Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yet another macOS privacy protections bypass

lapcatsoftware.com

Post reply on HN
Print view View original

31–40 of 94 posts

Re: Yet another macOS privacy protections bypass

#31

Post by saagarjha »

floatingatoll wrote: post #15
Wowfunhappy wrote: post #5

Earlier quoted context omitted.

My thoughts exactly. If this was just an overlooked bug, which was reported to Apple and which Apple then fixed, that would be the system working as intended. In reality, a very simple bug was reported more than a year ago, and Apple apparently hasn't cared enough to fix it. The only way I can interpret that is to conclude Apple doesn't really care about the integrity of their sandbox. IMO, this more than justifies t…

> The only way I can interpret that is to conclude Apple doesn't really care about the integrity of their sandbox. There are many other ways to interpret it. Here is one completely made-up example that I created just now for this reply: "Apple can't lock this down further without breaking open() calls in the majority of existing applications; therefore, they made a pragmatic choice to allow this issue to exist until…

> while declining to share their decision with the reporter, as is completely normal for Apple

This is completely normal for Apple, but that doesn’t make it OK for them to treat security fixes like product launches where they can choose an arbitrary timeline and keep the reporter hanging forever.

Re: Yet another macOS privacy protections bypass

#32

Post by vevans »

sofixa wrote: post #26
Toutouxc wrote: post #25

Okay, this is a serious issue and I want this to be taken seriously by Apple. What can I, as a reader, do? Is there someone to forward this to? Is there a person in Apple to email? Or are we hoping for a tweet storm to stir the water?

"vote with your wallet" would say some purists.

I don’t know that voting with your wallet works with the richest company in the world, especially when a lot of professionals have to have their devices to do their jobs.

Re: Yet another macOS privacy protections bypass

#33

Post by fbelzile »

IceWreck wrote: post #8

> I chose the example of ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! Also note that the output of long format ls -l contains the last modification date of the files. Thus, one possible privacy violation from this technique is to learn the user's web browsing history. Its a pretty serious issue if any random app can read your browsing histor…

No, not any random app. You knowingly chose to install the app. It either came from the App Store or it was notarized by Apple.

There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me because they "caught" me trying to "steal their data" if they add restrictions to this folder?

Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good.

I agree with the blog post. Apple seems to be more focused with "security theatre" right now (or at least half-assed security for the sake of marketing). They do things like add easy-to-implement (via their FileManager class) file access warnings to appease most non-technical users. But at the same time ignore bigger looming threats like apps accessing the Internet. I think the issue isn't the warnings, it's what the warnings are about.

Anyway, my guess is that Apple will be adding network access warnings in the future (since it seems they re-wrote a large chunk of the networking code recently) but let's not deny the two-faced marketing speak going on right now and fact that they do stuff like making it impossible to inspect network traffic from Apple apps. The hand-wavy "trust us" argument shouldn't work for Apple either. Why do I have to trust Apple more than a third party developer?

Re: Yet another macOS privacy protections bypass

#34

Post by vkou »

Toutouxc wrote: post #25

Okay, this is a serious issue and I want this to be taken seriously by Apple. What can I, as a reader, do? Is there someone to forward this to? Is there a person in Apple to email? Or are we hoping for a tweet storm to stir the water?

Now that this issue has hit HN, I expect it to be patched quickly.

The problem that is hard to solve is 'what does Apple do about issues that don't hit HN?'

Re: Yet another macOS privacy protections bypass

#35

Post by boogies »

fbelzile wrote: post #33
IceWreck wrote: post #8

> I chose the example of ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! Also note that the output of long format ls -l contains the last modification date of the files. Thus, one possible privacy violation from this technique is to learn the user's web browsing history. Its a pretty serious issue if any random app can read your browsing histor…

No, not any random app. You knowingly chose to install the app. It either came from the App Store or it was notarized by Apple. There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me beca…

> Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good.

Browsing history is not sensitive‽

Re: Yet another macOS privacy protections bypass

#36

Post by codezero »

boogies wrote: post #35
fbelzile wrote: post #33

Earlier quoted context omitted.

No, not any random app. You knowingly chose to install the app. It either came from the App Store or it was notarized by Apple. There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me beca…

> Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. Browsing history is not sensitive‽

I think they are implying apple can’t control the sensitivity of third party tools across the board, so it’s up to chrome to figure out how to protect your browsing history, and they need to improve their file system layout or APIs to protect their users.

Re: Yet another macOS privacy protections bypass

#37

Post by boogies »

codezero wrote: post #36
boogies wrote: post #35

Earlier quoted context omitted.

> Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. Browsing history is not sensitive‽

I think they are implying apple can’t control the sensitivity of third party tools across the board, so it’s up to chrome to figure out how to protect your browsing history, and they need to improve their file system layout or APIs to protect their users.

>third party tools

>it’s up to chrome

https://news.ycombinator.com/item?id=25267165:

> ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! [emphasis added]

Re: Yet another macOS privacy protections bypass

#38

Post by johncolanduoni »

coldtea wrote: post #11

> I continue to believe that macOS "security" is mainly theater that only impedes the law-abiding Mac software industry while posing little problem for Mac malware. It doesn't take a genius hacker to bypass macOS privacy protections: calling "ls" is a script kiddie level attack. And doing something useful with it, to the level of malware? Is that also trivial? Also, how would that "script kiddie" do that attack in th…

This limitation also applies to the Safari and Chrome sandboxes on macOS. Being able to get metadata like this off of the system of someone who warrants buying a V8 vulnerability to attack them seems like a reasonable possibility to me.

Re: Yet another macOS privacy protections bypass

#39

Post by joshstrange »

comex wrote: post #12

Quick note: The report makes it sound like /bin/ls is being given special privileges. That would be reminiscent of many past macOS security issues: processes are treated differently based on their code signature and entitlements, and sometimes that has unexpected consequences. But that's not the case here. /bin/ls has no entitlements. And if I modify the sample project to just call stat() directly rather than invokin…

> That would be reminiscent of many past macOS security issues: processes are treated differently based on their code signature and entitlements, and sometimes that has unexpected consequences.

Hmm, I wonder if this is the root cause of something my friend group found in high school. We had macs that were locked down and I think it was something the system did vs third-party software but I could be mistaken. Pretty much you could only launch certain applications and you couldn't edit and preferences/settings for the system. Being kids we wanted to play Starcraft so I brought in a bunch of copies to play during our free period. Unfortunately you couldn't launch the Starcraft app. I still don't remember how we even figured it out but you could go into Safari and change the default browser to Terminal, then you could open up a word doc, type a link, and click it (or anything that would cause the system to open a link when you weren't already in a browser). That would launch Terminal but with a level of permissions that you couldn't get by launching it directly (or maybe it was that we couldn't even open Terminal directly, it's been a while). Once you had this "system-permissions-Terminal" launched you could type "open /path/to/Starcraft/launcher" and boom, Starcraft would launch and it was off the races.

Good times. Our teacher questioned how we could play games and if it was allowed but was placated with the explanation "The computers are all locked down so the ability to play this game means it must be ok to play". A bit of circular-logic and misdirection but this was still in period where all the teachers were woefully behind on technology and how it worked.

Re: Yet another macOS privacy protections bypass

#40

Post by jmnicolas »

sofixa wrote: post #26
Toutouxc wrote: post #25

Okay, this is a serious issue and I want this to be taken seriously by Apple. What can I, as a reader, do? Is there someone to forward this to? Is there a person in Apple to email? Or are we hoping for a tweet storm to stir the water?

"vote with your wallet" would say some purists.

I have voted with my wallet since the 90s. As you can see Apple bottom line was deeply affected.
Post reply on HN