Apple = No virus... just security holes.
Internet security researcher Charlie MIller will release the results of research he's done to uncover 30 security holes in Mac OS X to the CanSecWest security conference in Vancouver later this month. According to a report by Forbes, the guy who won a MacBook Air at Pwn2Own the past two straight years is not sure whether he will tell Apple what the flaws are: he says he might hold on to them for this year's challenge.
Miller worked for five years at the US National Security Agency as a "global network explaoitation analyst," finding weaknesses and vulnerabilities in computer networks for the US government spies, reportedly carrying out multiple hacks against foreign targets. As a private citizen, he started Independent Security Evaluators, a consulting firm, showing service providers how to harden their Web code against attack. Miller has been very public in his focus on the vulnerabilities of Apple software, being the first to discover a security hole in Mobile Safari in 2007. At Pwn2Own in 2008, it took him just two minutes to defeat a MacBook Air's security, and used a Safari exploit to crack a MacBook in less than 10 seconds in 2009. Last year, he also used an SMS vulnerability to pwn an iPhone.
A report by Andy Greenberg the Forbes Firewall blog notes that of the 30 previously unknown security holes Miller found in Mac OS X, 20 of them are in the Preview application. By tricking a user into opening a PDF that contains Miller's exploit, a hacker could gain control of their Mac. Moreover, since Safari uses Preview's rendering engine to display PDFs in the browser, the code could be hidden on any web page.
Miller told Forbes that he used "dumb fuzzing" to find the holes: a Python script just five lines long changed one bit on a PDF file at a time and let the application run it, checking to see if it crashed. He used this brute force method for three weeks straight on each of four applications and says he found a thousand different ways to crash them. He then investigated the crashes to see if any of them allowed him to gain control of the system. There were 20 exploitable bugs in Preview compared with either 3 or 4 each in Reader, PowerPoint, and OpenOffice.
Miller said that he was surprised he found so many bugs, and took it as a clear indication that Apple being lax in doing its own security testing, “It’s shocking that Apple didn’t do this first," the researcher told Forbes. "The only skill I’ve used here is patience.” He indicated that he hasn't informed Apple of his discoveries and may try to use them against Mobile Safari on the iPhone for this year's Pwn2Own competition. If that works, he says, he'll see if they work on the iPad as well.
"Microsoft, Apple, and Adobe all have huge security teams, and I'm one guy working out of my house," Miller says. "I shouldn't be able to find bugs like these, ever."
