Mac OS X Software Update security issue uncovered

Apple has been using an automated system to update users computers on Mac OS X since the software was first released over a year ago. According to the Bug Traq Security list, Mac OS X's implementation of the Software Update is vulnerable to attack.

According to the list, HTTP is used with no authentication when running the Software Update application. "Using well known techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to trick a user into installing a malicious program posing as an update from Apple," according to the site.

Apparently an exploit for this vulnerability has been released to the public for what Bug Traq says is "testing purposes." The exploit is being distributed as a Mac OS X package, which includes DNS and ARP spoofing software. The package also includes the cgi scripts, and apache configuration files required to impersonate the Apple Software Update Server.

"The exploit is done by tricking a DNS server into thinking that Apple's update server is in fact a different IP address - that server can then provide the bad app to download," Scott Anguish of Stepwise told MacCentral. "This is not a new trick, it's a well-known issue, and can be done with anything that connects on the net that doesn't have an authority system (like public/private key authentication)."

Of course, you don't have to check for updates automatically, but setting Software Update to check manually doesn't protect you. "You'll click 'Update now' and the bad application could still be downloaded," said Anguish. "The malicious user would need to make sure that the update just looked legitimate ... not hard at all."

Anguish also confirmed that Mac OS 9 is susceptible to the same exploit.

In order to fix the problem, Anguish said Apple has to do a couple of things: