Linked by Thom Holwerda on Fri 24th Nov 2006 20:06 UTC, submitted by hamster
Mac OS X On Thursday, antivirus firm F-Secure published a brief analysis of a proof-of-concept adware program for the Mac OS X that could theoretically hook into any application to run attacker-specified code. The program, dubbed IAdware by F-Secure, could be silently installed in a user's account without requiring administrator rights. "We won't disclose the exact technique used here - it's a feature not a bug - but let's just say that installing a System Library shouldn't be allowed without prompting the user," stated F-Secure in the blog post. "Especially as it only requires copy permissions." My take: I'd say, hand over the code, then we'll talk.
Permalink for comment 185299
To read all comments associated with this story, please click here.
by l0ne on Sat 25th Nov 2006 12:31 UTC
Member since:

...the hole has been there since the NeXTStep days and it's one many applications use for non-nefarious means (including my own little beloved Afloat).

Apple is well aware of this. However, their policy is, if you run an application, you get all consequences of it running (although I must agree with the blog above that standard permissions are too lax on /Library). Their security efforts are focused on the front line, that is, in preventing applications or code from running without you knowing.

Also, recent 10.4 Intel builds (post 10.4.4) have features that prevent some of the holes from being used even by running apps (see mach_inject woes on Intel) unless an administrator gives his password.

Reply Score: 1