XARA exploits on Mac, iPhone, and iPad, and what you need to know!<div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even" property="content:encoded"><p><a href='
http://www.imore.com/xara-exploits-mac-iphone-and-ipad-and-what-you-need-know' title="XARA exploits on Mac, iPhone, and iPad, and what you need to know!"><img src='
http://www.imore.com/sites/imore.com/files/styles/large_wm_blw/public/field/image/2014/11/retina_5k_imac_gaming_arkham_hero.jpg?itok=H0pUdSGa' />[/url]</p> <p class="intro">'XARA' is an acronym for 'unauthorized cross-app resource access' and lumps together several exploits against OS X and iOS.</p> <p>The XARA exploits, recently disclosed to the public in a paper titled
Unauthorized cross-app resource access on Mac OS X and iOS, target the OS X Keychain and Bundle IDs, HTML 5 WebSockets, and iOS URL schemes. While they absolutely need to be fixed, like most security exploits, they have also been needlessly conflated and overly sensationalized by some in the media. So, what's really going on?</p> <h2>What is XARA?</h2> <p>Simply put, XARA is the name being used to lump together a group of exploits that use a malicious app to gain access to the secure information transited by, or stored in, a legitimate app. They do this by placing themselves in the middle of a communications chain or sandbox.</p> <h2>What does XARA target exactly?</h2> <p>On OS X, XARA targets the Keychain database where credentials are stored and exchanged; WebSockets, a communication channel between apps and associated services; and Bundle IDs, which uniquely identify sandboxed apps, and can be used to target data containers.</p> <p>On iOS, XARA targets URL schemes, which are used to move people and data between apps.</p> <h2>Wait, URL scheme hijacking? That sounds familiar...</h2> <p>Yes, URL scheme hijacking isn't new. It's why security-conscious developers will either avoid passing sensitive data via URL schemes, or at the very least take steps to mitigate the risks that arise when choosing to do so. Unfortunately, it appears that not all developers, including some of the biggest, are doing that.</p> <p>So, technically, URL hijacking is not an OS vulnerability so much as a poor development practice. It's used because no official, secure mechanism is in place to accomplish the desired functionality.</p> <h2>What about WebSockets and iOS?</h2> <p>WebSockets is technically an HTML5 issue and affects OS X, iOS, and other platforms including Windows. While the paper gives an example of how WebSockets can be attacked on OS X, it doesn't give any such example for iOS.</p> <h2>So XARA exploits primarily affect OS X, not iOS?</h2> <p>Since "XARA" lumps together several different exploits under one label, and the iOS exposure seems much more limited, then yes, that appears to be the case.</p> <h2>How are the exploits being distributed?</h2> <p>In the examples given by the researchers, malicious apps were created and released to the Mac App Store and iOS App Store. (The apps, especially on OS X, could obviously be distributed via the web as well.)</p> <h2>So were the App Stores or app review tricked into letting these malicious apps in?</h2> <p>The iOS App Store was not. Any app can register a URL scheme. There's nothing unusual about that, and hence nothing to be "caught" by the App Store review.</p> <p>For the App Stores in general, much of the review process relies on identifying known bad behavior. If any part of, or all of, the XARA exploits can be reliably detected through static analysis or manual inspection, it's likely those checks will be added to the review processes to prevent the same exploits from getting through in the future</p> <h2>So what do these malicious apps do if they're downloaded?</h2> <p>Broadly speaking, they intermediate themselves into the communications chain or sandbox of (ideally popular) apps, and then wait and hope you either start using the app (if you don't already), or start passing data back and forth in a way they can intercept.</p> <p>For OS X Keychains, it includes pre-registering or deleting and re-registering items. For WebSockets, it includes preemptively claiming a port. For Bundle IDs, it includes getting malicious sub-targets added to the access control lists (ACL) of legitimate apps.</p> <p>For iOS, it includes hijacking the URL scheme of a legitimate app.</p> <h2>What sort of data is at risk from XARA?</h2> <p>The examples show Keychain, WebSockets, and URL scheme data being snooped as it's transited, and Sandbox containers being mined for data.</p> <h2>What could be done to prevent XARA?</h2> <p>While not pretending to understand the intricacies involved in implementing it, a way for apps to securely authenticate any and all communications would seem to be ideal.</p> <p>Deleting Keychain items sounds like it has to be a bug, but pre-registering one seems like something authentication could protect against. It's non-trivial, since new versions of an app will want to, and should be able to, access the Keychain items of older versions, but solving non-trivial problems is what Apple does.</p> <p>Since Keychain is an established system, however, any changes made would almost certainly require updates from developers as well as Apple.</p> <p>Sandboxing just sounds like it needs to be better secured against ACL list additions.</p> <p>Arguably, absent a secure, authenticated communications system, developers shouldn't be sending data through WebSockets or URL Schemes at all. That would, however, greatly impact the functionality they provide. So, we get the traditional battle between security and convenience.</p> <h2>Is there any way to know if any of my data is being intercepted?</h2> <p>The researchers propose that malicious apps wouldn't just take the data, but would record it and then pass it on to the legitimate recipient, so the victim wouldn't notice.</p> <p>On iOS, if URL schemes are really being passed through a malicious app, we'd expect that app to launch and be visible for at least a moment before it passes it on to the legitimate app. Whether most people would recognize what's happening—i.e., seeing a fake app and then a real app launching in sequence—is hard to say.</p> <h2>Why was XARA disclosed to the public, and why hasn't Apple fixed it already?</h2> <p>The researchers say they reported XARA to Apple 6 months ago, and Apple asked for that much time to fix it. Since that time had elapsed, the researchers went public.</p> <p>Strangely, the researchers also claim to have seen attempts by Apple to fix the exploits, but that those attempts were still subject to attack. That makes it sound, at least on the surface, that Apple was working on fixing what was initially disclosed, ways to circumvent those fixes were found, but the clock wasn't reset. If that's an accurate read, saying 6 months has passed is a little disingenuous.</p> <p>Apple, for its part, has fixed numerous other exploits over the last few months, many of which were arguably greater threats than XARA, so there's absolutely no case to be made that Apple is uncaring or inactive when it comes to security.</p> <p>What priorities they have, how difficult this is to fix, what the ramifications are, how much changes, what additional exploits and vectors are discovered along the way, and how long it takes to test are all factors that need to be carefully considered.</p> <p>At the same time, the researchers know the vulnerabilities and may have strong feelings about the potential that others have found them and may use them for malicious purposes. So, they have to weigh the potential damage of keeping the information private versus making it public.</p> <h2>So what should we do?</h2> <p>There are many ways to get sensitive information from any computer system, including phishing, spoofing, and social engineering attacks, but XARA is a serious group of exploits and they need to be fixed (or systems need to be put in place to secure against them).</p> <p>No one needs to panic, but anyone using a Mac, iPhone, or iPad should be informed. Until Apple hardens OS X and iOS against the range of XARA exploits, the best practices for avoiding attack are the same as they've always been — don't download software from developers you don't know and trust.</p> <p>
Nick Arnott contributed to this article.</p> </div></div></div><img width='1' height='1' src='
' border='0'/><br clear='all'/>
<a href="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/1/rc.htm" rel="nofollow"><img src="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/1/rc.img" border="0"/>[/url]
<a href="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/2/rc.htm" rel="nofollow"><img src="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/2/rc.img" border="0"/>[/url]
<a href="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/3/rc.htm" rel="nofollow"><img src="
http://rc.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/rc/3/rc.img" border="0"/>[/url]
<img src="[url]http://da.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/a2.img" border="0"/>[/url]<img width="1" height="1" src="
http://pi.feedsportal.com/r/231049649773/u/49/f/616881/c/33998/s/47572351/sc/28/a2t.img" border="0"/><img src="
http://feeds.feedburner.com/~r/TheIphoneBlog/~4/qXDYRevcFRk" height="1" width="1" alt=""/>
Source:
XARA exploits on Mac, iPhone, and iPad, and what you need to know!
