Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

111–120 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#111

Post by graeme »

po1nter wrote: post #69

OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

Yeah, this is scandalous. I've heard enough things about Yosemite bugs that I held off upgrading, especially as I want to avoid software compatibility issues.

I hate Apple's new yearly release cycle. There's not enough time to stabilize and improve OS's.

This update just rolled out, but it indicates the admin fixes are only for Yosemite:

https://support.apple.com/en-us/HT204659

How worried should I be about not having updated? There's still a risk I may lose some program compatibility by updating.

Re: Hidden backdoor API to root privileges in Apple OS X

#112

Post by kazinator »

coldpie wrote: post #50
raldi wrote: post #27

I'm having a hard time understanding whether this is an intentional backdoor or just an accident.

Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.

Not closing the hole in old versions of the OS isn't an oversight, however.

Re: Hidden backdoor API to root privileges in Apple OS X

#113

Post by chc »

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

Null pointer dereferences do crash in Objective-C. Sending messages to nil is generally not nonsense in Objective-C, though. It has well-defined semantics and is useful in many cases. It isn't a "Don't crash when faced with nonsense" policy. I'm not sure the benefits are enough to justify its propensity to trip people up, but it's not like it's just some kind of crash prevention.

Re: Hidden backdoor API to root privileges in Apple OS X

#114

Post by JorgeGT »

wyager wrote: post #87
moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

There's a huge difference between physical access vulnerabilities (which are basically impossible to prevent) and local privesc vulnerabilities (which can be exploited in software).

To exemplify, for instance, this vulnerability could be packed in a phishing mail executable giving the remote attacker root access if the user falls for the trap, no?

Re: Hidden backdoor API to root privileges in Apple OS X

#115

Post by maqr »

pbreit wrote: post #94

Could anyone summarize the implications of this finding in plain English?

Sometimes these things are easier to explain if you look at it like an attacker:

If you're a regular user of an OSX system before 10.10.3, and you want to become root (admin user), you can use this exploit to become root.

If you're an author of malicious OSX software, and a user without admin permissions installs your malware, you can use this exploit to make your malware run as root.

Once you have root, you can do anything on a system.

If the system you're attacking is 10.10.3 or later, you won't be able to use this exploit because Apple has a fix in 10.10.3.

Apple will not make the fix available to anyone on 10.9 or earlier.

Re: Hidden backdoor API to root privileges in Apple OS X

#116

Post by diminoten »

w0utert wrote: post #107
diminoten wrote: post #99

Earlier quoted context omitted.

The submitted article says so. In fact, I quoted the relevant sentence in an above comment.

Interestingly, the release notes for the 2015-004 patch that includes the fix specifically mention it is also available for Mavericks and Mountain Lion. https://support.apple.com/en-us/HT201222

No it doesn't:

from https://support.apple.com/en-us/HT204659:

> Admin Framework

> Available for: OS X Yosemite v10.10 to v10.10.2

> Impact: A process may gain admin privileges without properly authenticating Description: An issue existed when checking XPC entitlements. This issue was addressed with improved entitlement checking.

> CVE-ID

> CVE-2015-1130 : Emil Kvarnhammar at TrueSec

Re: Hidden backdoor API to root privileges in Apple OS X

#118

Post by MichaelGG »

pcwalton wrote: post #81
mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

To be fair, calling a virtual method on a null receiver is undefined behavior (not necessarily a segfault!) in C++ too. The compiler is free to replicate Objective-C's behavior if it wants to. (Of course, no compilers actually do precisely that, but it is possible for compilers to delete virtual method calls entirely if it can prove the receiver had to be null...)

Why is that undefined? Seems like it should obviously cause a fault...

Re: Hidden backdoor API to root privileges in Apple OS X

#119

Post by jjarmoc »

While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.

Re: Hidden backdoor API to root privileges in Apple OS X

#120

Post by evilduck »

po1nter wrote: post #69

OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

What apologists? Were the comments deleted or something, because I really don't see anyone defending Apple in this thread.
Post reply on HN