Mac O/s security warning

[Paul K]

BBC
http://isc.sans.org/diary.php?storyid=1138

Experts have uncovered a serious security hole in the way Apple software handles downloaded files.
The flaw could give malicious attackers a back door into Mac computers if users visit carefully crafted websites and download booby-trapped files.
Although no attackers were known to be exploiting the bug, experts said it was easy to write code to take advantage of the flaw.
Separately, three concept viruses for Apple computers have been discovered.
"This could be really bad," said a warning about the vulnerability by the widely-respected Internet Storm Center.
The discovery of the bug opens up Apple users to so-called "drive-by downloads" that plague users of the Window operating system and are used by makers of adware and spyware to install their software on victims' PCs.
Discovered by University of Ulm student Michael Lehn, the loophole arises because of the way that Apple's OS X operating handles downloaded files.
Although OS X displays an icon for files based on the suffix it finds on the program being downloaded, such as .jpg, it uses different criteria to decide what to do with these files.
This makes it possible to have files look benign by labelling them as images but, behind the scenes the operating system will know it is dealing with a proper program and run it as such.
Initially the flaw was thought only to affect compressed or zipped files but the Internet Storm Center said it can be used for any file that arrives on a target machine.
So far, no net-based exploits of the bug are known to be in existence but Apple is known to be working on a fix for the flaw. The operating system can also be made secure against the loophole by changing some preferences.

Just in case no one has already posted this, more of a heads up than anything.

This looks surprisingly like a schoolboy error by Apple. I'm really surprised. I always knew the OS did not need a filename extension to know what to do with any given file, but choosing which icon to use based on an extension is just asking for trouble.

In windows terms, this is like creating a malicious .exe file, then renaming it with a .jpg extension so someone will click it, expecting a picture to open, and Windows then carrying on and executing it.

[punky]

Cheers for that Paul

[Paul K]

Well I thought that some here might appreciate the warning, hopefully it's something that Apple will look to resolve quickly so that the work around isn't necessary to secure the system properly.

[Stuart]

I find it amazing that OSX relies on the file extension to display an icon. Especially as it already has code that uses the file contents to determine the file type.

Still, not as bad as Windows, which relies on the extension for the whole thing.

Originally Posted by Stuart C

I find it amazing that OSX relies on the file extension to display an icon. Especially as it already has code that uses the file contents to determine the file type.

Still, not as bad as Windows, which relies on the extension for the whole thing.

Once upon a time Mac OS would have nothing to do with extensions whatsoever. Apple has been pushed into having to do something about that since everyone else is now so familiar with them. Still, I am surprised they treat them in the way they do. It's a recipe for trouble. I'm only surprised it has taken so long for someone to notice this. I wonder if it has been this way since OSX 10.0 or if it came in one of the more recent versions.