OS X Lion Raises Bar on Security, But Battery Firmware Vulnerability Surfaces

filevault iconThe Register reports on some of the new security improvements in OS X Lion, with researchers calling the changes a "major overhaul" that goes far beyond the minor security tweaks Apple made going from Mac OS X Leopard to Snow Leopard.

"It's a significant improvement, and the best way that I've described the level of security in Lion is that it's Windows 7, plus, plus," said Dino Dai Zovi, principal of security consultancy Trail of Bits and the coauthor of The Mac Hacker's Handbook. "I generally tell Mac users that if they care about security, they should upgrade to Lion sooner rather than later, and the same goes for Windows users, too."

In particular, the report points to such features as full support for address space layout randomization (ASLR), application sandboxing, and a revamped FileVault encryption system as being key to Lion's improved security.

"When they went from Leopard to Snow Leopard, as far as I'm concerned, there really wasn't any change," said Charlie Miller, principal research consultant at security firm Accuvant and the other coauthor of The Mac Hacker's Handbook. "They might have said there was more security and it was better, but at a low functionality level there really wasn't any difference. Now, they've made significant changes and it's going to be harder to exploit."

Miller isn't only interested in operating system and core application vulnerabilities, however, as evidenced by his recent discovery of a vulnerability in the chips that control the batteries in Apple's notebooks. That vulnerability could be exploited on a basic level to harm battery function or with additional effort to implant malware that could reinfect computers multiple times.

The batteries' chips are shipped with default passwords, such that anyone who discovers that password and learns to control the chips' firmware can potentially hijack them to do anything the hacker wants. That includes permanently ruining batteries at will, and may enable nastier tricks like implanting them with hidden malware that infects the computer no matter how many times software is reinstalled or even potentially causing the batteries to heat up, catch fire or explode. "These batteries just aren't designed with the idea that people will mess with them," Miller says. "What I'm showing is that it's possible to use them to do something really bad."

Miller plans to officially announce his discoveries at next month's Black Hat conference, and he will also be releasing a new "Caulkgun" tool to allow Mac notebook users to change their batteries' default passwords to randomized strings. That move would help keep hackers out of the batteries, but also prevent Apple from issuing its own upgrades and fixes for the battery firmware. Miller has also been in touch with Apple and Texas Instruments regarding the vulnerability.

Top Rated Comments

munkery Avatar
127 months ago
Um, I don't really understand this article.

The "security guy" says that Lion is great because it has ASLR, disk encryption, and Sandboxing. Windows has had those since Vista, and Windows 7 improved on them. It reads as though he's a paid spokes person.

Here is a comparison of OS X to Windows:

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Much of the ability to turn these vulnerabilities into exploits is due to the insecurity of the Windows registry. Also, more easily being able to link remote exploits to local privilege escalation exploits in Windows is due to the Windows registry.

Mac OS X does not use an exposed monolithic structure, such as the Windows registry, to store system settings. Also, exposed configuration files in OS X do not exert as much influence over associated processes as the registry does in Windows.

Mac OS X Snow Leopard has contained only 2 elevation of privilege vulnerabilities since it was released; obviously, neither of these were used in malware.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+ -> list of incidences of kernel mode driver vulnerabilities.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

2) Windows has the potential to have full ASLR but most software does not fully implement the feature. Most software in Windows has some DLLs (dynamic link libraries = Windows equivalent to dyld) which are not randomized.

http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf -> article overviewing the issues with ASLR and DEP implementation in Windows.

Also, methods have been found to bypass ASLR in Windows 7.

http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf -> article describing bypassing ASLR in Windows 7.

Mac OS X has full ASLR implemented on par with Linux. This includes ASLR with position independent executables (PIE). DLLs in Windows have to be pre-mapped at fixed addresses to avoid conflicts so full PIE is not possible with ASLR in Windows.

3) Mac OS X Lion has DEP on stack and heap for both 64-bit and 32-bit processes. Third party software that is 32-bit may lack this feature until recompiled in Xcode 4 within Lion. Not much software for OS X is still 32-bit.

But, not all software in Windows uses DEP; this includes 64-bit software. See article linked in #2.

4) Mac OS X implements canaries using ProPolice, the same mitigation used in Linux. ProPolice is considered the most thorough implementation of canaries. It is known to be much more effective than the similar system used in Windows.

http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf -> article comparing ProPolice to stack canary implementation in Windows.

5) Application sandboxing and mandatory access controls (MAC) in OS X are the same thing. More specifically, applications are sandboxed in OS X via MAC. Mac OS X uses the TrustedBSD MAC framework, which is a derivative of MAC from SE-Linux. This system is mandatory because it does not rely on inherited permissions. Both mandatorily exposed services (mDNSresponder, netbios...) and many client-side apps (Safari, Preview, TextEdit…) are sandboxed in Lion.

Windows does not have MAC. The system that provides sandboxing in Windows, called mandatory integrity controls (MIC), does not function like MAC because it is not actually mandatory. MIC functions based on inherited permissions so it is essentially an extension of DAC (see #1). If UAC is set with less restrictions or disabled in Windows, then MIC has less restrictions or is disabled.

http://www.exploit-db.com/download_pdf/16031 -> article about Mac sandbox.

http://msdn.microsoft.com/en-us/library/bb648648(v=VS.85).aspx -> MS documentation about MIC.

https://media.blackhat.com/bh-eu-11/Tom_Keetch/BlackHat_EU_2011_Keetch_Sandboxes-Slides.pdf -> researchers have found the MIC in IE is not a security boundary.

6) In relation to DAC and interprocess sandboxing in OS X in comparison with some functionality of MIC in Windows 7 (see #5), the XNU kernel used in OS X has always had more secure interprocess communication (IPC) since the initial release of OS X.

Mac OS X, via being based on Mach and BSD (UNIX foundation), facilitates IPC using mach messages secured using port rights that implement a measure of access controls on that communication. These access controls applied to IPC make it more difficult to migrate injected code from one process to another.

Adding difficulty to transporting injected code across processes reduces the likelihood of linking remote exploits to local exploits to achieve system level access.

As of OS X Lion, the XPC service has also been added to implement MAC (see #5) on IPC in OS X. (http://developer.apple.com/library/mac/#documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html)

7) Windows has far more public and/or unpatched vulnerabilities than OS X.

http://www.vupen.com/english/zerodays/ -> list of public 0days.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker -> another list of public 0days.

http://m.prnewswire.com/news-releases/qihoo-360-detects-oldest-vulnerability-in-microsoft-os-110606584.html -> article about 18 year old UAC bypass vulnerability.

8) Password handling in OS X is much more secure than Windows.

The default account created in Windows does not require a password. The protected storage API in Windows incorporates the users password into the encryption key for items located in protected storage. If no password is set, then the encryption algorithm used is not as strong. Also, no access controls are applied to items within protected storage.

In Mac OS X, the system prompts the user to define a password at setup. This password is incorporated into the encryption keys for items stored in keychain. Access controls are implemented for items within keychain.

Also, Mac OS X uses a salted SHA1 hash, which is still considered cryptographically secure. It is more robust than the MD4 NTLMv2 hash used in Windows 7.

http://www.windowsecurity.com/articles/How-Cracked-Windows-Password-Part1.html -> article about Windows password hashing.
Score: 44 Votes (Like | Disagree)
NT1440 Avatar
127 months ago
For Apple's sake and the sake of the product, shout outs for the person behind finding and talking about this severe security hole. How could have Apple missed this? Then again, OS X is now incredibly secure, mistakes happen.

But this needs to be addressed ASAP, or I know I'd honestly never buy an Apple laptop with this vulnerability - that's ofcourse to say, I wouldn't spend my well earned money on any other laptop if it's not a Mac, but with an issue like this, I would hold off until this is alleviated. :eek:

Um, over react enough?

You have to give them your laptop, then they'd have to know what to do with it. Seeing as it's getting as much press as its gotten, I'd say this a newly discovered exploit.

No real need to get worked up, unless you've had your laptop serviced at some shady place that took it apart for you.
Score: 7 Votes (Like | Disagree)
munkery Avatar
127 months ago
This comparison uses the most recent release of Ubuntu.

Linux has a higher incidence rate of local privilege escalation vulnerabilities than OS X. So, OS X has more secure DAC.

Linux has a lower incidence rate of remote vulnerabilities than OS X. This largely negates the difference in DAC.

But, the difference in remote vulnerabilities is also prior to the new security mitigations in Lion.

ASLR, DEP, canaries (propolice), and mandatory access control (sandboxing) are equivalent between the two with the release of Lion. Much of security mitigations used in OS X are derived from those in Linux.

Mac OS X's kernel has always had more secure interprocess communication (IPC) than the Linux kernel. Lion also adds sandboxing to IPC in OS X.

Password hashing in Linux is more secure. Linux uses sha512 while OS X uses salted SHA1.

Both have secured protected storage. Linux has keyring and OS X has keychain.

But, I do not believe the browser in Linux uses this secure storage. In browser password managers have been shown to be leveraged by malware.

I would say that OS X and Linux have equivalent security given the benefits and deficits of each OS.
Score: 7 Votes (Like | Disagree)
NT1440 Avatar
127 months ago
I like what I'm reading.

I think it'd be very cool to have a small super secure OS on hand, that said if its coming from the DoD and approved for public use (as in allowed for download) I can only assume there is some monitoring stuff in there (regardless of the official PR).
Score: 6 Votes (Like | Disagree)
WannaGoMac Avatar
127 months ago
Does this exploit require physical access to the computer?
Score: 6 Votes (Like | Disagree)
munkery Avatar
127 months ago
Also, realiasing that ASLR can be bypassed in Windows, this may be a just a repeat on the Mac.
Bypassing ASLR in Lion will be more like bypassing ASLR in x86_64 Linux distro that uses a full compliment of security mitigations, such as Ubuntu.

Find an article about bypassing ASLR in x86_64 Linux for more info.

Edit: Below is probably the most relevant and recent article.

Score: 5 Votes (Like | Disagree)

Top Stories

apple event spring loaded

Apple's 'Spring Loaded' Event Officially Announced for Tuesday, April 20

Tuesday April 13, 2021 9:04 am PDT by
Following an overnight leak by Siri, Apple today officially announced that it will be holding a special "Spring Loaded" event on Tuesday, April 20 at 10:00 a.m. Pacific Time at the Steve Jobs Theater on the Apple Park campus in Cupertino, California. As with all of Apple's 2020 events, the April 2021 event will be a digital-only gathering with no members of the media invited to attend in...

Kuo: 2022 iPhones to Feature 48-Megapixel Camera, 8K Video, and 6.1 and 6.7" Sizes With No 5.4" Mini Option

Tuesday April 13, 2021 10:45 pm PDT by
The upcoming 2022 iPhone lineup will feature two 6.1-inch devices and two 6.7-inch devices, with no mini-sized 5.4-inch iPhone, well-respected Apple analyst Ming-Chi Kuo said in a note to investors that was seen by MacRumors. Two of the iPhones will be high-end models and two of the iPhones will be lower-end models, similar to the current iPhone 12 lineup. Apple introduced the 5.4-inch...
macos catalina serial number

Apple Preparing Rollout of New Randomized Product Serial Numbers Ahead of 'Spring Loaded' Event

Wednesday April 14, 2021 2:08 am PDT by
Apple is advising its authorized premium resellers and dealers to prepare for new products with 10 and 12 digital serial numbers, days ahead of when it's expected to reveal a slew of new products. MacRumors previously reported that Apple plans to switch to randomized serial numbers for future products starting in early 2021. The company now seems to be preparing for that roll-out, telling...
apple event particularly innovative article

Gurman: Apple's 'Spring Loaded' Event Won't Feature Anything 'Particularly Innovative'

Thursday April 15, 2021 1:30 am PDT by
Bloomberg's highly-respected Mark Gurman says that he expects nothing "particularly innovative" or "extraordinary" to launch at Apple's "Spring Loaded" event next week, Tuesday, April 20. Gurman made the remarks during an interview for Bloomberg Technology, in which he reaffirmed that Apple will launch a new 11-inch and 12.9-inch iPad Pro, with the higher-end model featuring a brand new...
duanrui iphone13 notch samples

More Leaked iPhone 13 Samples Show Smaller Notch, Repositioned Earpiece and Front Camera

Wednesday April 14, 2021 1:06 am PDT by
Leaker known as "DuanRui" has today shared an image of two iPhone 13 "film samples," which show the same rumored smaller notch design coming to the iPhone 13 series that we've seen from other sources. In past tweets, DuanRui has accurately leaked the correct names of the iPhone 12 models and an iPad Air 4 manual revealing its new design, so there's good reason to think this leak is credible, ...
siir apple event april 20

Siri Reveals Apple Event Planned for Tuesday, April 20

Tuesday April 13, 2021 12:04 am PDT by
Siri has apparently prematurely revealed that Apple plans to hold an event on Tuesday, April 20, where the company is expected to reveal brand new iPad Pro models and possibly its long-awaited AirTags trackers. Subscribe to the MacRumors YouTube channel for more videos. Upon being asked "When is the next Apple Event," Siri is currently responding with, "The special event is on Tuesday, April...
apple event hashflag

Twitter Hashflag for April 20 Apple Event Goes Live

Tuesday April 13, 2021 2:21 pm PDT by
Following the overnight Siri leak and subsequent announcement that Apple will hold a media event on Tuesday, April 20, a new Twitter hashflag has appeared to help provide visibility for the event on the platform. For the last several recent events, Apple has utilized hashflags, which are little icons next to hashtags on Twitter, as a way to market its events. The company first started the...
parallels windows 10 arm mac

Parallels 16.5 Can Virtualize ARM Windows Natively on M1 Macs With Up to 30% Faster Performance

Wednesday April 14, 2021 7:00 am PDT by
Parallels today announced the release of Parallels Desktop 16.5 for Mac with full support for M1 Macs, allowing for the Windows 10 ARM Insider Preview and ARM-based Linux distributions to be run in a virtual machine at native speeds on M1 Macs. Parallels says running a Windows 10 ARM Insider Preview virtual machine natively on an M1 Mac results in up to 30 percent better performance compared ...
iphone 13 pro render rear

iPhone 13 Pro Rumored to Be Thicker and Feature Larger Rear Camera System

Wednesday April 14, 2021 7:07 am PDT by
Tech blog 91Mobiles has obtained 3D renders of what it claims will be the iPhone 13 Pro, revealing a largely familiar design with a few notable changes, including a smaller notch and a significantly larger rear camera system. Following renders of the standard iPhone 13 model from MySmartPrice yesterday, which showed a new diagonal rear camera layout, these renders of the 6.1-inch iPhone 13...
third gen Apple pencil leaked video

Video of Alleged Third-Generation Apple Pencil Leaks Ahead of Apple Event

Friday April 16, 2021 6:13 am PDT by
A video purporting to be of the third-generation Apple Pencil has today been shared online, showing a glossy finish that mirrors previous leaks. New ✏️ ready to 🚢 #AppleEvent @TommyBo50387266 pic.twitter.com/s4RCDwDi5M— 漢尼斯·拉斯納 🇨🇳 (@ileakeer) April 16, 2021 The brief video from Twitter account @ileakeer, spotted by 9to5Mac, shows an Apple Pencil with a glossy finish much like the...