2015 Vulnerabilities - Windows7 VS MacOSX

I was sent this interesting article; http://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/

Yes it does appeal to an existing bias I have; APPLE BAD, everything else (except adobe) good. I really hate Apple, but don't get me started.


I had a look at this article and like it on the outset, but thinking about it I don't agree with it for a few reasons. There is likely a lot of crossover between OSX and the iPhoneOS, between AIR SDK and AIR itself (it is odd that they list the Air SDK & Compiler separately).
There is also the issue of simply counting vulnerabilities as a measure of badness. One vulnerability doesn't equal another, if one of those vulnerabilities allows a bad guy to remotely take control of your computer and the other simply allows them to crash your browser, then the first is much worse.

So I thought I would do a more detailed analysis to see what is up and maybe confirm my hatred that Apple is terrible.

The CVEdetails site gives each vulnerability a score (CVSS), from 0 being minor/non-existent issue to 10 being a critical issue. I decided to show a different side of that article. One that would show the scores more importantly and thus give us the OS with the worse security score. I will focus on OSX and Windows7 to narrow the field. I'll do Android and iPhone OS in the next blog post.

Microsoft had 147 vulnerabilities last year all up for Windows 7, with an average across those vulnerabilities of a score of 6.84. If we then round all the scores (down if they are .4 and below, up if they are .5 and above we get the below);

Let's look at these vulnerabilities that scored 10.

CVE-2015-0014
Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
An interesting vulnerability, but not many people should be running telnet on their windows7 PC, let alone then exposing this to the internet.

CVE-2015-1635
Was a bad one, that allowed you to crash a webserver, though the IIS on windows 7 doesn't run as a service and is connection limited at windows XP's IIS and Windows Vista IIS was.

CVE-2015-2373
Essentially allows an attacker to execute code on your machine via a vulnerability in remote desktop, not likely that this is enabled through your router, but it is an issue for a malicious insider as it is enabled by default to some extent in corporate environments.

I don't think these vulnerabilities should all be 10 (say 9.x?). Yes they allow a remote attacker to take control, but they require a kind of perfect storm. They require the Windows7 machine to have these services enabled (Telnet and IIS are not installed by default, RDP is installed but disabled), and if the attacker is on the internet these also need to be open on the victims router/firewall, or an attack chained to include attacking the UPNP natting that some home routers do.

****************************************

Now lets look at Apple's MACOSX.

OSX had 384 vulnerabilities in 2015, with a lower average than Microsoft at 6.76. This is likely due to their being more vulnerabilities reported. It could also be that Microsoft seemingly score and report their own vulnerabilities and thus are harsher on themselves. There is also the issue that a lot of the OSX vulnerabilities are due to included open source software and thus these libraries etc get reported by their maintainers (ag Apache, PHP etc). Some of the higher rated vulns I noticed where Apple only, and only reported on their support pages or lists.
If we do the same breakdown as before we get the below;

Looking at that we can see there are simply so many more 7, 4 and 5 rated vulnerabilities, which is what brought the average down. I had a look at the standard deviations using the excel STDEV and the full population STDEVP functions, and they are pretty close. MS at 2.43 and OSX at 2.04.

Having a look at a samples of the CVSS 10's there is a bit of a difference.

CVE-2015-7071

"The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for app scoped bookmarks via a crafted pathname."
This one sounds worse than any of the vulnerabilities that scored 10 on windows, essentially allowing an attacker to bypass protections via a bookmark, bookmarks can be created by running some javascript on a site that the user visits, pretty bad.


CVE-2015-6988
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
OK, this one is pretty bad too, allowing an attacker to execute code remotely.

CVE-2015-5887
This one is a TLS/SSL bug, probably a flow on from SSL bugs found in 2015 in open source libraries and in closed sourced ones such as the Windows bug CVE-2015-6112, and CVE-2015-1637. Though I note both these windows bugs had much lower CVSS scores of 5.8 and 4.3 respectively.


CVE-2015-1131
A bug in an Apple font library, essentially allowing remote code if the font is called in a specific way, say from a webpage. Similar to the much lower rated CVE-2015-0059 Windows 7 bug.

Then there are a few bugs in drivers for apple hardware, Bluetooth, IOAceelerator (seems to be a ram disk card not likely found in most macs), a couple pretty bad kernel bugs and some HID driver bugs.

But then, looking at the rest of the 10 rated bugs, a pattern emerges. 27 of the CVSS rated 10's are actually ADOBE bugs in Acrobat/PDF reader... yikes. See the below example;

CVE-2015-3074

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3073.

I don't think it is fair that these Adobe bugs are rated 10 for Apple when they aren't even listed on the Windows7 list as they are a third party bug.
Some of the other 10 rated bugs also reference OSX's app store. Apps that install from their app store install into a permissions based Jail, essentially protecting the rest of the system from this app. The bugs that were found allowed these apps to break out of this jail... But Windows7 doesn't have this feature for their stores apps so an app installs in whatever context the user is running as (run everything as admin and the app you install can get admin privileges), so really although this is a bug, it is not as bad as simply not even having that protection.

MS has an appstore in Windows8 and above... and for a time it was so horrible that I would advise against using it for the foreseeable future.

Conclusion

As much as I hate to admit it, MacOSX having more bugs doesn't mean anything, it isn't the number but the quality. Macos had more, yes, but other than that one bookmark bug a lot of them were actually third party code or code that was not likely to be exploited. The Windows7 CVSS 10 bugs weren't that bad either, not too many will have these exposed to the internet, and inside networks all bar the RDP bug will likely not be installed on 99% of machines. I think we would find if Apple ditch support for natively updating Adobe and other third party software then their number of bugs would drop dramatically, account for their supporting directly all their hardware and you can count for the disparity on numbers of bugs.
There is more analysis that could be done here too (I will post the Spreadsheet I used in the next post), perhaps MacOSX had more bugs as more were reported, more were actioned and more were reported publicly to open source software library mailing lists were they would make their way to the media and Apple would be red-faced if they didn't jump on patching them. Perhaps MS was scoring their bugs harsher than they needed to be, and submitters of the open source software bugs in MacOSX were scoring their bugs softer due to their bias to support their own code.

Security wise I would say they are actually neck and neck, which is I suppose a good place to be for security at large. Not good for Apple-bashers like me, but I will admit when Apple does good things.

On to the CVSS scores, I don't think they are doing it right. They shouldn't be giving an optional disabled by default service like Telnet, or an obscure and I assume non-loaded driver like the IOAccelerator on Apple a score of 10. Sure it allowed remote exploitation, but how likely is it. They should probably put these at <9.5, then they are still critical, but this score doesn't black eye the vendor so much. Next they really shouldn't include third party software in one listing and not in the other, you can't compare the two this way it is an (ahem) Apples verse oranges issue.

Disrupting the paradigm

Not sure if I am quoting here, but be careful when someone says they are disrupting the paradigm, often when you look beneath the vale you will find an issue. The paradigm is usually there for a reason, cause it works.

I have discussed factorisation of authentication before here, this one will be a little more indepth;


To reiterate authentication currently works under a model of factors. Factors are simply classifications of things, in a cumulative manner. Things could be something you know (and preferably keep private), something you have, something you are, somewhere you are. This is 4 factors.

Something you know; Pin, password, passcode, passphrase, pictures in a certain order, last 4 digits of a credit card (even though this is something you have, it is a known never changing string).

Something you have; a key, a key-card, usb fob, Certificate, smart-card, rfid chip, SMS/Phone call receiving phone, Bluetooth paired phone or other device, laptop, tablet, phone itself.

Something you are; fingerprint, iris scan, voiceprint, DNA sequence.
I will rant on biometrics later, but you can't re-issue a fingerprint so if it gets compromised and copied by someone you are out of luck.

Somewhere you are; GPS location, IP-gelocation (thou as this would be in band checked on the connection you may be using to access the service the security doesn't increase), a landline or mobile phone could also be somewhere you are, eg you login to an app and it calls you on a separate phone at that same location to ensure you meant to.

Lets look at some examples.

• You login to your computer with a username and password, this is 1 factor of authentication, just a password.
• You login to your computer with a username and password, then onto a super-secret corporate system with a different username and password, this is still 1 factor of authentication. You only used a username and password.
• You login to your PC using a swipe card only, this is still 1 factor of authentication.Yes you used something you have, but it was not cumulative on something you know.
• You login to your PC using your username, password and Secure USB key, this is now 2 factors of authentication, something you know and something you have.
• You login to your PC using your username, password, thumbprint and Secure USB key, this is now 3 factors of authentication; something you know, something you have and something you are.
• You login to your netbanking via their app with username, password, fob token code, and your thumbprint on the home button. The app has rights to your phones GPS, it disallows transfers over $1000 from anywhere but inside your own home or registered place of work, if you go to transfer $1001 to another account and it then allows you due to the registered GPS, this could be considered 4 factors of authentication; something you know, have, are, and somewhere you are, all checked to ensure valid authorization.

Now comes the paradigm shifting. I wish it was me that thought of these.

Device profiling
This makes the device a factor, specifically a second factor.
This will do things like take the IP you are logging in from weighted with things like browser headers and put them in a database, if sees these to dramatically change it can deny you access.
A good example shoring the power of this hidden data that you send can be seen at the EFF's Panotoclick here; https://panopticlick.eff.org/
There are certain banking and social media apps that do this already, alerting you via email when you have logged in from a new device.


Risk based authentication
Awesome idea, basically the application has some smarts. Similar to the above device profiling it does some device profiling and then if you fail it, it either challenges you for more authentication or simply denies you access. It has risk scores that it assigns to things, so risk +1 if you are logging in at a different time, risk +9000 if you are logging in from a country with a bad reputation that you have never logged in from before. This still works in the factorising model, but doesn't force a user to enter every-factor every time, it is an extension of the paradigm.

Pingrid and their ilk
As I mentioned last time, these aren't two factor. They are a challenge, with a user response based on something they know. Interestingly I think they do increase security, but still not as much as a second factor. This really doesn't fit the factorised model. See there demo here; https://www.winfrasoftbank.com/MyAccounts/Default.aspx
You can see how due to the randomness of the numbers it does reduce the likelihood that the users "password" will ever be compromised by an over the shoulder or man in the middle attack, but again repeat enough views of the users login through a screen scraper and you have them. Still doesn't stop Man in the browser attacks (where malicious code waits for you to authenticate to your bank then distracts you and gives control of that tab to the remote bad guys to transfer out your cash).

That being said, I think they are probably making the authentication process more complicated than it needs to be and not more secure. Hard tokens that are transparent to the user like Ubi-key or smart cards are much, much more secure.

So uhh disrupting the paradigm, I thought I could make case that the above three did disrupt the paradigm, but they don't. I started this article all gung-ho to prove to myself they did, but they simply extend what we already have.
Device profiling and risk based authentication either work with existing factors of authentication, or make a sting of numbers unique to you and your device part of auth (just like a certificate or token, and thus are a second factor), and pingrid is simply an extension of single factor authentication.

Seeing as I mentioned Schneier last time I posted about auth, I had a look to see is he has discussed pingrid or others, he hasn't. But I did find the below, which is awesome;
http://www.schneierfacts.com/fact/vote/631

Playing with google

So I was recently having a discussion with a vendor about the insecurity versus usability of the google play store, yep there is malware there, yep there are copycat scam apps. But google will eventually get it under control, just as apple has done...

Ok so you can't trust either of them, but I think Apple is actually doing a better job of keeping the look-a-like scam apps out, at least I haven't heard of any yet, and this is coming from me a very anti-apple person.

So what do you do if you have written an Android app. Well you could host it on your own site, but then you need to reduce your customers security by making them set their device to allowing apps be installed from anywhere, opening them up to drive by downloads that are becomming prevelent in Android land (mainly due to some manufacturers enabling this setting by default).

You could host a QR code on your site and point this to your play store app...

Maybe just a link on your site back to the play store to ensure they get the right version of the app.

This got me thinking, it doesn't really protect you from those that just look through the store for apps from your company, so you should protect yourself in some other way. I use google alerts already to monitor stuff I am interested in, as well as comments about things I am interested in for security reasons.

This is where I thought I could make a search alert for: site:play.google.com appname
I wanted to try it out first, so I did: site:play.google.com commbank
Commbank is a big bank in Australia, and they have a few apps, one caught my attention; https://play.google.com/store/apps/details?id=au.com.commbank.hr.sidekick&hl=en
Looks to me like Commbank trust the store so much they trust a third party to put up an app for them for their users to access the intranet. The company that listed the app at time of writing was http://www.gpssolutionsdevelopers.com/ who's site looks like it is what is being loaded for the app;

The domain was suspiciously registered on the 28th of January this year.
I might need to reinstall this app and do a packet capture to see what web services it is trying to hit on this site, but this site is not https, and is hosted on a shared host that has unencrypted ftp, smtp and imap enabled. I let someone I have met from Commbank's IT security team know, and this was all amazingly fixed within a few hours. Props to them.
I did a packet capture post their fixes and it is all over ssl/tls now.

So anyway I guess the take-a-way is, if you want to add some security even for google play apps, you can setup a google alerts at http://www.google.com/alerts and do one for site:play.google.com appname set it for As-it-happens and hope you never get that email.