Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking OSX Lion passwords

defenceindepth.net

Post reply on HN
Print view View original

31–40 of 82 posts

Re: Cracking OSX Lion passwords

#31

Post by _hnwo »

lawnchair_larry wrote: post #27
dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Apple doesn't compensate security researchers, so I am not disappointed or surprised. In fact, they just ignore people half the time. If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.

Totally agree with this. Apple really ignore most security advisories, and I am speaking from experience.

Re: Cracking OSX Lion passwords

#32

Post by hmottestad »

SoftwareMaven wrote: post #20
moe wrote: post #12

Earlier quoted context omitted.

You can not decrypt Filevault that way, though.

Does this problem allow file vault access? Unless I read it wrong (totally reasonable in my jet lagged state), this won't reset your keychain either.

I'm wondering the same thing. I use filevault, but I don't feel like messing it up by changing the password this way.

I wonder if you can reset the password and use that password to simply disable the filevault.

Btw. My five cents. Write a script to: 1. change current users password to X 2. sudo "something really bad" 3. use password X

And there is a virus that can do anything on a mac. If you can change the password of the current user and he/she is an administrator, then any application can escalate to SU.

Re: Cracking OSX Lion passwords

#33

Post by _hnwo »

nknight wrote: post #14
rmc wrote: post #8

Earlier quoted context omitted.

It's bad, but it's not that bad. SHA is widely supported, and not that bad, yet. Also this is protecting desktop computers, where cracking hashes is not a common security problem. Getting the machine stolen in starbucks is probably much more common for this type of machine.

Macs are not used exclusively as desktops.

It would be interesting to see if this was possible in OSX Lion Server.

Re: Cracking OSX Lion passwords

#34

Post by hmottestad »

scott_s wrote: post #21
dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.

Re: Cracking OSX Lion passwords

#35

Post by [deleted] »

scott_s wrote: post #21
dotBen wrote: post #17

This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.

Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

[deleted]

Re: Cracking OSX Lion passwords

#36

Post by simcop2387 »

hmottestad wrote: post #32
SoftwareMaven wrote: post #20

Earlier quoted context omitted.

Does this problem allow file vault access? Unless I read it wrong (totally reasonable in my jet lagged state), this won't reset your keychain either.

I'm wondering the same thing. I use filevault, but I don't feel like messing it up by changing the password this way. I wonder if you can reset the password and use that password to simply disable the filevault. Btw. My five cents. Write a script to: 1. change current users password to X 2. sudo "something really bad" 3. use password X And there is a virus that can do anything on a mac. If you can change the password…

Yea with this I'd be worried about something doing that, making a new hidden user and then setting the password on the original account back leaving no immediately visible signs that anything is wrong.

Re: Cracking OSX Lion passwords

#37

Post by hackermom »

hmottestad wrote: post #34
scott_s wrote: post #21

Earlier quoted context omitted.

Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.

Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.

Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.

Re: Cracking OSX Lion passwords

#38

Post by hackermom »

lawnchair_larry wrote: post #28
maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

Despite all the ranting on HN about bcrypt, pretty much no one actually uses it. Not linux, not windows, not apple.

OpenBSD uses it :)

Re: Cracking OSX Lion passwords

#39

Post by KonradKlause »

lawnchair_larry wrote: post #28
maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

Despite all the ranting on HN about bcrypt, pretty much no one actually uses it. Not linux, not windows, not apple.

No, OpenSUSE for example is using bcrypt.

See: http://www.openwall.com/crypt/

Re: Cracking OSX Lion passwords

#40

Post by retanga »

num1 wrote: post #29
jessedhillon wrote: post #23

Earlier quoted context omitted.

I downvoted not because you joked, but because you made patently untrue claims and then backed them up with a very poor methodology. So poor that you can't simultaneously be smart enough to read and understand this site and dumb enough to think it's logical to argue this way. I conclude, therefore, that you're trolling.

I wasn't talking about the downvotes, that's to be expected. I was talking about the humorless replies :) If we all acted our IQs, all the time, the world would be a very boring place. It's not responsible to buy myself expensive toys, it's not respectable to be sarcastic. Yet we do it anyway. Trolling is meant to make people angry, I meant to to get a chortle out of at least somebody... but now I know, beyond a shad…

You're replying on the premise that your original comment (and maybe it's followup too) was humorous.

I assure you, that was not the case.

Post reply on HN