[unsanity] Weblog: Keep Yo' Surf Safe With Paranoid Android!

Strange - I just loaded this and logged out and back in, but it isn't being loaded for any application.

Is there something I need to do to "activate" this? Or should it be loading like other APE modules?

Posted by: neil on May 20, 2004 6:53 AM

Jason, you say that "a malware author could write an exploit that would delete your home directory" but wouldn't that type of exploit still require you to authenticate? Or can you delete your home directory without authenticating? I've seen a few of the proof-of-concepts that are currently available online and at first I thought, holy crap these things can nuke my system...but then I realized that ultimately anything they do (whether it be in the terminal or elsewhere) will require authentication before it can proceed. Or am I wrong here? I thought that was one of the strong points of Mac OS X? I thought only if you were running as root would you be able to delete your home directory.

Could you clarify this for me?

Posted by: mark on May 20, 2004 7:05 AM

You are mistaken mark. Authentication is ONLY needed to modify folders/files or other stuff that the current user does not own and cannot do. Since the current user owns the home folder, the current user can delete it (try it, move the home folder to the trash or something).

malware could not delete the entire HD. Unless you log in as root, of course which is a rather silly thing to do.

And it is active. Try typing evilthing:blah in safari and hit return. Just because it has no effected applications does not mean it isn't loaded.

Posted by: Rosyna on May 20, 2004 8:11 AM

I work for a school district that is all OS X. I saw this haxie, downloaded it, but like nell above there are no applications listed in the Enhanced Applications list. How do we add Safari, IE or any other browser that we might use.....or are we automatically protected with it???? Please let us know!!!!

Posted by: CLarson on May 20, 2004 8:37 AM

CLarson - did you restart the computer after installing it (or just log out and back in)? That's required.

Alternately, a while ago none of my Haxies were working at all after moving HDs (after my original one crashed and I spent 2 days running Data Rescue on it to get my databack). The solution? Reinstall Application Enhancer and reboot.

Posted by: kevin on May 20, 2004 9:51 AM

If you alll would like to see screenshots of Paranoid Android in action, go here:

http://www.marihart.org/leo/tao/hole_filling/

I'm a bit rushed today, but I wrote it up for some friends who were also saying 'Wha...?' about this issue.

Posted by: Leo of BORG on May 20, 2004 11:56 AM

Go Jason! Thanks guys.

Posted by: NetworkShadow on May 20, 2004 12:02 PM

Do you plans to release a Jaguar version?

Larry

Posted by: Larry Friedman on May 20, 2004 2:05 PM

Works like a charm, guys! Simple and elegant. Great job.

Posted by: la1itree on May 20, 2004 6:12 PM

Larry: Jaguar isn't affected by the exploit (actually, i think help:// may be, but not the second one).

mark/Rosyna: well, it's semi-easy to make the exploit app to pop up an authentication dialog. Most users will blindly enter the admin password without much thinking -- and bingo, you got full root access.

Scary.

Posted by: slava on May 21, 2004 1:23 AM

Oh, about PA not showing up in the Affected Applications -- I think Jason forgot to put APEBundleMessage() call in, so the module *does* loads, but won't show up in the affected apps list (we don't register ape modules without APEBundleMessage() callback for speed/rationality purposes). We'll fix this in the next update, if it will be needed (read: Apple won't act fast).

Posted by: slava on May 21, 2004 1:25 AM

I'm thinking of installing PA, but I've not used haxies before. I was going to be upgrading from 10.3 to 10.3.3 soon and wonder if I would need to uninstall PA before doing so. Also, how DO you uninstall PA exactly?
Thanks

Posted by: cuppa on May 21, 2004 5:24 AM

I noticed that PA doesn't say anything when I click (in Safari) on a link on a website that leads to the iTunes music store.

I would have assumed I'd get a warning about "daap:" in use, but it just went right through. I know there is no vulnerability involving daap right now, but I thought PA was supposed to catch everything? Or is Safari/iTunes using a different method that bypasses PA?

Latest versions of Safari, iTunes, and OS X were used.

Posted by: Johnathan Grant on May 21, 2004 6:00 AM

iTMS uses the itms:protocol, not daap:

daap: is used for the rendezvous sharing.

Posted by: Rosyna on May 21, 2004 8:00 AM

Unless it was fixed in iTunes 4.5, daap: is actually treated as a streaming URL (which is wrong).

Posted by: kevin on May 21, 2004 9:49 AM

having problems w/ PA and Entourage (yah, i know). mailto: links in web pages will bring E forward, but not instigate a new message w/ recipient entered. also, html emails with certain images will launch the PA warning, accepting will allow images to be loaded, but trying to delete the message afterwards results in an empty message dialog.

Posted by: bughouse on May 21, 2004 1:11 PM

If you're interested in more fully understanding the exploit that PA protects you from, this is a good description:

http://www.euronet.nl/~tekelenb/playground/security/diskURLscheme/

Posted by: petey on May 21, 2004 1:26 PM

Yes I restated the computer and received the same results. I just installed it on a new computer - loged out = restarted= logged back in and no applications show under enhanced applciations

Posted by: clarson on May 21, 2004 4:00 PM

clarson, Paranoid Android 1.0 doesn't show which apps are enhanced in the APE Manager preference pane, but it's working fine.

Posted by: Jason Harris on May 21, 2004 4:24 PM

Pardon me for indicating the wrong URI (daap) when I should have indicated (itms). My point was that no warning at all came from Paranoid Android, and I thought it should have given me a warning for *something*, since a protocol helper was indeed being called. That's all. I had been up a long time, and was about to go to bed when I posted that. I just used the protocol that came to mind when I thought of iTunes. If PA had given me a warning, then I would have known the proper protocol, but then, I wouldn't have had anything to post about.

Lest I be taken the wrong way, I do certainly appreciate your efforts in this matter, as your solution certainly does seem more comprehensive and appropriate than what Apple has provided thus far.

Posted by: Johnathan Grant on May 21, 2004 10:09 PM

Well, PA doesn't warn about itms because itms is considered safe. As are http, ftp, https, and some others.

Posted by: Rosyna on May 22, 2004 8:17 AM

How do I uninstall PA? It is driving me crazy with incessent warnings (twice) for each html email.

Posted by: Paul McKlendin on June 6, 2004 4:45 PM

Paul McKlendin - umm, you don't need to install, just put the scheme you're using into the PA list. Just go to the APE Manager prefpane, select Paranoid Android, hit the + button and type the scheme in (the scheme being, for example, 'http' or 'ftp').

If you really want to get rid of it the easiest way is it just uncheck it in the APE Manager and relaunch the applications you want to be free of PA. This doesn't uninstall it, it just disables it. If you want to uninstall go to ~/Library/Application Enhancers/ (or /Library/Application Enhancers/) and delete Paranoid Android.ape

Posted by: kevin on June 6, 2004 5:45 PM

Posted by: x on July 8, 2004 6:38 PM

Posted by: x on July 8, 2004 6:42 PM

Posted by: x on July 8, 2004 6:44 PM

July 2011 > <
Sun	Mon	Tue	Wed	Thu	Fri	Sat
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31