Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X sudoers exploit found in the wild

blog.malwarebytes.org

Post reply on HN
Print view View original

31–40 of 193 posts

Re: OS X sudoers exploit found in the wild

#31

Post by x0054 »

flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

Could you explain the dual-use export issue. I read a little about it here [1], but I don't understand. So, if Esser was to contact Apple and provide them with the vulnerability info for free, but with out first registering it as a dual-use export, he could get in trouble? Even if he didn't receive any compensation from Apple? Is that the case?

[1] https://www.justsecurity.org/5703/export-control-arrangement...

Re: OS X sudoers exploit found in the wild

#32

Post by enneff »

lawnchair_larry wrote: post #27
flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

https://en.wikipedia.org/wiki/Responsible_disclosure

Re: OS X sudoers exploit found in the wild

#33

Post by 13 »

andykellr wrote: post #4
mey wrote: post #3

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recommend as security software for OSX currently? How do you help secure your devices from public wifi and the internet in general? Especially for novice users?

On public wifi, I use https://www.getcloak.com I also uninstalled Flash.

Why do you trust Amazon AWS and this company more than your own connection?

Re: OS X sudoers exploit found in the wild

#34

Post by acomjean »

lawnchair_larry wrote: post #27
flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not.""

So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..

Re: OS X sudoers exploit found in the wild

#35

Post by geofft »

flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

Dynamic linkers trusting variables during setuid operation has long been a place known to be security-sensitive (or alternatively a fruitful source of privilege escalation bugs; see CVE-2010-3847 re LD_AUDIT, http://seclists.org/bugtraq/2004/Aug/281 re LD_DEBUG, CVE-1999-1182 (!) re LD_DEBUG, etc.). The bug had never been particularly hidden from those with a malicious eye.

Frankly, I find myself reading dyld's source code every so often when tracking down something or another with OS X program loading. I'm not saying I would have caught it, but I'm pretty sure I'm not the only one who reads it non-maliciously.

Furthermore, it was fixed in 10.11 betas, so Apple themselves already knew about it [edit: apparently not]:

https://twitter.com/i0n1c/status/624103245233917952

Re: OS X sudoers exploit found in the wild

#36

Post by code_sterling »

lawnchair_larry wrote: post #27
flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out.

I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...

Re: OS X sudoers exploit found in the wild

#37

Post by 13 »

acomjean wrote: post #34
lawnchair_larry wrote: post #27

Earlier quoted context omitted.

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not."" So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..

Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.

Re: OS X sudoers exploit found in the wild

#38

Post by geofft »

cmurf wrote: post #16
linky123 wrote: post #14

Earlier quoted context omitted.

Keeping the OS up to date wouldn't have helped with this.

I know that. Overwhelmingly in most cases it does help though, probably more than anything else short of air gapping the thing.

You can also install another OS. Putting an Ubuntu LTS or Debian stable on it will help you way more, compared to OS X 10.9.5, than any number of other mitigation strategies.

Frankly, I'm way more comfortable taking my Windows 8.1 machine to public wifi hotspots these days than my OS X 10.9 machine.

Re: OS X sudoers exploit found in the wild

#39

Post by acomjean »

geofft wrote: post #35
flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

Dynamic linkers trusting variables during setuid operation has long been a place known to be security-sensitive (or alternatively a fruitful source of privilege escalation bugs; see CVE-2010-3847 re LD_AUDIT, http://seclists.org/bugtraq/2004/Aug/281 re LD_DEBUG, CVE-1999-1182 (!) re LD_DEBUG, etc.). The bug had never been particularly hidden from those with a malicious eye. Frankly, I find myself reading dyld's sourc…

Repost from the comments in the original article indicates it may have be fixed because apple changed something in the way it handles permissions.

>EdisonCarter 3 days ago

>It's only really "fixed" in El Capitan as a side effect of Apple introducing the new - and widely reported - "rootless" security feature which introduces fine grained file permissions.

Re: OS X sudoers exploit found in the wild

#40

Post by chjj »

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary?

I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's better than getting a rootkit.

Post reply on HN