Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking OSX Lion passwords

defenceindepth.net

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Cracking OSX Lion passwords

#21

Post by scott_s »

dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Not really. There's no privilege escalation. You can only change user's password if you're already logged-in as user. That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

Re: Cracking OSX Lion passwords

#22

Post by jessedhillon »

scott_s wrote: post #21
dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

Or run a malicious script?

Re: Cracking OSX Lion passwords

#23

Post by jessedhillon »

num1 wrote: post #13
tiles wrote: post #11

Earlier quoted context omitted.

Apple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as…

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

I downvoted not because you joked, but because you made patently untrue claims and then backed them up with a very poor methodology. So poor that you can't simultaneously be smart enough to read and understand this site and dumb enough to think it's logical to argue this way.

I conclude, therefore, that you're trolling.

Re: Cracking OSX Lion passwords

#24

Post by delinka »

itg wrote: post #19
KonradKlause wrote: post #2

TL;DR: There is no need to crack the password. You (as non-root user) can just reset the currently logged in user's password by calling: dscl localhost -passwd /Search/Users/bob

Has anyone tried this yet? One of the comments on that blog mention you still have to enter to old password in order to reset. $ dscl localhost -passwd /Search/Users/bob New Password: * Permission denied. Please enter user's old password:

If you are currently logged in as alice, this is correct. However, if you are logged in as bob, you are not prompted for the old password.

Re: Cracking OSX Lion passwords

#25

Post by scott_s »

jessedhillon wrote: post #22
scott_s wrote: post #21

Earlier quoted context omitted.

Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

Or run a malicious script?

There are far more damaging "malicious scripts" one could trick someone into running, such as "cd; rm -rf *".

Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege. I like Raymond Chen's take on the topic: http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...

Re: Cracking OSX Lion passwords

#26

Post by num1 »

scott_s wrote: post #18
num1 wrote: post #13

Earlier quoted context omitted.

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

There's a difference between recognizing a joke, and thinking it's funny.

Let's see how much karma I can lose in one thread.

There's a difference between not thinking a joke is funny, and arguing against it as if it weren't a joke, a la tiles.

Re: Cracking OSX Lion passwords

#27

Post by lawnchair_larry »

dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Apple doesn't compensate security researchers, so I am not disappointed or surprised. In fact, they just ignore people half the time.

If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.

Re: Cracking OSX Lion passwords

#28

Post by lawnchair_larry »

maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

Despite all the ranting on HN about bcrypt, pretty much no one actually uses it. Not linux, not windows, not apple.

Re: Cracking OSX Lion passwords

#29

Post by num1 »

jessedhillon wrote: post #23
num1 wrote: post #13

Earlier quoted context omitted.

Erm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On t…

I downvoted not because you joked, but because you made patently untrue claims and then backed them up with a very poor methodology. So poor that you can't simultaneously be smart enough to read and understand this site and dumb enough to think it's logical to argue this way. I conclude, therefore, that you're trolling.

I wasn't talking about the downvotes, that's to be expected. I was talking about the humorless replies :)

If we all acted our IQs, all the time, the world would be a very boring place. It's not responsible to buy myself expensive toys, it's not respectable to be sarcastic. Yet we do it anyway.

Trolling is meant to make people angry, I meant to to get a chortle out of at least somebody... but now I know, beyond a shadow of a doubt, that this is not the site for that. Thank you for helping me realize it.

Re: Cracking OSX Lion passwords

#30

Post by zdw »

maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

Apple uses a key strengthening algorithm on their passwords, similar in concept to Bcrypt - I think they've increased the number of rounds past the 1000 mentioned since this paper came out: http://people.cis.ksu.edu/~sakthi/src/data/filevault_sakthi....

If you've already compromised an account and have access as that user, it's likely that what you're going after isn't going to be their password...

... although, if you were to nab the password file and their keychain file (which contains passwords to other accounts that they access) which is generally encrypted with the same password (the system nags you if it's not the same), you could potentially do some real damage.

Post reply on HN