Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

101–110 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#101

Post by bougiefever »

po1nter wrote: post #69

OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

Hey, at least there weren't any of the 'Well, I don't care if anyone sees all my boring details anyway' variety. At least people are beginning to understand the most basic implications of loss of privacy.

Re: Hidden backdoor API to root privileges in Apple OS X

#102

Post by marcinx27 »

lultimouomo wrote: post #36
percept wrote: post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

I recently got a mac mini that shipped with Yosemite. It has the nice feature of completely killing the WiFi interface when you attach a USB hub - googling around it seems a Yosemite bug. I have been told that also using bluetooth devices (such as the apple mouse) can trigger the same behaviour. So I'd say I'm sorry that the mac shipped with Yosemite, except that at least I received the fix for the privilege escalati…

I had this bug plaguing me for a while. My WiFi connection would drop every fifteen minutes or so, requiring me to turn off the WiFi and then turn it on again. I was able to fix it by doing a clean install of Yosemite (from a bootable drive).

Re: Hidden backdoor API to root privileges in Apple OS X

#103

Post by 0x0 »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

That's not very interesting. You can do the same on a linux box, passing init=/bin/sh in the boot loader, and probably the same on windows (boot a WinPE CD or a Linux live CD with NTFS3g).

Re: Hidden backdoor API to root privileges in Apple OS X

#104

Post by rdudek »

po1nter wrote: post #69

OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

I have to agree. I have an older macbook that if I upgrade to another above Snow Leopard, it runs pretty slow. But I do understand that support for older devices has to stop at some point.

Re: Hidden backdoor API to root privileges in Apple OS X

#105

Post by EC1 »

thebouv wrote: post #90
JustSomeNobody wrote: post #54

Earlier quoted context omitted.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

I'm with you on this; I can't leave Mavericks just yet. Every colleague I have that's moved on has had numerous issues with their machine. And now this crap. Ugh.

What kind of issues? I've literally noticed no differences besides UI.

Re: Hidden backdoor API to root privileges in Apple OS X

#106

Post by AgentME »

raldi wrote: post #52
coldpie wrote: post #50

Earlier quoted context omitted.

Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.

In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.

Works the same way for whoever uses it.

Re: Hidden backdoor API to root privileges in Apple OS X

#107

Post by w0utert »

diminoten wrote: post #99
dsjoerg wrote: post #97

Earlier quoted context omitted.

What makes you say that?

The submitted article says so. In fact, I quoted the relevant sentence in an above comment.

Interestingly, the release notes for the 2015-004 patch that includes the fix specifically mention it is also available for Mavericks and Mountain Lion.

https://support.apple.com/en-us/HT201222

Re: Hidden backdoor API to root privileges in Apple OS X

#108

Post by AgentME »

towelguy wrote: post #29

> Okay, so the systemsetup binary simply checks if we are running as the root user? >Philip tried patching that function (replacing sete with setne), with success: How do you patch the binary without root or the admin user password anyway?

Just make a copy of the binary that's editable by the user. Or copy its code into a new program. There's nothing special about the specific root-owned systemsetup binary. (It's not setuid.)

Re: Hidden backdoor API to root privileges in Apple OS X

#109

Post by kalleboo »

pbreit wrote: post #94

Could anyone summarize the implications of this finding in plain English?

Any code running as any user on an unpatched version can become root (and do whatever it wants, E.g. install keyloggers)

Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.

Re: Hidden backdoor API to root privileges in Apple OS X

#110

Post by sceutre »

bitwize wrote: post #89
kaoD wrote: post #74

Earlier quoted context omitted.

Can you explain this to non Obj-C users? How does it not crash on null pointers?

In Objective-C 'nil' is a special object (internally rwpresented by a null pointer). When the runtime is instructed to invoke any method on nil, the method does nothing and returns nil (rather than crashing). I think this is an artifact of Smalltalk behavior.

This is all Objective-C. In Smalltalk sending messages to nil results in a #doesNotUnderstand: runtime exception.
Post reply on HN