April 17th, 2014

OSX update service MITM attack

It looks like there is a fairly serious security vulnerability/exploit/patch released for OSX. Among other things, arbitrary commands can be trivially run on any OSX client with a man in the middle attack to the update service. There is a patch, but exploit code is already publicly available for metasploit, so I’d suggest not patching over any insecure connections, ;)

The security update also contains fixes for about a dozen other things within OSX as well. I’m pretty surprised that the OSX update service doesn’t (didn’t?) use any type of certificate or other methods for server authentication. Several other projects (firefox, debian, etc) have had issues with this in the past, but have been subsequently fixed. It does appear that Apple responded very quickly to the the notice (initial notice was on 12/6), but this seems like one of those “by design” vulnerabilities, so I’d have to guess they’ve known about it for a while.

If I wasn’t stuck writing reports tonight instead of hacking, I’d try to put together a quick script for AirPwn. It looks like you just need to intercept/inject a couple of http connections to swscan.apple.com. It makes a request to get a catalog file (“.sucatalog”), which is just an xml file that references a distribution xml that contains the packages (payload).

17 Responses to 'OSX update service MITM attack'

  1. 1kuran meali
    January 31st, 2008 at 5:15 am

    OSX update service MITM attack very good im update

    thank you midnightresearch :)


  2. 2tommy andersson
    December 18th, 2012 at 7:48 am

    Hello, Neat post. There is an issue along with your site in internet explorer, might check this? IE nonetheless is the market chief and a huge component of other people will leave out your fantastic writing because of this problem.


  3. 3binary options
    January 16th, 2013 at 2:59 pm

    There are some interesting cut-off dates in this article however I don’t know if I see all of them heart to heart. There’s some validity but I will take maintain opinion till I look into it further. Good article , thanks and we wish more! Added to FeedBurner as properly


  4. 4zijaextreme.com
    February 8th, 2013 at 3:30 pm

    Hi” i think which you should add captcha for your blog.


  5. 5Hosea Kamiya
    April 9th, 2013 at 9:11 pm

    Hi there, simply become aware of your weblog via Google, and found that it is truly informative. I am gonna watch out for brussels. I’ll be grateful when you continue this in future. Numerous other folks will likely be benefited out of your writing. Cheers!


  6. 6mocne katalogi stron
    April 9th, 2013 at 9:27 pm

    I’m shocked how good this blog is.


  7. 7Jacinto Mccloy
    April 9th, 2013 at 9:27 pm

    Hey would you mind sharing which blog platform you’re working with? I’m going to start my own blog soon but I’m having a hard time choosing between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your layout seems different then most blogs and I’m looking for something unique. P.S My apologies for getting off-topic but I had to ask!


  8. 8charley harper prints
    April 14th, 2013 at 5:13 am

    This is a excellent site to learn about Charley Harper posters.


  9. 9Snapback Hats
    April 18th, 2013 at 3:15 am

    Hi there, just become aware of your weblog through Google, and found that it is really informative. I’m going to be careful for brussels. I will appreciate should you continue this in future. Lots of folks might be benefited from your writing. Cheers!


  10. 10campeggi mare croazia
    July 2nd, 2013 at 12:39 am

    I’m really inspired along with your writing talents as neatly as with the format to your weblog. Is this a paid subject or did you modify it your self? Either way stay up the nice quality writing, it is uncommon to peer a nice blog like this one nowadays..


  11. 11cheap rolex sale
    July 4th, 2013 at 6:48 pm

    These heaven-kissing quality Rolex watches are given precedence while selecting trendy watches. Rolex watches for men are equally of the people as of Rolex watches for women as they suffice the needs of both of them. One profitable thing about Rolex watches is that having dissimilarity in their making. While manufacturing Rolex circle take the close observation of the latest trends and designs and finally come up with debarring pieces that match up the latest trends.


  12. 12Rolex GMT For Sale
    July 5th, 2013 at 7:19 pm

    Then lower down the ladder comes the Of japan watches that are assembled using mind made in japan. Anyone accomplished about Of japan watches know about their reliability too, hence these swiss rolex online are also extremely trusty, though they are not as renowned as their Swiss language counterparts. The last grade swiss rolex online are those that are made in china or are assembled from mind sourced from china. These Swiss language Rolex online are not so trusty and do not last for drawn out and they are priced much cheaper than the other two. However, before going in for a swiss rolex online you have to make sure whether it is a swiss, Of japan or Chinese one and this by itself is a daunting labor.


  13. 13vanity table with stool
    July 30th, 2013 at 11:20 pm

    My partner and I stumbled over here different web page and thought
    I might check things out. I like what I see so now i’m following you. Look forward to looking into your web page for a second time.


  14. 14masonry chciago
    November 25th, 2013 at 3:38 pm

    Excellent concepts throughout this article, individually Im gonna need to bookmark this and also come back with that. Do you possess any type of comments on your newest blog post though?


  15. 15self made millionaire
    January 26th, 2014 at 2:38 am

    I am genuinely delighted t? read this webpage posts ?hich includes plenty of valuable fact?, thanks for proividing these data.


  16. 16nagelpilz Behandlung
    March 23rd, 2014 at 12:20 pm

    This article will help the internet visitors for building up new blog
    or even a weblog from start to end.


  17. 17Used Grosfillex Restaruant Furniture Phoenix
    March 25th, 2014 at 11:58 am

    Recycling symbol 7 – OTHER signifies materials not belonging to
    any of the other 6 resin groupings. Buying wicker plastic furniture will also ensure that you don’t
    have to change it out for cosmetic reasons as wicker looks as good today as it will 20 or 50 years from
    now. It is like buying brand new plastic furniture all over again at
    a fraction of the cost.


Leave a Response

Imhotep theme designed by Chris Lin. Proudly powered by Wordpress.
XHTML | CSS | RSS | Comments RSS