51–60 of 82 posts
Earlier quoted context omitted.
Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.
If sudo works the same way on Mac's as it does on Linux, then anyone in the sudoers file could give a rogue application root access.
This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.
Apple doesn't compensate security researchers, so I am not disappointed or surprised. In fact, they just ignore people half the time. If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.
Sure many don't do the above, but the OP author is presenting himself as white-hat/legitimate.
And as informed users, we should consider carefully giving our business to vendors who don't go out of their way to encourage private disclosure --- a zero-day on a vendor is a zero-day on all of it's customers.
Earlier quoted context omitted.
Not really. There's no privilege escalation. You can only change user 's password if you're already logged-in as user . That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.
Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.
You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
I suppose it's different if an unauthenticated user can perform a password change with the system powered on, but similar things can be done with Windows and a Linux live cd with some tools, and Linux passwords can be changed in "single user" mode.
You can also just pop in the OS X cd and change the password at boot.
Earlier quoted context omitted.
Actually. Any application can do this and use the new password to become super-user. Really useful for a virus I reckon.
Exactly how can it use the new password to become super-user? You can't assume that everyone runs only the default admin user on their OS X system.
This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.
Apple, like Microsoft, has the tendency to sweep things under the rug when they feel it is unlikely the situation will become public. The only way to correct this behavior is release what you find to the public and as fast as possible.
This feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.
Full disclosure is the only responsible sort of disclosure. Apple, like Microsoft, has the tendency to sweep things under the rug when they feel it is unlikely the situation will become public. The only way to correct this behavior is release what you find to the public and as fast as possible.
[1] - http://en.wikipedia.org/wiki/Responsible_disclosure
TL:DR of above link: "[responsible disclosure] is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details"