OS X has detractors and champions. Some laud the arm’s-length distance between users and fundamental processes, while others regard this distance as a failure waiting to happen when security threats breach the gate-kept trunk of Apple’s tree.
Both camps may have a point. Here’s a roundup of the good, the bad and the ugly security news for OS X.
The Good…
As noted by Threatpost, security researcher Partrick Wardle has developed a generic ransomware detection tool for the operating system. This is a kind of holy grail for ransomware spotting: It’s a tool that doesn’t depend on identifying specific strains but generalizes based on app behavior and stops offending processes before they get too far.
While OS X faces fewer ransomware attacks than its PC counterparts, Wardle’s RansomWhere? defense is still a step in the right direction. The researcher decided to act after he watched KeRanger sneak through Gatekeeper using a legitimate Apple developer ID.
RansomWhere? starts by determining whether a process is trustworthy — for example, those processes signed by Apple or directly approved by users. Unapproved apps are then monitored. If they start to encrypt files at high speed, they’re halted and a notification is sent to users.
Wardle pointed out that some files will be lost as the tool scans existing processes. His solution isn’t perfect since it can be bypassed, but overall it’s good news on the defense front.
The Bad…
On the bad side is old Git source code that’s included as part of the Command Line Tools package for Xcode, which is used by developers who create apps for OS X or iOS. According to CSO Online, the most recent version of the package comes with Git version 2.6.4, released in December 2015. But last month, two serious flaws — CVE-2016-2315 and CVE-2016-2324 — were discovered.
On the client side, these vulnerabilities make it possible for attackers to carry out remote code attacks, so on March 17, Git released version 2.7.4, which fixed both issues.
The problem? The Command Line Tools haven’t been updated to reflect this change. It’s also not easy to update Git alone on an Apple device, meaning both developers and new applications could be at risk.
…The Ugly
To address concerns over OS X hacks, Apple recently implemented the System Integrity Protocol (SIP), which prevents the modification of specific programs in certain directories even with root access.
As noted by TechWeekEurope UK, however, all OS and iOS versions earlier than 10.11.4 and 9.3 contain a flaw that allows attackers to escalate their privileges and bypass SIP using a phishing or browser attack. It also enables them to evade detection by other security programs. If users don’t update to the newest OS versions — released just last month — their mobile device or laptop could be modified without their knowledge or consent.
Good news? OS X got a generic ransomware detector. Not-so-good news? Outdated Git code and a vulnerable SIP could put users at serious risk.