For some reason I think I often end up the middle on some of these vulnerability issues; trying to bring reasonable advice to both technical and less-technical users on hyped security issues.
Here’s another one.
The Month of Kernel Bugs project released a new flaw affecting Macs- it’s a flaw in disk image files that crashes the system. Right now we don’t know for sure if it could allow someone to take over your computer, but I promise you that this class of attacks will, if not now, eventually let someone else take over your system. There is also an unconfirmed report this may be in the wild.
DMG files are, to be blunt, the single most likely vector for a rapidly spreading Mac virus.
We talked a little about this in our first post on kernel bugs. Because of how OS X manages disk image files, if you mount a malicious disk image (even if you don’t run anything inside of it) an attacker could take over your system. This is a kernel flaw- so you don’t need to be running as root or with administrator privileges. The attacker will totally own your system, and can use it, just as Windows systems are commonly used, to attack your friends and associates. A really nasty attacker might even do some nasty things like try and identify other Mac users based on their address book settings or by trolling your inbox for Mac-formatted emails.
Yep- I’m using hyperbole, because I want you to take this seriously.
Matasano has a great write up on this. I disagree that disk images are always a bad idea since I’ve found them really useful, but do agree they are a royal pain in the rear to secure. I also think Gruber is taking this more seriously than they give him credit for, yet considering his influence on the Mac community I hope he takes it even more seriously.
Because of how disk images work they are far more likely to allow someone to take over your computer than other file types on a Mac. Here’s my advice for other Mac users:
- As many recommend, turn off Safari’s “Open safe files after downloading” preference.
- Don’t download any DMG file from an untrusted source.
- Never open a DMG file emailed or IMd to you from someone you know unless you were expecting it. That’s how a mass exploit will work.
- Apple should require admin privileges to open a disk image in future versions of the OS, or design some other mechanism to prevent kernel panics (e.g. virtualization or something similar). Yes, this is an inconvenience, but since we’re talking about a file format that will be nearly impossible to secure, yet is valuable to us as users, additional steps should be taken.
There’s no need to panic, but we do need to take this very seriously. This won’t be the last we hear about this kind of problem.
Comments