Holes in Leopard's firewall
Although Apple is selling its new Mac OS X Leopard operating system on its improved security, researchers at Heise Security have already found fault with its firewall. Unlike with Windows Vista, the Apple firewall is not enabled by default and must be enabled by the end user. Even if you had the firewall enabled in a previous version of the Mac OS X, after an upgrade to Leopard the firewall will again be set to "Allow all incoming connections." It will be disabled.
According to Jürgen Schmidt, editor in chief at Heise Security, if you enable the Apple firewall and set it to "Block all incoming connections," access from the Internet to certain internal system services will still be allowed. As an example, he said that his team was able to query the NetBIOS Naming Service over a Lan network even with full blocking enabled. The team was also unable to specifically enable UDP filtering within Leopard, which should block access to NetBIOS.
Schmidt also faulted Apple for not including the latest versions of open-source applications within Leopard. In August, Charles Miller of Independent Security Evaluators noted the same at the annual Black Hat conference in Las Vegas. The expectation over the summer had been that Leopard would include the most recent version of several open-source applications and protocols.
Within Leopard, Schmidt noted that Apple ships ntpd 4.2.2, while the latest version is 4.2.4, although he admits that it is unclear whether there are any exploitable vulnerabilities here.
That's not the case with Samba, a primary networking protocol. Over the summer Apple did update its Samba package, but not to the most recent version. Leopard ships with version 3.0.025b (same as Tiger). The more recent releases of Samaba, 3.0.25c and 3.0.26a, do include several known bug fixes so it is unclear why Apple did not update Samba within Leopard.
Apple has a longstanding policy about not commenting in public on issues regarding the security of its products.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
This is *clearly* Microsoft's fault.
;)
Companies need to take responsibility for themselves period.
is "immune to virus, trojans, malware, etc" is one that is still in the
box. - and under armed guard.
OS X will eventually be successfully attacked. Every OS so far has
been, with the possible exception of OS/400.
the point of being unusable like Vista does. And most of us don't
even have to upgrade their HW to run it.
And if the playing field was level Windows would not be almost a
monopoly. And I am not talking OS X here.
revert the firewall back to off. Probably a mistake overall.
If Leopard trusts the app/service (which is either trusted via cryptographic signature or by being initiated by the root user), it gets network access. Otherwise, it simply does not.
Simply put - in order to break in, you either have to have the cryptographic trust, or you already have to know the local machine's root password.
And BTW - for the truly paranoid, the traditional firewall is sitting there in System Preferences, where you can turn it on at any time after installation. This will give you twice the protection that Vista could ever hope to give in its current state.
==========
Second Up - The title is misleading, the content is misleading (and inaccurate, and incomplete), and Heise is more used to pure *nix, where iptables/ipf trumps all. Things are a bit more nuanced nowadays, so call me when/if (most likely "if") someone manages to actually break into a Leopard machine, 'kay?
=========
Meanwhile, anyone who doesn't have a home firewall appliance (not the one from the cable/DSL company, the one you buy and put in between the cable/DSL modem and your computers) deserves what they get by now *shrug*.
It's called "defense in depth", and maybe more than just some people will get a clue and practice it?
/P
you security updates. I remember the iphone had flaws where
people were getting their info taken. its better to be safe than
sorry. Steve Woz said that OS 10 had some security flaws that were
not around in OS 9.
I'm confused here. Should people run a firewall or not? Software or hardware? Your comments in the past contradict what you're saying here. A clarification of your stand on firewalls and security would be appreciated to avoid confusion in the future.
What "major" titles are you referring to? All my applications are working. Such as Adobe PhotoShop, Firefox, Transmit, Final Cut Pro, Yahoo IM, World of Warcraft and including my not so major ones like BluePhoneElite and other shareware.
And not faster? I think it is faster. What is your source?
Mac OS X is not perfect, but lets not forget there is still not one virus for OS X in its seven year history.
(not a virus, but still bad)
exceptions by opening up ports to allow file sharing, screen
sharing, Skype, et.
I don't have Leopard yet, but I don't see Apple changing that,
Here is what Apple says,
"Mac OS X includes firewall software you can use to block
unwanted network communication with your computer. Using a
firewall protects your computer from users on other networks or
the Internet.
In order to use Mac OS X services, such as personal file sharing,
Windows sharing, or FTP access, you need to open ports in the
firewall to allow traffic for that service to and from your
computer. When you select a service in the Services pane of
Sharing preferences, it is automatically selected in the Firewall
pane, and the port is opened."
As it says, these ports are closed unless you open them.
people were getting their info taken.
No, you remember flaws which could have potentially been used
for this purpose. At no stage was this ever actually 'in the wild' (not
that it's OK of course, but there is a difference).
traffic, it was hosting a webserver, and was dugg, slashdotted and
reddited all at the same time.
Well, duh, that's because netbios is DISABLED by default in OS X. You have to turn it ON. When you do, OS X is smart enough to know that you would probably like the firewall to open a port to this service, since you JUST TURNED IT ON and so does that for you automatically when you turn on the firewall.
Classic FUD.
No one thinks that OS-X or Linux are imposable to hack or write a virus for. It is just that Windows is effectively defenseless.
From time to time hackers have contests to see who can break into more systems or deface more websites (Please don't ask me how I know.). Different point values are given to different operating systems.
Linux or other Unix operating systems will give you one point. OS-X will give you 3 or 4. You don't get any points for hacking Windows. It is like shooting a 30 foot picture of a fish in a barrel with a shotgun from five feet away (Nothing to brag about).
vulnerabilities?! If you roll down the windows and leave the keys in the
ignition your car may get stolen, too. But if you leave OS X's settings alone,
usie the default mode that 99% of Apple users run, you're safe.
Maybe you could run another Mac Attack contest, and change this security
setting, too. Then you may finally give away those MacBooks and the 10
grand you never paid out from the last "successful" attack.
OS X and Apple is simply better. Heck, Apple and Vista is simply better -
take a look at PC Magazines latest Windows speed tests!
It's time to give it up. Either go to journalism school, fold your tent, or
simply rebrand yourself Microsoft. You're a laughingstock as it now stands.
What is interesting though is that when I ran my own nmap port
scan (sudo nmap -sU ipaddress - the same that they ran) on a
MacBook that I own and I got this: All 1488 scanned ports on
xx.x.x.x are open|filtered.
According to nmap documentation:
open|filtered
Nmap places ports in this state when it is unable to determine
whether a port is open or filtered. This occurs for scan types in
which open ports give no response. The lack of response could
also mean that a packet filter dropped the probe or any
response it elicited. So Nmap does not know for sure whether
the port is open or being filtered. The UDP, IP protocol, FIN, null,
and Xmas scans classify ports this way.
It interesting that I should get a different result???
I'm trying to see where the Firewall settings are left open by default. I don't see it in Leopard. Could it be that such was the setting imported from the tester's Tiger install? It would be useful if journalists could ask such questions or address them -- you know, the simple stuff: what settings are wide open or 'vulnerable' to a system with a clean install, not a migrated package adopting bad user habits from the prior system. Alas, these journalists can't be bothered with details. Cnet -- hire someone who can ask better questions and write more complete answers. The rest (be it Mac, Windows, Linux, Commodore64) is all FUD.
Believe me, don't be that kind of bird that sticks its head in a hole and says....nothings happening outside because I can't see it.
- by geo11101 January 21, 2009 2:57 AM PST
- Eric Schmidt is the biggest Mafia puppet in the US. He is bad news for apple users. http://endmafia.com
- Reply to this comment
-
(59 Comments)