Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking OSX Lion passwords

defenceindepth.net

Post reply on HN
Print view View original

41–50 of 82 posts

Re: Cracking OSX Lion passwords

#41

Post by dchest »

zdw wrote: post #30
maximilian wrote: post #4

In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)

Apple uses a key strengthening algorithm on their passwords, similar in concept to Bcrypt - I think they've increased the number of rounds past the 1000 mentioned since this paper came out: http://people.cis.ksu.edu/~sakthi/src/data/filevault_sakthi.... If you've already compromised an account and have access as that user, it's likely that what you're going after isn't going to be their password... ... although, if y…

The paper is about FileVault, not user accounts.

Re: Cracking OSX Lion passwords

#42

Post by alttag »

simcop2387 wrote: post #36
hmottestad wrote: post #32

Earlier quoted context omitted.

I'm wondering the same thing. I use filevault, but I don't feel like messing it up by changing the password this way. I wonder if you can reset the password and use that password to simply disable the filevault. Btw. My five cents. Write a script to: 1. change current users password to X 2. sudo "something really bad" 3. use password X And there is a virus that can do anything on a mac. If you can change the password…

Yea with this I'd be worried about something doing that, making a new hidden user and then setting the password on the original account back leaving no immediately visible signs that anything is wrong.

Reverting the pw assumes you knew it in the first place, and thus didn't need to change/reset it.

Re: Cracking OSX Lion passwords

#44

Post by keeperofdakeys »

hackermom wrote: post #37
hmottestad wrote: post #34

Earlier quoted context omitted.

Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.

Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.

The file includes all password hashes, including root. So crack that, then you have superuser.

Re: Cracking OSX Lion passwords

#45

Post by jfriedly »

hackermom wrote: post #37
hmottestad wrote: post #34

Earlier quoted context omitted.

Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.

Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.

If sudo works the same way on Mac's as it does on Linux, then anyone in the sudoers file could give a rogue application root access.

Re: Cracking OSX Lion passwords

#46

Post by lawnchair_larry »

kulpreet wrote: post #43

You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.

That risk level is not at all on par with this though. That won't help with filevault turned on, and it requires both a reboot and a physical presence at the machine. This can be done remotely with shell access, and discloses hashes from other accounts.

Re: Cracking OSX Lion passwords

#47

Post by ryannielsen »

keeperofdakeys wrote: post #44
hackermom wrote: post #37

Earlier quoted context omitted.

Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.

The file includes all password hashes, including root. So crack that, then you have superuser.

By default, Mac OS X disables the root user: http://support.apple.com/kb/ht1528

That said, reset or crack any admin's password and you can go to town with sudo.

Re: Cracking OSX Lion passwords

#48

Post by bigiain »

scott_s wrote: post #25
jessedhillon wrote: post #22

Earlier quoted context omitted.

Or run a malicious script?

There are far more damaging "malicious scripts" one could trick someone into running, such as "cd; rm -rf *". Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege. I like Raymond Chen's take on the topic: http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...

"Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege."

Doesn't the end of the article suggest that without admin access, you could just reset the password for any admin user, then be able to log in as them? Sounds like priv escalation to me.

Edit: Actually, reading further comments, it seems you can only reset the password of the currently logged in user without reauthentication, so you can only get admin privs if you've already got a console with admin privs. I'm wrong.

Re: Cracking OSX Lion passwords

#49

Post by ryannielsen »

SoftwareMaven wrote: post #20
moe wrote: post #12

Earlier quoted context omitted.

You can not decrypt Filevault that way, though.

Does this problem allow file vault access? Unless I read it wrong (totally reasonable in my jet lagged state), this won't reset your keychain either.

`dscl` should change the FileVault disk password for the associated user as well.

Note that if you're able to run `dscl`, the disk has already been unlocked and is insecure. You may as well just copy any interesting data while you're there.

Re: Cracking OSX Lion passwords

#50

Post by alwillis »

_hnwo wrote: post #31
lawnchair_larry wrote: post #27

Earlier quoted context omitted.

Apple doesn't compensate security researchers, so I am not disappointed or surprised. In fact, they just ignore people half the time. If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.

Totally agree with this. Apple really ignore most security advisories, and I am speaking from experience.

Just from looking at Apple’s security page, it’s pretty clear they don’t ignore security issues: http://support.apple.com/kb/HT1222. Organizations and researchers are even acknowledged in the release notes: http://support.apple.com/kb/HT4826.

Like a lot of things, Apple does things quietly and on their own schedule without a lot of hoopla.

Post reply on HN