July 28, 2008, 4:49 PM — Apple Inc. has not yet patched a critical Domain Name System (DNS) bug in its Mac OS X operating system, analysts and security researchers noted today as some criticized the company for dragging its feet.
"It's not sending a real good message," said Rich Mogull, an independent security consultant and former Gartner Inc. analyst. "If they don't patch this in a reasonable time, they're putting their customers at risk."
Apple, which integrates considerable open-source code into its operating systems, relies on BIND (Berkeley Internet Name Domain), created by the Internet Systems Consortium (ISC), for its DNS components. ISC patched BIND July 8, but as of today, Apple had not released an update for Mac OS X.
According to Dan Kaminsky, the researcher who uncovered the DNS flaw in February and helped coordinate a multivendor patch effort, Apple was told of the vulnerability before patches went public. "They were notified at some point," said Kaminsky, who did not name a date. "They were given a heads-up."
Approximately a month after Kaminsky discovered the vulnerability, representatives from several major developers, including Cisco Systems Inc., Internet Systems Consortium (ISC) and Microsoft Corp., met at the latter's Redmond, Wash., headquarters to discuss how to handle the bug. "In the Spring it was all about [vendors] who write DNS code, at its core it was about people who write name servers," said Kaminsky. Companies he called "second tier," those that "ship name server code that others write," were not part of that March meeting at Microsoft. Apple, he added, was one of those second tier vendors.
Calls to patch grew louder last week, however, after other researchers guessed some of the bug's technical details. Two days later, attack code went public.
Apple did not respond to questions about when it had been informed of the DNS flaw and when it would update Mac OS X to patch the bug.
Kaminsky was willing to cut Apple some slack on the DNS patch issue because of its miniscule market share. "Not that many people are running BIND on OS X Server, and those that do don't need Apple to hold their hand about patching," he said. "If there was a huge population of people behind DNS servers running OS X, I'd be more worried. That's not a dig [against Apple], it's just a statement."
In the grand scheme of things DNS, Kaminsky continued, Apple is a minor player at best. "We have bigger fish to fry," he said, adding that it was more important to focus on the vendors whose DNS code affected the most people.
True enough, said Mogull, but that's beside the point for people running Apple's operating system, particularly those relying on Mac OS X Server. "It may be a low priority in the scheme of the DNS vulnerability, but if all my servers are OS X, it matters. Within the Mac audience, it matters."
Andrew Storms, director of security operations at security vendor nCircle Network Security Inc., echoed Mogull's comments. "It is valid to say that the target market [for the DNS exploit] doesn't really affect them, if only because Mac OS X is primarily a client-side operating system."
But both Mogull and Storms hammered Apple for not providing its users with any word. "Users have to wonder if Apple is even listening to the talk about the DNS bug," Storms said. "We don't know anything. Why can't Apple simply make a one-line statement that it knows about the vulnerability and will have a fix in the next 30 to 60 days?
"It's that fear of the unknown that fuels the fire," Storms said.
Mogull, too, was critical of Apple's security process in general and this example in particular. "Apple's mostly gotten a pass on security issues," he said, "and as long as customers aren't getting beaten up, that's not been a problem. But that can change very quickly."
Mogull recommended that Apple work more closely with the open-source community responsible for code integrated in Mac OS X, such as the ISC's BIND, and urged the company to change how it handles security. "Apple does need to change its security practices. It makes a great operating system, but it's going to be much more of a target going forward."
Storms saw the bright side of Apple not patching the DNS bug, however, saying that it could be one of the few instances when the company's time-to-patch can be measured accurately. "Let's give them the best case, for them, and say that they didn't know until Microsoft patched on July 8," Storms said. "But now there's a vulnerability with exploit code freely available. How quickly is Apple going to respond a get a patch out?
"For most of the vulnerabilities it patches, it's difficult to tell what their internal [patch] release cycle looks like," he said. "This is the first chance we've had to gauge how quickly they can get their act together."
But this isn't the first time that Apple has been taken to task over how fast it updates the open-source parts in its OS. Last year, for example, Charlie Miller, a researcher at Baltimore-based Independent Security Evaluators (ISE) who is noted for his Mac and iPhone vulnerability research, called the company "negligent" for taking too long to patch. More recently, Miller slammed Apple for waiting until July to update the iPhone's built-in browser after Miller had exploited the same bug to hack a MacBook Air in March at a security conference contest.
"They do have a history of being slow to patch their open-source code," Mogull agreed.
