Security concerns mar Leopard launch

Matthew JC. Powell
22 November, 2007
View more articles fromthe author

Apple sold over two million copies of Mac OS X 10.5 in its first weekend of availability in late October, making it easily the fastest-selling version of Mac OS ever. The combination of iPod and iPhone “halo effects” plus the enormous pent-up demand created as Tiger users waited for the new OS, contributed to the blockbuster opening.

For most of those users, they found a zippier, more responsive operating system with in-built backup, gorgeous new high-resolution icons and a multitude of productivity and user-experience enhancements.
Unfortunately, that feel-good story barely rated a mention in most of the press coverage, which was more concerned with the glitches and — worryingly — security problems in the new release.

First there was the Leopard Blue Screen Of Death (which pinched its name from the crashes that used to plague Windows). Many users who performed straight upgrades of their systems rather than “Archive and Install” upgrades or clean installations found that at the end of the process their computers hung on a blue screen (a different shade from the Windows one) indefinitely. The problem was traced to Unsanity’s APE framework, installed as part of Application Enhancer and bundled with a number of third-party products, including Logitech keyboards. Within hours of the bug being reported Apple had posted a fix, albeit a geeky one, on its support forums. The best advice is to uninstall APE frameworks if they’re on your machine before moving to Leopard.

Of considerably more concern are the flaws being spotted in Leopard’s much-vaunted security (a factor which prompted untold numbers of Windows users to switch to Mac). Leopard’s built-in firewall is not activated by default, and even when you do activate it it is not automatically in “stealth” mode (which hides the computer from detection on the internet).

Even in stealth mode, though, computers running Leopard can still be located and “pinged” — meaning that they are still visible and might be vulnerable to malicious exploits. Stealth mode only seems to apply to some ports — most ports remain visible but closed, while others remain visible and even responsive to remote requests. Using any of the online security-testing web sites provided by companies such as ShieldsUp and Symantec, Leopard fails the test.

Deeper problems. More esoterically, and less easily noticed, the memory randomisation touted for Leopard turns out to be a half-measure. Apple had indicated before the launch that Leopard would introduce a system whereby various functions of the operating system would be executed in random sections of the computer’s memory, rather than always being assigned to the same address. This means that hackers, should they find a way to attack, would not be able to attack those known memory addresses in the knowledge of what functions will be performed there.

I told you it was esoteric.

Unfortunately, it turns out that Leopard does not fully randomise its memory allocations, and some functions such as the Dynamic Linking Library are not random at all. While this does not necessarily mean that Leopard is vulnerable to attack, it does mean that if a vulnerability were opened, hackers would know what part of the Mac they could attack.

Leave a Comment

Please keep your comments friendly on the topic.

Contact us