Critical flaw forces Apple to push automatic Mac update for first time ever

[sincity]

Vulnerabilities in the ubiquitous Network Time Protocol (NTP) service have forced Apple to issue its first-ever automated security update for Mac OS X, a process that is common on Microsoft's Windows platform.

Apple has included that mechanism in its last three operating systems and is using it as a last-resort intervention.

The weaknesses were unearthed by Google researchers last week and have since been published by the US Department of Homeland Security as well as the Carnegie Mellon University Software Engineering Institute.

The Mac OS X update, which a spokesperson said is seamless and doesn't require a restart, will roll out on 10.10 Yosemite, 10.9 Mavericks, and 10.8 Mountain Lion.

Time splitters

NTP is used primarily to synchronise time on devices across networks and is a fundamental component of any connected operating system.

While there is no risk of data being compromised, it allows any remote attacker that uses a particular payload to execute malicious code, something that might be particularly useful to mount DDoS attacks.

NTP-based attacks usually cause more havoc because of a so-called amplication factor where a query sent by a device gets a response that's 1000x larger.