Hidden backdoor API to root privileges in Apple OS X • Hacker News Board

Re: Hidden backdoor API to root privileges in Apple OS X

#81

Post by pcwalton » Thu, Apr 09, 2015, 5:06 PM UTC

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

To be fair, calling a virtual method on a null receiver is undefined behavior (not necessarily a segfault!) in C++ too. The compiler is free to replicate Objective-C's behavior if it wants to.

(Of course, no compilers actually do precisely that, but it is possible for compilers to delete virtual method calls entirely if it can prove the receiver had to be null...)

Re: Hidden backdoor API to root privileges in Apple OS X

#82

Post by tjr » Thu, Apr 09, 2015, 5:07 PM UTC

matt4077 wrote: post #38

danielweber wrote: post #22

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

I have a lot of music production software on my Mac, which doesn't all necessarily get updated to work with the latest OS X right away. Upgrading the operating system tends to be a maze of determining what works and what doesn't, possibly including paying for updates of software besides the OS.

I generally put off doing a major Mac OS update for as long as possible.

Re: Hidden backdoor API to root privileges in Apple OS X

#83

Post by avn2109 » Thu, Apr 09, 2015, 5:08 PM UTC

mxfh wrote: post #72

So is Snow Leopard (Mac OS X 10.6.8) not affected?

Still pretty much the best OSX.

Re: Hidden backdoor API to root privileges in Apple OS X

#84

Post by _cbsz » Thu, Apr 09, 2015, 5:08 PM UTC

kaoD wrote: post #74

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

Can you explain this to non Obj-C users? How does it not crash on null pointers?

The Obj-C function call [foo doSomething] compiles to the equivalent of objc_msgSend(foo, "doSomething"); (for the pedantic, I'm intentionally simplifying and leaving out objc_selfrefs)

The first thing objc_msgSend does is check if foo is nil and, if so, returns 0/nil/the all-zero bit pattern/whatever. It can be extremely convenient, but it can also be extremely inconvenient.

Re: Hidden backdoor API to root privileges in Apple OS X

#85

Post by antimora » Thu, Apr 09, 2015, 5:08 PM UTC

This article has a nice exploit code written in python down below for curious ones how works in code.

Re: Hidden backdoor API to root privileges in Apple OS X

#86

Post by TeMPOraL » Thu, Apr 09, 2015, 5:09 PM UTC

diminoten wrote: post #78

TeMPOraL wrote: post #75

Earlier quoted context omitted.

They'll just think "oh god, I have viruses!" and call whoever is the family's "computer whiz". The very concept of "this system is not secure" is something that ordinary user does not understand. Source: I'm a family "computer whiz" :/.

That's completely untrue, and pretty cynical. People understand if a system is insecure, and now apparently all non-Yosemite Macs are insecure. Folks will grok that. Whether or not they find out about it, well that's up to you and I, and everyone else on this website.

I didn't mean it in a cynical way. From my observation, "it has viruses" is the best model that is self-consistent and yet doesn't require investing a lot of time in comprehending the workings of a computer. Non-tech people reach it naturally.

I agree it's up to us to proactively tell our parents, friends and colleagues who may be vulnerable about this problem.

Re: Hidden backdoor API to root privileges in Apple OS X

#87

Post by wyager » Thu, Apr 09, 2015, 5:12 PM UTC

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

There's a huge difference between physical access vulnerabilities (which are basically impossible to prevent) and local privesc vulnerabilities (which can be exploited in software).

Re: Hidden backdoor API to root privileges in Apple OS X

#88

Post by rcthompson » Thu, Apr 09, 2015, 5:14 PM UTC

matt4077 wrote: post #38

danielweber wrote: post #22

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

"Most users on the newest version"? Of the seven or eight Macs at my workplace, my personal Macbook is the only one running the latest OSX.

Re: Hidden backdoor API to root privileges in Apple OS X

#89

Post by bitwize » Thu, Apr 09, 2015, 5:14 PM UTC

kaoD wrote: post #74

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

Can you explain this to non Obj-C users? How does it not crash on null pointers?

In Objective-C 'nil' is a special object (internally rwpresented by a null pointer). When the runtime is instructed to invoke any method on nil, the method does nothing and returns nil (rather than crashing). I think this is an artifact of Smalltalk behavior.

Re: Hidden backdoor API to root privileges in Apple OS X

#90

Post by thebouv » Thu, Apr 09, 2015, 5:16 PM UTC

JustSomeNobody wrote: post #54

matt4077 wrote: post #38

Earlier quoted context omitted.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

I'm with you on this; I can't leave Mavericks just yet. Every colleague I have that's moved on has had numerous issues with their machine.

And now this crap. Ugh.