71–80 of 82 posts
You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
That risk level is not at all on par with this though. That won't help with filevault turned on, and it requires both a reboot and a physical presence at the machine. This can be done remotely with shell access, and discloses hashes from other accounts.
Earlier quoted context omitted.
Yea with this I'd be worried about something doing that, making a new hidden user and then setting the password on the original account back leaving no immediately visible signs that anything is wrong.
Reverting the pw assumes you knew it in the first place, and thus didn't need to change/reset it.
Two points: 1. When it comes to security, from the point of view of an OS vendor, if you have gained unauthorized access to an interactive shell on a target machine it's already "game over, man". You cannot protect against physical access, and you can pretty much assume that there are a plethora of unknown privilege escalation bugs so that any account is effectively a root account. Every company has limited security…
any account is effectively a root account I'm no security expert, but that doesn't seem right to me.
Two points: 1. When it comes to security, from the point of view of an OS vendor, if you have gained unauthorized access to an interactive shell on a target machine it's already "game over, man". You cannot protect against physical access, and you can pretty much assume that there are a plethora of unknown privilege escalation bugs so that any account is effectively a root account. Every company has limited security…
any account is effectively a root account I'm no security expert, but that doesn't seem right to me.
No, you strengthen all of the defenses leading up to the door so you never have to worry about just how strong that door is. That's not to mention that the King probably doesn't appreciate having to swing a 3 ton door every time he wants to go to sleep.
Same idea with computer security. Only give accounts to trusted individuals. Assume anyone with an interactive shell can quickly gain root access. Physical access is even worse. If you can sit at the keyboard, then you control everything. This is why most banks have key servers locked in real physical vaults with 3 ton doors.
Honestly, I'm a little surprised. This is all "Computer Security 101" level stuff here. Getting worked up about "cracking" passwords given local access is akin to worrying about someone spying on you when you visit this site: http://www.josephcrawford.com/2006/11/11/scary-isight-trick/ . If you want some real security research meat to sink your teeth into, the pwn2own contests are always pretty good, especially the most recent one (http://arstechnica.com/security/news/2011/03/pwn2own-day-one...). You might notice, if you read about the pwn2own contest, that the contest is over as soon as the exploit runs arbitrary code on the local machine and successfully breaks out of the application sandbox. At that point, you're knocking on the door...
Earlier quoted context omitted.
I downvoted not because you joked, but because you made patently untrue claims and then backed them up with a very poor methodology. So poor that you can't simultaneously be smart enough to read and understand this site and dumb enough to think it's logical to argue this way. I conclude, therefore, that you're trolling.
I wasn't talking about the downvotes, that's to be expected. I was talking about the humorless replies :) If we all acted our IQs, all the time, the world would be a very boring place. It's not responsible to buy myself expensive toys, it's not respectable to be sarcastic. Yet we do it anyway. Trolling is meant to make people angry, I meant to to get a chortle out of at least somebody... but now I know, beyond a shad…
Earlier quoted context omitted.
any account is effectively a root account I'm no security expert, but that doesn't seem right to me.
Think of any system as a castle. Having access to an interactive shell is like standing outside the King's bedroom. Sure, you might not have the keys to the bedroom door, but you've already made it past the archers, the moat, the drawbridge, the boiling oil, and the King's personal body guards. You don't put a 3 ton door on the King's bedroom and say, "Well, that should keep the invading army out!" No, you strengthen…
If you seriously think having an account on a machine is as good as having the root account, then you should call up every shared hosting provider and let them know. They hand out accounts to any asshole with $10.
Earlier quoted context omitted.
It's bad, but it's not that bad. SHA is widely supported, and not that bad, yet. Also this is protecting desktop computers, where cracking hashes is not a common security problem. Getting the machine stolen in starbucks is probably much more common for this type of machine.
Macs are not used exclusively as desktops.
Earlier quoted context omitted.
Think of any system as a castle. Having access to an interactive shell is like standing outside the King's bedroom. Sure, you might not have the keys to the bedroom door, but you've already made it past the archers, the moat, the drawbridge, the boiling oil, and the King's personal body guards. You don't put a 3 ton door on the King's bedroom and say, "Well, that should keep the invading army out!" No, you strengthen…
That an attacker has physical access does mean that your computer is compromised, so you're half right. If you seriously think having an account on a machine is as good as having the root account, then you should call up every shared hosting provider and let them know. They hand out accounts to any asshole with $10.
Even a properly secured system can be vulnerable to known and unknown privilege escalation bugs.
Earlier quoted context omitted.
Compensation is irrelevant - if you bothered to sniff around a specific vendor's security and you discover an exploit then you really should disclose it. Such is the lore of white-hatism. Sure many don't do the above, but the OP author is presenting himself as white-hat/legitimate. And as informed users, we should consider carefully giving our business to vendors who don't go out of their way to encourage private dis…
Sorry, but no. Compensation is highly relevant. Do you work for free? Or do you just not consider security research to be worth anything? Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others. We can easily spin it the other way too…
I entirely agree that Apple should be compensating those that disclosure exploits appropriately - I didn't say otherwise. But if you have a status quo where a vendor won't compensate and you have a zero-day opportunity, I say the appropriate thing is to inform the vendor first anyway (you can always disclosing publicly if you get no response). I fight for the user and all that.
Disclosing it publicly zero-day doesn't make you any money anyway.
Earlier quoted context omitted.
Think of any system as a castle. Having access to an interactive shell is like standing outside the King's bedroom. Sure, you might not have the keys to the bedroom door, but you've already made it past the archers, the moat, the drawbridge, the boiling oil, and the King's personal body guards. You don't put a 3 ton door on the King's bedroom and say, "Well, that should keep the invading army out!" No, you strengthen…
That an attacker has physical access does mean that your computer is compromised, so you're half right. If you seriously think having an account on a machine is as good as having the root account, then you should call up every shared hosting provider and let them know. They hand out accounts to any asshole with $10.
I'll leave it as an exercise to the reader to compare and contrast the entirely different use cases between a shared hosting server and a desktop machine running OS X.