Exploit Released for Unpatched Apple Wi-Fi Flaw
Update, 4:35 p.m. ET: Lynn Fox over at Apple called back with the following statement:
"We were recently made aware of this security issue in our first generation AirPort card, which has not shipped since October 2003. This issue affects a small percentage of previous generation AirPort enabled Macs and does not affect currently shipping or AirPort Extreme enabled Macs. We are currently investigating the issue."
Original Post From Earlier Today:
"With all the hype and buzz about the now infamous Apple wireless device driver bugs (brought to attention at Black Hat, by Johnny Cache and David Maynor, covered up and FUD'ed by others), hopefully this will bring some light (better said, proof) about the existence of such flaws in the Airport device drivers," said LMH (the alias of the hacker who runs the Kernelfun blog) -- referring to an Apple wireless driver issue covered by Security Fix earlier this year (the links in the quote are his).
Moore said he tested the exploit on a 1.0Ghz PowerBook running Mac OS X 10.4.8 with the latest updates (Halloween, 2006). "The fastest way to trigger this bug is to place the card into active scanning mode. This can be accomplished by launching Kismac [a wireless network scanning program] with the active scanning driver, or by using the 'airport' utility provided with OS X."
While Apple released updates in September to fix at least three problems in its wireless drivers, there is currently no fix available from Apple for the flaw detailed by Moore.
I exchanged a series of e-mails with Moore today to ask about some of this exploit's more technical details, which can be viewed here for anyone interested. In a nutshell, he says the exploit is somewhat unreliable as written, but that it could be made more so if someone spent a bit more time finessing it. He also said "it may be possible to make this exploit reliable by hammering the Airport driver with requests while triggering the bug."
Moore has since folded the exploit into Metasploit 3.0, a free software tool built to help users exploit security flaws against a variety of operating systems and third-party software applications.
The vulnerability is the first in a series of daily bug details to be released over the next 29 days as part of the "Month of Kernel Bugs" project. LMH said we can expect at least five more Apple kernel bugs to be detailed in the coming days, as well as kernel flaws in Linux, BSD, and Solaris 10 systems.
The "kernel" is probably the most vital and fundamental area of any computer system, as it handles the transfer of information between hardware and software on a machine, among other things. Kernel flaws are serious vulnerabilities, but kernel flaws that are exploitable remotely are extremely dangerous, because an attacker can use them to completely subvert the security of the target machine, usually regardless of the presence of security software or the system privileges of the user account the victim happens to be running at the time.
I put a call in to Apple spokeswoman Lynn Fox and will update this post if I hear back from the company. I also pinged David Maynor from SecureWorks to determine if this was related to the exploit I saw at the BlackHat security conference in Las Vegas this summer, but I've not yet received a response from him either.
I did catch up with Maynor's co-presenter, Johnny "Cache" Ellch, who said the bug Moore released today is unrelated to the flaw detailed at Black Hat.
November 1, 2006; 1:25 PM ET
Categories: Latest Warnings
Save & Share: Previous: Congressman Comes to Defense of Boarding Pass Hacker
Next: 14 Arrested for Credit Card, Phishing Scams
Posted by: hehehe | November 1, 2006 2:19 PM | Report abuse
Posted by: Bill Blackmon | November 1, 2006 3:00 PM | Report abuse
Posted by: ah | November 1, 2006 3:30 PM | Report abuse
Posted by: Rick | November 1, 2006 5:25 PM | Report abuse
Posted by: Jeff | November 1, 2006 5:58 PM | Report abuse
Posted by: antibozo | November 1, 2006 9:10 PM | Report abuse
Posted by: KenC | November 1, 2006 9:20 PM | Report abuse
Posted by: Zeke | November 2, 2006 1:07 AM | Report abuse
Posted by: DBH | November 2, 2006 10:14 AM | Report abuse
Posted by: Anonymous | November 2, 2006 11:18 AM | Report abuse
Posted by: Troy | November 2, 2006 2:01 PM | Report abuse
Posted by: rahrens | November 2, 2006 2:04 PM | Report abuse
Posted by: antibozo | November 3, 2006 2:19 AM | Report abuse
Posted by: Wonk | November 3, 2006 7:35 AM | Report abuse
Posted by: Anonymous | November 3, 2006 9:23 AM | Report abuse
Posted by: Tweek | November 7, 2006 11:08 PM | Report abuse
Posted by: FFXI | November 27, 2006 10:47 PM | Report abuse
Posted by: FFXI | December 4, 2006 4:56 AM | Report abuse
Posted by: Naomi | December 8, 2006 9:22 PM | Report abuse
Posted by: Gary | December 8, 2006 9:22 PM | Report abuse
The comments to this entry are closed.