Of course, the obvious solution is to randomize the location of the dynamic linker as well.

Just to prove I was listening..... Isn't random memory location of the dynamic linker one of the new security features believed to be in Snow Leopard - in which case this vulnerability goes away again :-)

Interesting - you can encrypt your VM in Mac OS X, so this means that if you use that particular security measure to protect your data from snooping, forensics will have no chance of detecting this exploit at all.

@ 2nd poster in the thread - Apple has known about the limitations of its memory randomisation since Leopard was first released and no, they won't fix it soon in 10.5.x or before the hack is revealed, but they are fixing it for 10.6

"It's only a matter of time".

People have been saying that for 8 years now. Still nothing's happened.

So, the Mac I use daily is not invulnerable to attack. That's not really news, is it? Apple were late to introduce address space randomisation, so it's no surprise that it isn't perfect yet. But like Microsoft, we should probably applaud them at least for acknowledging the problem (well, as much as Apple ever do, in that we can guess they've acknowledged it long after the fact from their subsequent actions) and beginning to tackle it?

and if its so easy, this kind of attack happens all the time on linux then, does it?

So, let's get this clear:

a- If there is currently a vulnerability in an application, and

b- if your system is unpatched, and

c- if you executed a program with a malicious payload, and

d- if this malicious payload took advantage of the new stealth technique

THEN you'll get infected, and it will very hard to trace it using common forensic techniques.

That's a tall order right there. The current situation is at "c", and malicious programs and infections are not that common. The new factor of stealth will not necessarily influence the availability of malicious attacks, only their detection.

You still need that proverbial virus that we've been promised.

-dZ.