Are Apple glad it wasn't found by a "You have 90 days before disclosure" outfit? Look at that timeline...
Hidden backdoor API to root privileges in Apple OS X
41–50 of 367 posts
Re: Hidden backdoor API to root privileges in Apple OS X
#42wait, you expected to find people at a security conference that weren't aware of the fact that even OS X can have exploitable vulnerabilities?
Re: Hidden backdoor API to root privileges in Apple OS X
#43Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)
If you're seriously concerned, why not use an external drive of some sort and install Yosemite to it? (Bonus points: clone your internal disk to it first, and upgrade that.) Boot it up, test out your critical functions, and then update your main volume if it works out for you.
Would using an external drive make it noticeably slower, making performance non-representative?
Re: Hidden backdoor API to root privileges in Apple OS X
#44With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…
Local privilege escalation is always bad because it means you're one malware payload or RCE away from being rooted and conscripted into someone's botnet (or worse). This isn't just a physical access concern.
Re: Hidden backdoor API to root privileges in Apple OS X
#45With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…
If you're paranoid enough to think someone you don't trust can have physical access to your Mac, it is possible to prevent this by setting up firmware password though. See https://support.apple.com/en-us/HT204455
Firmware passwords can be bypassed by a local user with a Thunderbolt Option ROM. The 10.10.2 fix for Thunderstrike left that hole open during normal boots: https://trmm.net/Thunderstrike_FAQ#Is_Thunderstrike_fixed_in...
Re: Hidden backdoor API to root privileges in Apple OS X
#46Re: Hidden backdoor API to root privileges in Apple OS X
#47Earlier quoted context omitted.
Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
They are now. I remember buying upgrades ?
Re: Hidden backdoor API to root privileges in Apple OS X
#48Earlier quoted context omitted.
Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
What about developers that need to support customers on older systems?
You basically need VMs for every version of OS X you want to support, and need to keep copies of the old OS X SDKs since Apple seems not to test that newer ones will continue to work despite superficially supporting choosing a target version.
Most developers don't bother, as Apple has successfully made it quite difficult.
Re: Hidden backdoor API to root privileges in Apple OS X
#49Earlier quoted context omitted.
Well, you have a reason now, have you not?
[deleted]
Yes, but that security update doesn't include this patch. Apple confusingly lists the security updates in 10.10.3 and Security Update 2015-004 together, but not all items apply to 10.9. The very first item listed on the page is this Admin Framework bug, and it's only available for v10.10 to v10.10.2.
Re: Hidden backdoor API to root privileges in Apple OS X
#50I'm having a hard time understanding whether this is an intentional backdoor or just an accident.
Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.