Update: No Bluetooth 0day Vulnerability, but a New Exploit
After reviewing the materials I could find online I directly contacted Thierry Zoller and he was kind enough to respond with more details. In his words (with permission). Short version is the flaw is well patched, but the exploit is a new technique of getting a remote shell. No kernel bugs this time: Dear Rich Mogull, RM> Saw the ISC entry on your BT attacks. I’ve been writing a bit on this RM> issue and am wondering if you have any time for a couple quick RM> questions? RM> 1. Are currently patched Macs safe (OS X 10.4.8, 10.3.9)? Yes! The underflying flaw is patched since more than 1 year! I also mentioned and stressed this during my talk, that was the reason to to release the source code. HOWEVER and I also stressed this is the reason WHY this is marked as 0-day is that having a REMOTE SHELL over Bluetooth is something nobody knew and noticed, and yet it was feasable for over a year. RM> 2. Where’s the flaw- is this a device driver exploit that drops you RM> into kernel space? No, it’s a plain dumb directory traversal bug in the OBEX FTP server, Kevin used it to upload binaries/local root exploit to special directories. He then planted an Autostart using the INPUTMANAGER (a feature of MACos). Then after getting root through the local exploit (automated) he bound a RFCOMM shell to /etc/tty replacing the existing RFCOMM port 3 with an shell. And that’s it. No Kernel Space bugs demonstrated. – http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7 Share: