chapter 12).

Implementing Open Directory is the focus of Chapter 3, but the actual implementation steps are prefaced by a strong discussion of directory services.

The final chapter of the book concentrates on client management and how to implement managed preferences to workgroups, computer lists or individual user accounts. This, of course, is every administrator’s dream: to manage and control clients from a centralized environment! The authors show that OS X Server provides excellent management options and with a bit of planning and foresight, an administrator can properly configure their OS X Server tools to provide a balance of efficiency and control.

So what’s missing? Not much, really. VPN is not covered at all, though, and I would have liked a section on this. VPN is a real necessity not only for remote employees/students but also for the administrator. But sheesh — that’s a small complaint given the amount of information in this book, and I have to applaud the authors for their ability to combine such detailed instructions on nearly every aspect of OS X Server between two covers.

The book follows the classic Visual QuickPro Guide layout, with each page split into two columns to allow for instructional text situated alongside accompanying screenshots. This book is loaded with screenshots and icon graphics, so the reader will miss nary a step while following along on their test box or their production server. There are even pictures of the progress bar as configuration settings are being applied! (Well, sometimes patience needs to be encouraged.) Chapter subtopics are indicated on the binding of the book with gray thumb tabs. Extended information and digressions are highlighted in gray boxes as logical asides.

Everything about this book is designed to guide the reader through every aspect of the installation and configuration of OS X server. The authors provide clear explanations of each step using a task-based approach with extended discussions on the various choices the server presents the user with at appropriate intervals. There are plenty of real world “tips and tricks” that will save the administrator time and anguish over the course of setting up the server. Regan and White address some of the most difficult to comprehend topics and issues an admin will address: multi-platform environments and file sharing, DNS, Open Directory and security. Fully understanding these subjects is critical to making the correct choices while configuring the server. The authors’ thorough discourse provides the reader with the knowledge and tools to get the job done.

Mary Norbury-Glaser is an IT Director at a University of Colorado Health Sciences affiliate center in Denver. Working in a multi-platform academic environment dominated by Windows boxes, she sometimes feels like the Mac Maytag Lady.

Apple Releases Security Update

Wednesday, February 23rd, 2005

Apple on Tuesday released Security Update 2005-002. This update covers installations of Mac OS X that use Java 1.4.2. The update is available for download through the Software Update system preference pane, and is also available for download from Apple’s Web site.

According to information posted on Apple’s Web site, this update corrects an issue “where an untrusted applet could gain elevated privileges and potentially execute arbitrary code.”

Apple describes the problem as related to a vulnerability in the Java plug-in. The exploit works through JavaScript “calling into Java code, including reading and writing files with the privileges of the user running the applet. Releases prior to Java 1.4.2 on Mac OS X are not affected by this vulnerability.”

Further information about this vulnerability is available in Document ID 57591 from Sun.

Apple’s update makes changes to the following files:

Java Web Start
JavaPluginCocoa.bundle
JavaScriptCore
Core Java classes

FileMaker 7, Security, & Cornell University

Wednesday, February 23rd, 2005

FileMaker recentlyposted an article/story detailing an installation and upgrade of a FM 7 system for Cornell University. While I wish they would pass along screenshots of the solution, just out of curiousity, I understand why they don’t.

Click here to go to the story

Follow The Bouncing Malware

Tuesday, February 15th, 2005

The Internet Storm Watch Center at sans.org has a fascinating article following the trace of some bouncing malware. It’s interesting to see how these malware authors hide the code and links within Javascript that inevitably trace to reconfiguring a users settings in Internet Explorer. For the platform evangelists reading this, note that this is a PC exploit.