Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X sudoers exploit found in the wild

blog.malwarebytes.org

Post reply on HN
Print view View original

71–80 of 193 posts

Re: OS X sudoers exploit found in the wild

#71

Post by AdieuToLogic »

chjj wrote: post #40

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary? I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's bette…

> I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS ...

Ignoring the nonexistent "root" privileges on Windows-95 (which allowed anything to change anything it felt like), also one of the easiest to fix:

  mv /usr/bin/sudo /usr/bin/some-other-name-that-you-like-and-there-ya-go

Re: OS X sudoers exploit found in the wild

#72

Post by marquis »

odonnellryan wrote: post #52

For anyone looking for the patch: https://github.com/sektioneins/SUIDGuard

Is there a test to determine if the patch is successful?

Edit: as noted in Esser's blog [1]: $ EDITOR=/usr/bin/true DYLD_PRINT_TO_FILE=/this_system_is_vulnerable crontab -e

I found this test failed in both a patched (10.10.4) and un-patched system (10.10.1) so not sure what these results mean.

[1] https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_fi...

Re: OS X sudoers exploit found in the wild

#73

Post by noondip »

glhaynes wrote: post #29
noondip wrote: post #24

Earlier quoted context omitted.

One could easily make an "app" which just runs a shell script with this exploit - no code signing needed.

And users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.

I'm getting at the fact a shell script with this exploit can be made to look like an "app" and be "double-clickable", and doesn't require any code signing.

Re: OS X sudoers exploit found in the wild

#74

Post by NeutronBoy »

AdieuToLogic wrote: post #71
chjj wrote: post #40

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary? I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's bette…

> I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS ... Ignoring the nonexistent "root" privileges on Windows-95 (which allowed anything to change anything it felt like ), also one of the easiest to fix: mv /usr/bin/sudo /usr/bin/some-other-name-that-you-like-and-there-ya-go

That 'fix' is going to break a lot of other stuff.

Re: OS X sudoers exploit found in the wild

#75

Post by [deleted] »

AdieuToLogic wrote: post #71
chjj wrote: post #40

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary? I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's bette…

> I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS ... Ignoring the nonexistent "root" privileges on Windows-95 (which allowed anything to change anything it felt like ), also one of the easiest to fix: mv /usr/bin/sudo /usr/bin/some-other-name-that-you-like-and-there-ya-go

[deleted]

Re: OS X sudoers exploit found in the wild

#76

Post by x0x0 »

chjj wrote: post #40

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary? I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's bette…

It's a good contender, but in 10.2, you could hold down a key in the screen saver lock screen and overflow a buffer, crashing the screensaver and logging you in. Seriously. Not a root exploit but embarrassing.

http://www.cvedetails.com/cve/CVE-2003-0518/

btw, discoverer claims to have written a kext fixing the hole

http://www.sektioneins.de/blog/15-07-07-dyld_print_to_file_l...

Re: OS X sudoers exploit found in the wild

#77

Post by AdieuToLogic »

NeutronBoy wrote: post #74
AdieuToLogic wrote: post #71

Earlier quoted context omitted.

> I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS ... Ignoring the nonexistent "root" privileges on Windows-95 (which allowed anything to change anything it felt like ), also one of the easiest to fix: mv /usr/bin/sudo /usr/bin/some-other-name-that-you-like-and-there-ya-go

That 'fix' is going to break a lot of other stuff.

> That 'fix' is going to break a lot of other stuff.

True, but a short-term replacement along the lines of:

  #!/bin/sh
  unset DYLD_PRINT_TO_FILE

  # Cleanse the sudo arguments here...

  # Check MD5 of /etc/sudoers against known good
  # value here...

  exec /usr/bin/the-renamed-sudo "$@"
Would do the trick when put in the place of /usr/bin/sudo

EDIT: Added the comments regarding sanity checks.

Re: OS X sudoers exploit found in the wild

#78

Post by byset »

kordless wrote: post #67
code_sterling wrote: post #36

Earlier quoted context omitted.

You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out. I'm sure we can all agree, you should have locked your door. Why be mad at your neig…

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.

Well, I mean, there were consequences--as the article said, there's now malware out there that uses the exploit this guy publicized.

Re: OS X sudoers exploit found in the wild

#79

Post by 616c »

frio wrote: post #7
mey wrote: post #3

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recommend as security software for OSX currently? How do you help secure your devices from public wifi and the internet in general? Especially for novice users?

Little Snitch ( https://www.obdev.at/products/littlesnitch/index.html ) is excellent.

Our old infosec guy at work used the icefloor PF management tool at work. It seemed interesting, and I mention it in the vein of the venerable Little Snitch.

http://www.hanynet.com/icefloor/

Re: OS X sudoers exploit found in the wild

#80

Post by jakobegger »

noondip wrote: post #73
glhaynes wrote: post #29

Earlier quoted context omitted.

And users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.

I'm getting at the fact a shell script with this exploit can be made to look like an "app" and be "double-clickable", and doesn't require any code signing.

Gatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.
Post reply on HN