Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X sudoers exploit found in the wild

blog.malwarebytes.org

Post reply on HN
Print view View original

171–180 of 193 posts

Re: OS X sudoers exploit found in the wild

#171

Post by AdieuToLogic »

chjj wrote: post #116
AdieuToLogic wrote: post #77

Earlier quoted context omitted.

> That 'fix' is going to break a lot of other stuff. True, but a short-term replacement along the lines of: #!/bin/sh unset DYLD_PRINT_TO_FILE # Cleanse the sudo arguments here... # Check MD5 of /etc/sudoers against known good # value here... exec /usr/bin/the-renamed-sudo "$@" Would do the trick when put in the place of /usr/bin/sudo EDIT: Added the comments regarding sanity checks.

I'm not sure where you're going with this. That `unset` is useless since they don't call sudo to initiate the exploit. The setuid/setgid bits on the newgrp binary are to blame here (combined with the env variable). They could just overwrite your new /usr/bin/sudo file if they wanted to. Hell, they could brick your entire system just out of spite. No sudo necessary.

> I'm not sure where you're going with this.

My point was to show that this very nasty exploit can be mitigated in the short-term by introducing a wrapper script to "protect" setuid programs.

> That `unset` is useless since they don't call sudo to initiate the exploit. The setuid/setgid bits on the newgrp binary are to blame here (combined with the env variable).

You are quite right. In an effort to be concise, the example wrapper unset the environment variable (for completeness) and mentioned checking /etc/sudoers against a known-good hash. I did not properly explain the mitigation strategy and should have stated that wrapping and unsetting the environment variable should be done for all setuid programs. Doing so should block this attack vector until a vendor supplied patch is available.

Is it an ugly hack? Probably. Doable, though, and I believe capable of defending against this particular vulnerability.

Re: OS X sudoers exploit found in the wild

#172

Post by glhaynes »

noondip wrote: post #170
glhaynes wrote: post #162

Earlier quoted context omitted.

I haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?

Sorry for not making this more clear. Create a shell script with the exploit, then remove the .sh extension. You can edit the icon to make it appear as any application and when double-clicked it will open and run in Terminal.app.

Ah, thanks for clarifying. I suppose it wouldn't have execute permissions if downloaded from a browser, but it could if copied with Finder from a network share (or directly accessed, of course), so that sounds like a potential vector.

Re: OS X sudoers exploit found in the wild

#173

Post by coldtea »

zamalek wrote: post #136
coldtea wrote: post #127

Earlier quoted context omitted.

> The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? Perhaps because ever since 2001 there are 5-6 new stories like this with huge scaremongering headlines and "sky is falling" implications, and then NOTHING absolutely happens, at worse a tiny mini…

> "sky is falling" implications, and then NOTHING absolutely happens Sure, just brush off a sudo vulnerability. > fight viruses off of Windows boxes Virus != vulnerability. Furthermore, while a rootkit is still a virus it's a long-shot from the relatively benign things running around on Windows machines (not that I mentioned Windows at first, but there ya' go - were on to that now). Just to avoid a Windows shitstorm,…

>Sure, just brush off a sudo vulnerability.

If it doesn't impact me, and has never had, I will. Just like I don't feel any need to run antivirus and anti-spyware on my Ubuntu box, whereas I do on any Windows box 1 own (3 of them).

>Virus != vulnerability.*

Well, the vulnerability has to be exploited to matter. Either by some virus, some hackers, some malware, creating a botnet, whatever. If it never does, or its always in the form of some trojan needing a stupid user to install it willingly, I don't care about it.

The mere existance of it is not really important. All systems had, have and will have some vulnerabilities.

I'm not some wide eyed believer in the invulnerability of OS X. I've cut my teeth on Sun OS (pre Solaris) and HP-UX, and I've run Linux since 1997.

I just don't care much for hypotheticals.

As for my data, I back them up. I can go back to a clean system, if anything happens, within 10 minutes with rolling archived bootable backups. And I re-install from scratch + dumb data in around 5 hours (I just did it a few weeks ago to try El Capitan).

>Security is like a backup. You only care about it when you have the random bad experience of actually needing it. I'm sure there are a bunch of Windows users who lament turning off UAC now that their files are all encrypted by ransomware. It has nothing to do with "market share" and has everything to do with risk: "UAC is such a stupid feature."

Well, it's kinda stupid. Even with UAC enabled the same users would just have gone ahead and authorized it to install the malware in the first place, not knowing what it is and just wanting to get it out of the way.

Besides, if they had earlier backups of said files, removing the ramsonware and restoring the original files would be a few minutes affair.

>I could leave my keys in my car ignition every night of my life.

And if you live in certain countries where car theft rarely or never happens, you'll be justified too.

There are countries were people sleep and even leaves their house with the doors unlocked and windows open.

Not because theft is impossible -- just because it's rare enough that barely even registers, and they don't feel any need to be paranoid.

It's a healthy lifestyle, even if 1 in 100.000 has something stolen from time to time.

Heck, it's healthy even if it's you that has had that misfortune.

Re: OS X sudoers exploit found in the wild

#174

Post by Riseed »

sillygeese wrote: post #111
krisgenre wrote: post #110

Earlier quoted context omitted.

Are you saying the government is extorting in the name of taxes? Taxes are important because some things ( like laying roads ) cannot be selectively implemented. You can't just ask some to pay for the road and the rest not to use it.

I'm saying taxation is extortion, and just as immoral as when a mafia does it. You're trying to justify extortion with things that are built with extorted money, but could be built without extorting people too. > You can't just ask some to pay for the road and the rest not to use it. You could just build a road and then ask people to pay for using it, much like you can build an iPhone and ask people to pay for one if…

> You could just build a road and then ask people to pay for using it, much like you can build an iPhone and ask people to pay for one if they want it.

Or much like toll existing roads/bridges [e.g. Golden Gate Bridge, Pennsylvania Turnpike, M6 Toll, German Autobahn (as of 2016)].

Re: OS X sudoers exploit found in the wild

#175

Post by Riseed »

krisgenre wrote: post #110
sillygeese wrote: post #106

Earlier quoted context omitted.

> Do Apple employees not drive cars on roads (paid for by the taxpayer)? If a mafia built roads, would that make its extortion alright? > Of course Apple avoid taxes - anyone who can do so without fear of getting significantly punished does Exactly. Think about that for a while there. You're basically saying that no one would pay taxes without being forced to . Would anyone pay a mafia protection money without being…

Are you saying the government is extorting in the name of taxes? Taxes are important because some things ( like laying roads ) cannot be selectively implemented. You can't just ask some to pay for the road and the rest not to use it.

> You can't just ask some to pay for the road and the rest not to use it.

I believe that's precisely how tolls work.

Re: OS X sudoers exploit found in the wild

#176

Post by charonn0 »

AdieuToLogic wrote: post #71
chjj wrote: post #40

I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS (a one-liner in bash). Why in the world would they allow an env variable to write to a file in a setuid'd binary? I'm suddenly very glad I don't use my macbook as my main machine, but I guess I'll remove the set{u,g}id bits on newgrp for now. Don't know if that will break things, but it's bette…

> I'm seriously shocked. This is ridiculous. This looks like possibly the easiest root exploit ever discovered on a desktop OS ... Ignoring the nonexistent "root" privileges on Windows-95 (which allowed anything to change anything it felt like ), also one of the easiest to fix: mv /usr/bin/sudo /usr/bin/some-other-name-that-you-like-and-there-ya-go

I'm not sure why you would bring up Windows 95. Aside from being two decades old, it never claimed to be secure or a multi-user OS. Security-wise, I don't see how it was worse than Apple's contemporary System 7.

Re: OS X sudoers exploit found in the wild

#177

Post by Riseed »

sillygeese wrote: post #124
summerdown2 wrote: post #117

Earlier quoted context omitted.

> I'm saying taxation is extortion, and just as immoral as when a mafia does it. This is a ridiculous comment. I realise the social contract has broken down somewhat in recent years but if you can't see the difference between Mafia extortion and government taxation there's something wrong. Here's just one difference: we can vote for the government.

> Here's just one difference: we can vote for the government. So what? Go ahead and tell me how and why that matters with regard to taxation itself. Again, if a mafia let you vote for the new mafia boss, would that make extortion alright? Would it be good to be bossed around by a mafia boss you voted for? Would getting elected make it alright for him to extort you? You do realize they're still taking your money by fo…

> What difference does it make that you drop a piece of paper into a box once every few years?

The difference is that having choice of candidates can easily distract those voting from the larger picture. http://sadmoment.com/sheep-on-voting-for-a-lion-or-a-wolf-on...

Re: OS X sudoers exploit found in the wild

#178

Post by itistoday2 »

sillygeese wrote: post #125
Ntrails wrote: post #119

Earlier quoted context omitted.

And the police? Fire departments? Social security? Town planning/maintenance/social policy/etc etc etc. Essentially the only system without tax is anarchy, and if you are bona fide advocating that - well I wish you the best of luck in your brave new world.

> And the police? Fire departments? Social security? I know, it's like.. how could supermarkets sell you ice-cream without 330 million people getting extorted?! It's ridiculous!

Hey sillygeese, whoever you are, just wanted you to know that I upvoted your comments.

Keep up the good fight!

Your position is a totally legitimate one.

Anyone who objects to how the government uses their money is totally in their right to refuse to pay taxes.

Given today's technology, governments have no excuses left.

Re: OS X sudoers exploit found in the wild

#179

Post by davepeck »

13 wrote: post #33
andykellr wrote: post #4

Earlier quoted context omitted.

On public wifi, I use https://www.getcloak.com I also uninstalled Flash.

Why do you trust Amazon AWS and this company more than your own connection?

We're a well-known company with an earned reputation for doing the right thing.

Not everyone can set up their own VPN endpoint. For those who can, and are willing to maintain it, great!

More: https://blog.getcloak.com/2013/03/04/why-trust-matters-when-...

(And what does AWS have to do with anything?)

Re: OS X sudoers exploit found in the wild

#180

Post by danudey »

rosser wrote: post #10
frio wrote: post #7

Earlier quoted context omitted.

Little Snitch ( https://www.obdev.at/products/littlesnitch/index.html ) is excellent.

As a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now ?!" saturation. My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...

I really wish Little Snitch could generate aggregate rules for apps. I keep having situations where an app starts making requests over and over until I realize that the developer is using https requests to cdn###.somehost.com where ### is apparently a dozen or more different hosts, and the only option I have is to just allow all https traffic rather than more granular by-host rules.
Post reply on HN