Microsoft Provides Easy OS X Security Hack

Nothing like an 11 year old to find a security hole in Apple’s OS X. Of course, it helps if he gets some assistance from Microsoft. Through MS Office, Microsoft gives you free range access to the applications on your system when running Simple Finder, unlike Apple, who doesn’t allow its applications to do that when you’re in Simple Finder. This reflects MS’s whole ethos of allowing users access to anything on computers, which is why Windows is so virus and spyware ridden.

Now, before you go buying anti-virus software or a new firewall, this is not a threat from the outside world; it is an internal security breach—internally to OS X that is. The “good news” is it’s only a concern for people intent on using OS X’s “Finder & System” Parental Controls.

Our own Aaron Wright recently wrote an excellent must read two-part piece on setting up and using Parental Controls to help protect your kids from the net nasties: Part 1 - Email, Part 2 - Surfing the web
Another aspect of the Parent Controls functionality of OS X, and one that has been in place since Panther, is the limitation of what applications a user can run or access. In Tiger it’s under the “Finder and System” settings of Parental Controls.

What do “Finder and System” controls do?
If you enable “Finder and System” controls for an account and enter the configuration screen you’ll be presented with two options: “Some Limits” and “Simple Finder.” “Simple Finder” generates a very limited Finder with limited access to folders—you don’t even see removable drives. “Some Limits” gives you full access but you can limit what applications and functions can be run. Well, that’s the theory.

OS X’s help on Parental Controls says (in part):

Restricting what users can do with the computer
If other people use your computer, you can restrict the access they have to the Mac OS X disk and applications you have installed.

For example, you can prevent users from:

Using certain installed applications

Further, it’s help on “Limited Finder’ says:

Setting up a simplified interface
Simple Finder is a simplified and protected interface for inexperienced users, such as young children. Simple Finder also prevents settings from being accidentally modified or files from being accidentally deleted.

Simple Finder provides the following features:

A control of the applications that the user can access.

Twice you, Mr & Mrs Parent, have been assured that “Finder and System” controls would stop your darling little Johnny from running any old application he wanted to. Problem is, you got complacent. You thought Microsoft on Macs would not be like Microsoft on PCs. You thought Microsoft would be security conscious on Macs. Pfft! Although, Apple did give them more than a little bit of help.

Apple left the back door open and Microsoft is beaconing for your kids to come on in and play with all those applications you don’t want them to.

Beating Parental Controls
It’s not a difficult process to circumvent and you only need a couple of tools for the job:
1 x Microsoft Office Suite (I’m using version v.X)
1 x 11 year old with experience in Microsoft Office Suite
1 x Limited account with access to Word, Excel or PowerPoint

If you don’t happen to have an 11 year old in the cupboard under your stairs, you’re in luck. But just in case, I’ll provide some general instructions.

Setup the account with either “Simple Finder”

or “Some Limits”. If it is using “Some Limits” this hack only works if you’ve got “Allow supporting programs” ticked in the “Some Limits” settings.

In the supposedly secure account:
- Launch Powerpoint.
- Create a custom slide action
- Select the “Run Program” option.
- In the subsequent Open dialog, navigate to the application you’d like to run and select it

- Run the slideshow, click on button you’ve created and viola, you’re flying.

You can also run applications from Word and Excel documents using the Insert Hyperlink function. You will have to manually type in the address of the application in the form file:///Applications/program.app where program.app is the application you want to run.

A clever young kid could easily set up a document with buttons all over it for applications he or she wanted to run.

Now, you’re probably wondering about other applications. I tried Pages, Keynote and The Print Shop 2. Pages and Keynote would launch Safari but rejected any hyperlink except an http one. Other attempts to access applications from within Pages and Keynote were prevented by access to applications being disabled. The Print Shop 2 doesn’t have any hyperlinking.

Here is what my Dock in the account with “Simple Finder” looks like a few minutes later. Bear in mind, PowerPoint is the only applicatiopn I’ve given this account access to. Excel was launched from PowerPoint’s Project Gallery, Pages from the PowerPoint hack and Safari from a hyperlink in Pages.

What’s to be done?
I’m not too concerned about every Mac-using-juvenile on the planet reading this piece and hacking their parents’ Macs. We’re too high-brow here at AM for the kids, with our elite writing and company jet, emblazoned with the Apple Matters logo (it makes it go faster). We’re just not on the same page. But hopefully someone from Apple will read this and remedy it. It’s not a fix that should wait until Leopard. And if Apple has known about this hack for a while (it also works in Panther) then that’s really poor. It’s a security issue and although not seemingly as threatening as hacks from the outside world, anyone who’s been involved in security knows that the biggest threat comes from within - especially from the fingers of inquisitive 11 year olds.

The big lesson in all of this though is, if you let Microsoft near a computer, it’ll find a way to bugger up its security.

Does anyone know any other applications that let you exploit this hole?

Footnote: Thanks to my 11yo, Isaiah, for showing he’s smarter than I’ll ever be. I’m sure if I gave him Boot Camp he’d have it running on a PPC Mac within a week (for the Aspergers and other literals among us - myself included - that’s a joke… it’d probably take him two weeks. Ok. I know. Running Boot Camp on PPC is impossible.)