Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking OSX Lion passwords

defenceindepth.net

Post reply on HN
Print view View original

11–20 of 82 posts

Re: Cracking OSX Lion passwords

#11

Post by tiles »

num1 wrote: post #7
maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

You're using an apple product. When did they ever claim to be secure? Your life is easier, more magical, full of glass, and very fast! Security is... a little bit of whipped cream on top. So enjoy your gestures on that magic touchpad, don't worry about being safe. (Sorry, I couldn't resist)

Apple doesn't ignore security, they advertise security enhancements in their products:

"Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack."

"Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as opening documents or accessing the network. Sandboxing makes it more difficult for a security threat to take advantage of an issue in a specific application to affect the greater system."

Part of OS X Lion's new features: http://www.apple.com/macosx/whats-new/features.html#security

Re: Cracking OSX Lion passwords

#12

Post by moe »

maximilian wrote: post #5
drivebyacct2 wrote: post #3

I suppose it's different if an unauthenticated user can perform a password change with the system powered on, but similar things can be done with Windows and a Linux live cd with some tools, and Linux passwords can be changed in "single user" mode.

You can also just pop in the OS X cd and change the password at boot.

You can not decrypt Filevault that way, though.

Re: Cracking OSX Lion passwords

#13

Post by num1 »

tiles wrote: post #11
num1 wrote: post #7

Earlier quoted context omitted.

You're using an apple product. When did they ever claim to be secure? Your life is easier, more magical, full of glass, and very fast! Security is... a little bit of whipped cream on top. So enjoy your gestures on that magic touchpad, don't worry about being safe. (Sorry, I couldn't resist)

Apple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as…

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking.

I would like to point out though, that the text you just copied are pretty much apple's only words on the topic.

To further my joke even more:

Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results.

On the internet easy returns 3.6 billion results, and secure 1.25 billion. So on the apple site, you would expect easy to show up 3 times as much as secure. In fact, easy shows up over 6 times as much as secure.

This definitely proves apple cares about security only half as much as the rest of the internet does!

Re: Cracking OSX Lion passwords

#14

Post by nknight »

rmc wrote: post #8
maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

It's bad, but it's not that bad. SHA is widely supported, and not that bad, yet. Also this is protecting desktop computers, where cracking hashes is not a common security problem. Getting the machine stolen in starbucks is probably much more common for this type of machine.

Macs are not used exclusively as desktops.

Re: Cracking OSX Lion passwords

#15

Post by starpilot »

num1 wrote: post #13
tiles wrote: post #11

Earlier quoted context omitted.

Apple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as…

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

Does netcraft confirm that?

Re: Cracking OSX Lion passwords

#16

Post by num1 »

num1 wrote: post #13
tiles wrote: post #11

Earlier quoted context omitted.

Apple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as…

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

checking netcraft is left as an exercise for the reader

Re: Cracking OSX Lion passwords

#17

Post by dotBen »

This feels a little bit like a naughtily published zero-day exploit.

I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Re: Cracking OSX Lion passwords

#18

Post by scott_s »

num1 wrote: post #13
tiles wrote: post #11

Earlier quoted context omitted.

Apple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as…

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

There's a difference between recognizing a joke, and thinking it's funny.

Re: Cracking OSX Lion passwords

#19

Post by itg »

KonradKlause wrote: post #2

TL;DR: There is no need to crack the password. You (as non-root user) can just reset the currently logged in user's password by calling: dscl localhost -passwd /Search/Users/bob

Has anyone tried this yet? One of the comments on that blog mention you still have to enter to old password in order to reset.

$ dscl localhost -passwd /Search/Users/bob

New Password: *

Permission denied. Please enter user's old password:

Re: Cracking OSX Lion passwords

#20

Post by SoftwareMaven »

moe wrote: post #12
maximilian wrote: post #5

Earlier quoted context omitted.

You can also just pop in the OS X cd and change the password at boot.

You can not decrypt Filevault that way, though.

Does this problem allow file vault access? Unless I read it wrong (totally reasonable in my jet lagged state), this won't reset your keychain either.
Post reply on HN