Skype stumbles with Leopard firewall change

Stephen Withers
Thursday, 08 November 2007 02:32

Your IT - Home IT

The new application firewall in Mac OS X 10.5 Leopard is causing problems for Internet software that checks its own integrity or that modifies itself. Skype is perhaps the most high-profile program to fall foul of this feature.

The Leopard firewall is disabled by default. When activated, it works by permitting or denying network access by individual applications. Another change is that when a user runs an application for the first time, the operating system attaches a digital signature to it as a way of telling whether it has been modified.

This means that once the user has granted the application permission to talk to the network, the firewall doesn't have to ask on future occasions because it can tell the program hasn't been altered or replaced. That stops malware breaching the firewall by masquerading as a known application. Any changes mean the signature no longer matches the application, and the operating system can block it.

So far, so good. But the signature is attached to the application, so what happens when a program has a similar built-in mechanism to detect tampering? Depending on exactly how that's done, it may see the signature attached by Leopard as a modification, and refuses to run. That, it seems, is what happens with World of Warcraft. It should be easy to fix by skipping over the Leopard signature when carrying out the integrity self-check.

A related problem arises when an application modifies itself when first run as part of the set-up process. That's not a good practice, and there are other locations set aside for installation-specific files. The application bundle itself is expected to be static.

And that's apparently where Skype falls foul of Leopard. The first time a user launches the program, the operating system adds a signature to the application before it starts running. Subsequently, Skype's 'first run' routines make changes to the application bundle, and the signature no longer matches. If the firewall is active, the next time Skype is launched the signature does not agree with the contents of the application bundle and the program is prevented from running.

Some pundits would have you believe this is Apple's fault. That might be true in the narrow sense that it was the last party to change something and therefore should shoulder the blame for any negative consequences, but having applications modify themselves is a depreciated practice.

So it's up to Skype to fix the issue. The nature of the self-modifications will determine how big a task that will be. The company is well aware of the problem, and is "working hard to come to a fix for this" according to Skype project manager Ryan Hunt.