Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

11–20 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#11

Post by moey »

With physical access, one has been able to create admin accounts for as long as I can remember.

- Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges.

- Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy"

- Then mount the filesystem for it to be accessible: "/sbin/mount -uw /"

- Now remove this file so OS X will re-run Setup Assistant: "rm /var/db/.AppleSetupDone"

Now just restart, and enjoy the cool introduction animation as you create your admin account.

Re: Hidden backdoor API to root privileges in Apple OS X

#12

Post by mrchucklepants »

Osiris wrote: post #5
percept wrote: post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

I upgraded. I haven't had any problems that I wasn't already having in Mavericks (Anyone else have kernel panics when sleeping with a thunderbolt monitor attached?).

I've been running with a Thunderbolt Display for a few years now with few problems. I've had zero problems on Yosemite.

Re: Hidden backdoor API to root privileges in Apple OS X

#14

Post by fmela »

Alex3917 wrote: post #10
percept wrote: post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

My personal computer is a late 2008 MBP, and Yosemite runs fine on that. It's been upgraded to 8 gigs of ram, and that's enough to smoothly do dev work in vagrant environments.

I have the exact same setup with 8GB of RAM, and it's still going strong. I wish I could upgrade to 16GB to extend its life even further.

Re: Hidden backdoor API to root privileges in Apple OS X

#15

Post by KuchenKerze »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Not possible if full disk encryption is enabled. And that is a default since a year or so.

Re: Hidden backdoor API to root privileges in Apple OS X

#17

Post by btgeekboy »

percept wrote: post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

If you're seriously concerned, why not use an external drive of some sort and install Yosemite to it? (Bonus points: clone your internal disk to it first, and upgrade that.) Boot it up, test out your critical functions, and then update your main volume if it works out for you.

Re: Hidden backdoor API to root privileges in Apple OS X

#18

Post by Archio »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Isn't the idea though that with physical access, the game is already over anyway? If an intruder has physical access to your machine they will eventually be able to get to anything they want.

If someone really wants to protect their data, they have to count physical access as a possibility and rely on encryption and/or remote wiping - the operating system login isn't going to do much anyway.

Re: Hidden backdoor API to root privileges in Apple OS X

#19

Post by taumhn »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

If you're paranoid enough to think someone you don't trust can have physical access to your Mac, it is possible to prevent this by setting up firmware password though.

See https://support.apple.com/en-us/HT204455

Re: Hidden backdoor API to root privileges in Apple OS X

#20

Post by matthewmacleod »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Yes, but that's not really a concern. Physical access with no disk encryption is always 'vulnerable'.

What's pretty bad here is that any user now has a backdoor to obtaining root privileges. That's an awful security flaw.

Post reply on HN