Verbalism Personified

Go ahead, click on it one more time!

A week has passed since revelation of the doomsday Help URL security breach on Mac OS X. A number of websites have come up with do-it-yourself tips on how to disable the mechanisms by which the loop hole is exploited.

True to form, Apple released Security update 2004-05-21 last Friday, 21 May 2004. Though Apple wasn't specific about what flaws were fixed, it plugs the original Help URL exploit found in 'Panther'. A patch was also released for 'Jaguar'.

However this alone may not be enough, as these very same sites have recently detailed information on other potential exploits on the same concept.

One of them is Test Your Security. The writer has updated it to include tests for scripts on a number of likely scenarios. In addition to diabling the help, disk, disks and file protocols, it even recommends disabling afp, ftp and ssh for added security. Given that the concept has been tried and tested, an imaginative hacker could congure up a nightmare for any unsuspecting, and unprotected, Mac User.

To disable all of the above mentioned protocols, download Default App. Once installed, a Mac User has complete control over what application gets launched by any protocol. Disabling, or later re-enabling, the above protocols are a breeze.

The other would be Otterman speaks.... His advisory website posts pictures and detailed instructions on how to use Default App. He goes further by giving instructions on disabling the 'Open safe files" option in Safari, another potential loop hole.

Finally, there is Unsanity's Paranoid Android. This application enhancer alerts the user to any unauthorized scripts that they may have inadvertently 'clicked' across. It prompts a warning dialogue box, offering the user a re-course in allowing or denying the execution of the script. However there have been reports of this fix crashing iBooks while desktops are not affected. Currently in version 1.1, this may not be suitable for portable users until Unsanity releases another update.

There is no doubt that in securing an operating system, more revelations about exploits will appear. And sometimes, in the absence of timely patches from the vendor, self-styled pre-emption may be the way to go for now.

posted by Teutoburg @ 2:41 PM