Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

31–40 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#31

Post by e40 »

danielweber wrote: post #22
diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

What about developers that need to support customers on older systems?

Re: Hidden backdoor API to root privileges in Apple OS X

#32

Post by KuchenKerze »

nothrabannosir wrote: post #25
KuchenKerze wrote: post #15

Earlier quoted context omitted.

Not possible if full disk encryption is enabled. And that is a default since a year or so.

full disk encryption only protects you from passive snooping. If someone has physical access between two of your subsequent uses, no amount of any type of encryption will save you. Except maybe some entangled quantum bit collapsing mechanism. Maybe. Think hardware keyloggers, fake MBRs, &c. OP's trick won't work, but that's an "implementation detail;" there are plenty others that will. EDIT: to clarify; that's not wh…

Of course keyloggers etc. are a problem. But that is a different story. A bug which can be exploited just by grabbing any device might have a larger impact on the vendors reputation. A keylogger, fake smc, whatsoever ist much more dangerous for a single person, because the attacker knows what he wants on the specific device.

Re: Hidden backdoor API to root privileges in Apple OS X

#33

Post by nmc »

towelguy wrote: post #29

> Okay, so the systemsetup binary simply checks if we are running as the root user? >Philip tried patching that function (replacing sete with setne), with success: How do you patch the binary without root or the admin user password anyway?

I think this is not part of the exploit, it was simply a step to ensure that their intuition about the assembly code was correct.

Hint: the first sentence you quoted ends with a question mark.

Re: Hidden backdoor API to root privileges in Apple OS X

#34

Post by Osiris »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

The first Mac I ever got, the IT department forgot to give me admin access, so I couldn't install any software. Having never used a Mac before, it took a grand total of about 15 minutes of Googling to figure out how to boot into single user mode and give myself admin access.

Re: Hidden backdoor API to root privileges in Apple OS X

#36

Post by lultimouomo »

percept wrote: post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

I recently got a mac mini that shipped with Yosemite. It has the nice feature of completely killing the WiFi interface when you attach a USB hub - googling around it seems a Yosemite bug. I have been told that also using bluetooth devices (such as the apple mouse) can trigger the same behaviour. So I'd say I'm sorry that the mac shipped with Yosemite, except that at least I received the fix for the privilege escalation bug.

Re: Hidden backdoor API to root privileges in Apple OS X

#37

Post by apendleton »

towelguy wrote: post #29

> Okay, so the systemsetup binary simply checks if we are running as the root user? >Philip tried patching that function (replacing sete with setne), with success: How do you patch the binary without root or the admin user password anyway?

Pretty sure they did that as root, so they could get past that and explore how the program worked when being run as a non-root user. The final exploit doesn't depend on this program, though; it uses the same RPC interfaces this program does, from a separate program, so the patching was just part of their exploration, not part of the exploit.

Re: Hidden backdoor API to root privileges in Apple OS X

#38

Post by matt4077 »

danielweber wrote: post #22
diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

Re: Hidden backdoor API to root privileges in Apple OS X

#39

Post by ryanlol »

e40 wrote: post #31
danielweber wrote: post #22

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

What about developers that need to support customers on older systems?

Many don't.
Post reply on HN