Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

71–80 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#71

Post by jrochkind1 »

kpcyrd wrote: post #26
moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

It's even worse than it seems if you talk about it as 'anybody'.

Most OSX boxes are probably single user devices. But you do not normally run as root/wheel, you need sudo (sometimes through a nice GUI) for software to get root privs.

It's not 'somebody' as if another person were logged into their own account. It's that malware running as you can now get root, to further compromise your system, without needing a sudo password.

Re: Hidden backdoor API to root privileges in Apple OS X

#73

Post by TeMPOraL »

Vexs wrote: post #21
Archio wrote: post #18

Earlier quoted context omitted.

Isn't the idea though that with physical access, the game is already over anyway? If an intruder has physical access to your machine they will eventually be able to get to anything they want. If someone really wants to protect their data, they have to count physical access as a possibility and rely on encryption and/or remote wiping - the operating system login isn't going to do much anyway.

Yep, physical access is total access. However, this trick falls under cool-at-school-tech-labs, I'd hope enterprise systems would do something to prevent this kind of low-level shenanigans.

School tech labs are modelled after the enterprise networks, the only difference is usually a bit more competent IT staff. I'd expect most of the school-lab tricks to be directly transferable to enterprise.

Re: Hidden backdoor API to root privileges in Apple OS X

#74

Post by kaoD »

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

Can you explain this to non Obj-C users? How does it not crash on null pointers?

Re: Hidden backdoor API to root privileges in Apple OS X

#75

Post by TeMPOraL »

diminoten wrote: post #65
larrys wrote: post #30

Earlier quoted context omitted.

"What better way to encourage people to upgrade." The majority of their user base doesn't know and wouldn't care about this type of thing even if they did.

They'll care when their mouse starts moving by itself.

They'll just think "oh god, I have viruses!" and call whoever is the family's "computer whiz". The very concept of "this system is not secure" is something that ordinary user does not understand.

Source: I'm a family "computer whiz" :/.

Re: Hidden backdoor API to root privileges in Apple OS X

#76

Post by tomswartz07 »

matt4077 wrote: post #38
danielweber wrote: post #22

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

The OS update might be free, but that's not the only reason that a number of large deployments might stay at a single version.

For us IT Shops, its almost exclusively about ensuring support for the hundreds of other software programs.

I see a lot of folks arguing otherwise, and I'm not sure they realize this.

Sure, it works fine for the 'isolated single user', but it's totally different in a large deployment model.

Re: Hidden backdoor API to root privileges in Apple OS X

#77

Post by gabeio »

JustSomeNobody wrote: post #54
matt4077 wrote: post #38

Earlier quoted context omitted.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

Just because it's paid doesn't make it better either.

Re: Hidden backdoor API to root privileges in Apple OS X

#78

Post by diminoten »

TeMPOraL wrote: post #75
diminoten wrote: post #65

Earlier quoted context omitted.

They'll care when their mouse starts moving by itself.

They'll just think "oh god, I have viruses!" and call whoever is the family's "computer whiz". The very concept of "this system is not secure" is something that ordinary user does not understand. Source: I'm a family "computer whiz" :/.

That's completely untrue, and pretty cynical.

People understand if a system is insecure, and now apparently all non-Yosemite Macs are insecure. Folks will grok that. Whether or not they find out about it, well that's up to you and I, and everyone else on this website.

Re: Hidden backdoor API to root privileges in Apple OS X

#79

Post by shepard »

plorkyeran wrote: post #51
[deleted] wrote: post #13

Earlier quoted context omitted.

[deleted]

Xcode 6.3 is out now and requires 10.10. I also waited as long as I could, so now I have a machine that's been installing Yosemite for the last 18 hours...

It's a known issue related to having many nonstandard files in /usr/local or something like that. Eg. If you are using brew. Google for it, or just wait patiently, it should finish at some point.

Re: Hidden backdoor API to root privileges in Apple OS X

#80

Post by pcwalton »

kaoD wrote: post #74
mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

Can you explain this to non Obj-C users? How does it not crash on null pointers?

Calling any method ("sending any message" in Objective-C terminology) on a nil receiver does nothing and returns the zero value of the method's result type (a value of the right size with all bits zeroed).
Post reply on HN