Book Review: Mac OS X Leopard Security

One of the interesting challenges I've faced recently in my project load was how to deal with security training for Mac OS X. While Windows and Unix training are common and easily available, the only Mac OS security training available was a pending SANS course, and a dated Apple course.

What's a security guy to do? Our Mac community is generally aware that their resistance to attacks thus far has been more based on being a smaller community than on the Mac having some mystical inherent resistance to compromise - although a few holdouts beg to differ. We have begun to see the beginnings of a Mac OS malware threat, and we have definitely seen more standard SSH compromises of systems with weak passwords.

My best solution was to identify a book to serve as a resource and as a basis for short workshops for our Mac support staff. Our staff range in expertise from hardcore Mac techs to staffers who are interested either at the hobby level, or who support a handful of random Macs in their department. Thus, the book had to cover both the basics and more advanced topics. In addition, it had to be current - many MacOS 10.3 and 10.4 books are out there, but far fewer cover 10.5.

I read reviews and flipped through quite a few books before settling on Charles Edge, William Barker, and Zack Smith's Foundations of Mac OS X Leopard Security. The book has received many positive Amazon reviews as well as a Slashdot review, and had actually been independently purchased by a couple of our campus administrators based on their own flip-throughs of the book.


What does the book offer? Well, it offered a lot of what I was looking for, including:

• GUI based instructions for most basic MacOS security topics
• Details on malware, rootkits, and
  
• User account security
• File services security
• Server security
• And a selection of advanced topics

What you don't get is a down and dirty command line level toolkit, although many command line basics are covered. The book also makes no mention of security standards and profiles such as the CIS standards. Overall though, our Mac admins have generally been impressed, and have read it closely enough that they have pointed out a couple of mistakes.

Does Foundations of Mac OS X Leopard Security replace a training class? No. But it does give the staff a ready resource and a common body of knowledge on which we can base our own discussions. I'll schedule followup discussions of specific topics as necessary, and we'll keep our eyes open for training. For the time being, I'd recommend this book to anybody needing a good primer on Mac OS security.

More Google Whacking to Detect Compromises

Tom Liston posted "Putting the ED _back_ in .EDU" on the ISC diary yesterday. I've discussed using Google Alerts to monitor institutional webspace in the past:

• Practical Security: Dealing With Drug Spam Using Google Alerts
• When CAPTCHAs fail: phpBB Drug Spam

The lessons from both remain valid - I've detected a number of webspace compromises in the past year, and continue to use Google Alerts as an easy detection method. The methodology is simple: just build a query along the lines of:

site (your site) -pdf -ppt -doc "poker" or "xanax" or "viagra" or "cialis"

Then set your alert and watch. I keep mine sorted into a unique mail folder, so all I have to do is see if that folder shows a new alert. You can end up with some false positives, particularly with the inurl directive, but in general, you'll find that this is a great tripwire for large institutional webspaces with dynamic or user generated content.

This technique can also be used to monitor for internal documents and files - simply build your search to include the search terms that are of interest for your specific site.

Hacking Time's Most Influential People poll

(Creative Commons licensed image courtesy MarilynJane)

Paul Lamere wrote a great post titled "Inside the precision hack" on his MusicMachinery blog outlining the 4chan hack of Time's influence poll. His interview with Zombocom, a 4chan /b/ denizen. The article is worth reading, as it outlines many of the common errors made in online polling applications. In the end, the most influential person is moot...

We see:

• An easily modified and adapted submission URL
• A total lack of authentication and validation
• A lack of parameter control
• A poorly protected salt once validation and authentication were included
• A poor IP restriction protocol (each candidate could only be voted on once every 13 seconds...but there were many candidates, and it supported negative votes).
• A possible work around from systems using an IPv6 stack
• No banning mechanism

All of these added up into a great opportunity for a dedicated group of people to manipulate the poll. Take a look - Lamere's writeup is great.

LastPass - Answering Security Questions The Right Way

I was recently asked to take a look at LastPass. LastPass is an interesting solution to portable secure passwords - it works as a browser plugin, and works with IE and Firefox on MacOS, Linux, and Windows. It supports one time passwords, central synchronization, and a host of other features.

What impressed me the most, however, was the level of detail that the developers provide in their forum. These former eStara staffers give some great responses, as seen in this forum discussion which is a great example of how to answer questions about a password safe program effectively.

A user asks:

"You say you never receive and you never ask but when I access to your website I do send my password...
This is even more true when I don't have the lastpass plugin installed in FF and I just log to your site."

And Joe Siegrist, one of the founding developers responds:

You don't send your master password in either case, you may want to try it yourself to convince yourself: https://lastpass.com/faq.php#howcanilook

What's done is that password field is blanked out and the value is used to make a SHA-256 hash along with your email using JavaScript, locally on your computer.

As the discussion continues, further internal technical detail is explained:

We understand your concern and would like to help you verify. The data is base64'd AES encrypted data with the 256-bit key being made up by a SHA256(username+password) username is lowecased and has whitespace removed, password is untouched. m.lastpass.com is by far the simplest version to follow this logic. I can probably make an extremely simple page that just takes username+password and encrypts and decrypts data in JavaScript if needed.

I'll continue to look at LastPass for a while, but it looks like it may well be on my list of regular recommendations in the near future.

Real MacOS Malware - Getting Over Invulnerability

A local sysadmin recently emailed me about his experience with a compromised Mac:

We recently found and removed some Mac-based malware.

The user had enabled "safe content" in Safari, (More reason to script-o-magically uncheck it as a login hook) which allowed her to download a file from a web site that Safari thought was a movie. When the file ran it was really a shell script that installed a payload into her Movies folder and assigned another shell script as a login item. Then at login she noticed the terminal would open, and then she'd close it. I presumed it was an advertising script and removed it. Interestingly enough, I just discovered that the application was actually pirating movies. The script made no attempt to elevate privileges. No passwords we asked for. It simply ran in standard user space once the user logged in.

He noted that he didn't keep a copy of the malware, and that his user wasn't sure of what she was doing when the malware ran initially. For now, keep an eye out for shell scripts in login items.

A recent survey that we conducted pointed out that a significant portion of our MacOS using community still feels that they are invulnerable. Examples like this point out that there are threats, even if they're not as common as Windows and Linux malware and compromises.

Consumers and Card Skimmers

The Consumerist has a brief writeup with some great pictures of the card skimmer that a reader found on a WAMU ATM. This sort of picture is an excellent way to help raise awareness - it looks quite persuasively real. As the reader notes, "there is a battery, flash memory card, and a mini USB port" on the back of the skimmer. Hopefully the police will set up a sting to catch the person who shows up to check the skimmer - if this were wireless it would be far more difficult to catch th perpetrator.

Death By Powerpoint: Microsoft Security Advisory 969136

We've all heard the joke about corporate meetings - "Death by PowerPoint". Microsoft's most recent security advisory however should make system administrators running older versions of PowerPoint 2000, 2002, 2003, and Office 2004 for MacOS sit up and take notice. Per the advisory, "Microsoft is investigating new reports of a vulnerability in Microsoft Office PowerPoint that could allow remote code execution if a user opens a specially crafted PowerPoint file.".

The good news is that newer versions of Office are not vulnerable, and that as usual, this only executes with the rights of the local user, and it requires users to open the PowerPoint file.

This is referenced as CVE-2009-0556, for those who would like to track it.