Google ProjectZero disclose details for three OS X 0days on Apple

[steven36]

Google ProjectZero disclosed the details of 3 new OS X zero-day vulnerabilities, but experts believe that they could be exploited by hackers to run attacks.

If you thought the ProjectZero team worked only to find flaws in Microsoft systems you are mistaken, this time the excellence crew has discovered three more zero-day vulnerabilities affecting the Apple’s OS X platform.

The ProjectZero team has already disclosed in the last weeks OS X flaws, in particular the hacker team has published the following advisories:

• OS X networkd “effective_audit_token” XPC type confusion sandbox escape (with exploit)
• OS X IOKit kernel memory corruption due to bad bzero in IOBluetoothDevice
• OS X IOKit kernel code execution due to NULL pointer dereference in IntelAccelerator

The experts haven’t considered these bugs very concerning because an attacker needs to already have access to a targeted machine in order to exploit them.

The security vulnerabilities were reported to Apple on October 2014 and also in this case ProjectZero team has disclosed the details of the flaws after 90 days according to its policy. The approach of the Google Team is criticized by part of the security community because the ProjectZero team provides enough detail for skilled hackers to write their own exploits.

An attacker could combine exploits provided by the ProjectZero team as proof-of-concept with other malicious code to gain more privileges on the targeted machine and run further attacks.

Security experts consider the Google disclosure policy dangerous because may have a number of adverse effects to the final customer. According to experts, the premature release of a fix could have an impact on other components of the system. If the fix is not available for technical reasons, the disclosure of details of a flaw would increase the window of exposure to attacks, although it is true that in acting in this way, companies are obliged to provide a response within ninety days and then providing greater support to the end user.

Source

[kay3460]

Sounds like Google is doing this to demonstrate the lack of security in other platforms. Don't use Windows or Mac; use ChromeOS instead.

[flash48]

Perhaps MS and Apple should start publishing bugs with Chrome.