Apple is to fix a bug in its Mac OS X operating system as soon as possible amid concerns over the security of its desktop and laptop computers.
The tech company will patch a serious “privilege escalation” bug in the next security update to its desktop operating system, Mac OS X 10.10.5, the Guardian has learned. The initial beta of the next update to the Mac operating system did not include a fix for the bug, known as DYLD, leading to concerns it would not be fixed until the Autumn when the next major OS release, El Capitan, is planned.
A second serious bug, Thunderstrike 2, which can allow attackers to overwrite a computer’s firmware using a malicious webpage, has already been partially patched in Mac OS X 10.10.4.
The two bugs have led to concerns that Apple is losing its historic lead in security. The company has long emphasised its safety compared to rivals operating systems, highlighting its resilience to viruses in ad campaigns.
The most notable part of the Thunderstrike 2 vulnerability – which lets attackers create a “worm” which can spread from computer to computer without human intervention – remains unfixed, though some experts have questioned its seriousness. Rich Mogull, a Mac security expert who covers the platform on the TidBITS news site, wrote that Thunderstrike 2 is less severe than it was made out to be.
“In this case, an infected computer will infect something known as the option ROM on any vulnerable Thunderbolt device that’s attached. Then that device can infect any computer it’s connected to, and so on.
“Yes, it’s a worm, and that’s the most interesting part of the research. But especially with the new patch in place, and the generally limited use of Thunderbolt, it would be hard for even a malicious version of this attack to spread very far.”
Mogull concluded that “nearly everyone can ignore Thunderstrike 2 entirely.”
For typical users, the worm is a mostly hypothetical threat compared to the already-patched web infection vector. Thunderbolt devices, which are required to spread the worm, are rarely used outside of a few niche applications, and they are shared between multiple computers even less frequently.
The DYLD vulnerability, which remains unpatched in the latest versions of Mac OS X, is a more pressing concern. It allows a program to run as though it has administrator access without needing to ask the user to input their password, and has already been seen “in the wild”, with at least one adware installer using it to increase its capabilities.
The Guardian understands that Apple has taken interim measures to prevent further exploitation of the vulnerability, including revoking the credentials of developers who use it, and including any app which does so on the company’s regularly updated list of malware. As such, unsuspecting users should be protected against specific attacks until a broader patch is released.
This article was written by Alex Hern, for theguardian.com on Wednesday 5th August 2015 11.20 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010