Article by George Norman

On 26 Jan 2009

It would seem that the Trojan that comes bundled with pirated versions of iWork ’09 is not the only security issue affecting the Mac OS X. An Italian researcher has discovered a means of attacking the operating system, and by that I mean executable code injection directly into the memory, without leaving a telltale trace behind. Without that trail, it would be nearly impossible for security researchers and security software to detect an attack.

“My attack is an implementation of a technique called userland-exec. This technique makes it possible to launch an executable on a machine without invoking the kernel and that it is present on your disk. But it can not be considered a vulnerability in the usual sense. In fact, the attack is made possible in practice because of an inherent problem of Mac OS X has long known, namely the lack of randomization dynamic linker within space processes,” said Vincenzo Iozzo, the Italian researcher mentioned above, in an interview for oneITsecurity.


According to Vincenzo Iozzo the technique does not make life easier for would-be Mac OS X hackers, it simply allows an attacker to inject an entire executable as opposed to just a shellcode, thus making it a lot easier to execute malicious code on the targeted system. Not only is this technique groundbreaking (you could not inject entire .exe files before), it also cleans up behind it leaving no trace whatsoever on the targeted machine (once it is shut down). The only way one could detect the attack is by using a network intrusion detection system or an anomaly intrusion detection system.

Vincenzo Iozzo plans to present more in-depth details and a proof-of-concept exploit during his “Let Your Mach-O Fly” presentation which will be held at the Black Hat Conference, this February in Washington DC.



Tags: Apple, Mac OS X, Security

I Hope you LIKE this blog post! Thank you!

What do YOU have to say about this

Popular News

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25.

26.

27.

28.

29.

30.