OS X sudoers exploit found in the wild • Hacker News Board

Re: OS X sudoers exploit found in the wild

#161

Post by flyryan » Fri, Aug 07, 2015, 3:31 PM UTC

frio wrote: post #7

mey wrote: post #3

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recommend as security software for OSX currently? How do you help secure your devices from public wifi and the internet in general? Especially for novice users?

Little Snitch ( https://www.obdev.at/products/littlesnitch/index.html ) is excellent.

Patrick Wardle dropped two Little Snitch bypasses at BlackHat [1] this year.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-W... [PDF Warning]

Re: OS X sudoers exploit found in the wild

#162

Post by glhaynes » Fri, Aug 07, 2015, 3:36 PM UTC

noondip wrote: post #147

jakobegger wrote: post #80

Earlier quoted context omitted.

Gatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.

You're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.

I haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?

Re: OS X sudoers exploit found in the wild

#163

Post by spike021 » Fri, Aug 07, 2015, 3:58 PM UTC

_pmf_ wrote: post #84

flashman wrote: post #21

I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. Disclosures make caree…

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. > Esser has his reasons - "Sh…

I have a 2011 Macbook Pro. Sure it doesn't get AppNap or a few other small features, even if I've installed an SSD, but OS-wise I've been able to install all updates since I bought it. It's still supported, especially hardware-wise when I had a couple issues with it.

Re: OS X sudoers exploit found in the wild

#164

Post by muaddirac » Fri, Aug 07, 2015, 3:59 PM UTC

Will a major OS vendor ever start taking object-capability ideas seriously? It seems this is part of a class of vulnerabilities that simply couldn't occur under that model.

Re: OS X sudoers exploit found in the wild

#165

Post by JonnieCache » Fri, Aug 07, 2015, 4:13 PM UTC

mey wrote: post #3

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recommend as security software for OSX currently? How do you help secure your devices from public wifi and the internet in general? Especially for novice users?

TCPBlock is a free version of little snitch. It's apparently abandoned, but it doesn't need any more features.

http://www.macupdate.com/app/mac/35914/tcpblock

You can set it up to disallow all network traffic until you whitelist the binary. Not sure if it's actually hashing them or just checking the path though.

Re: OS X sudoers exploit found in the wild

#166

Post by Angostura » Fri, Aug 07, 2015, 4:26 PM UTC

spike021 wrote: post #163

_pmf_ wrote: post #84

Earlier quoted context omitted.

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. > Esser has his reasons - "Sh…

I have a 2011 Macbook Pro. Sure it doesn't get AppNap or a few other small features, even if I've installed an SSD, but OS-wise I've been able to install all updates since I bought it. It's still supported, especially hardware-wise when I had a couple issues with it.

2007 iMac running the most recent OS here.

Re: OS X sudoers exploit found in the wild

#167

Post by kordless » Fri, Aug 07, 2015, 4:32 PM UTC

hueving wrote: post #89

kordless wrote: post #67

Earlier quoted context omitted.

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.

At least read about responsible disclosure before being so flippant about things like that. Esser put people at risk. Whether or not anything happens is irrelevant. He put them at risk and we need to recognize that is the cost of full disclosure. If you're fine with that, cool, but don't pretend he didn't do anything.

> read about responsible disclosure

Stop presuming I haven't.

> Esser put people at risk.

That's non-provable until we see it instantiated.

> If you're fine with that, cool, but don't pretend he didn't do anything.

Don't speak for me. I never said he did the right thing. I said stop spinning what-ifs about it, but clearly what I should have said is STFU and do something about it. People getting in each other's grill isn't doing something about it. It's blaming others for whatever issues we, as a group, find polarizing.

Re: OS X sudoers exploit found in the wild

#168

Post by kordless » Fri, Aug 07, 2015, 4:37 PM UTC

byset wrote: post #78

kordless wrote: post #67

Earlier quoted context omitted.

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.

Well, I mean, there were consequences--as the article said, there's now malware out there that uses the exploit this guy publicized.

Actually that's not a consequence. A consequence is "200K credit cards were stolen and created $50M in losses". Our assumptions (nay, EXPECTATIONS) that we can achieve a perfect record for responsible disclosure is akin to dissonance, which is why this topic is so polarizing. Let's save the judgement of him until we have evidence that shows why what he did is wrong. Until then, this is all a waste of effort.

Re: OS X sudoers exploit found in the wild

#169

Post by kordless » Fri, Aug 07, 2015, 4:41 PM UTC

chippy wrote: post #104

kordless wrote: post #69

I seriously wonder if issues that have highly polarized responses aren't some sort of rip in reality.

..well, it's not cognitive dissonance - it's not holding two contradictory thoughts, it's more a refusal to believe and more so a defence of investment. Early innovators, technologists and many Hacker Newsers have spent thousands in both time and money on Apple. To attack Apple attacks their investment leading to defensive behaviour. To think to yourself "oh, now I'm going to ditch Apple and choose Linux" causes psyc…

Dissonance is harder to resolve than it is to 'deal with'. I'd say you are on the mark with your last two statements and wrong about it not being cognitive dissonance. I can only claim that because I spend an inordinate amount of time thinking about it in terms of cloud services and trust. :)

Re: OS X sudoers exploit found in the wild

#170

Post by noondip » Fri, Aug 07, 2015, 5:03 PM UTC

glhaynes wrote: post #162

noondip wrote: post #147

Earlier quoted context omitted.

You're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.

I haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?

Sorry for not making this more clear. Create a shell script with the exploit, then remove the .sh extension. You can edit the icon to make it appear as any application and when double-clicked it will open and run in Terminal.app.