Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

151–160 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#151

Post by bdcravens »

cozzyd wrote: post #135
bdcravens wrote: post #132

10.10.3 came out 2 days ago. This counts as reasonable disclosure?

He discovered it 6 months ago. Maybe he gave Apple 6 months to fix it before disclosing?

I get that, but surely you have to provide a reasonable amount of time for patches to be installed. Perhaps a 2-part blog entry, where he gives general details (to instill urgency) and then release exploit code a month later?

Re: Hidden backdoor API to root privileges in Apple OS X

#152

Post by glhaynes »

mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

I'm kind of surprised there's not a means (to my knowledge, at least) to crash/throw an exception upon sending a message to nil for people who want to better ensure their code doesn't have lurking issues like this. I suppose it'd have to be smart enough to filter out system frameworks to be useful, but I'd imagine that to be do-able.

Re: Hidden backdoor API to root privileges in Apple OS X

#153

Post by baldfat »

evilduck wrote: post #138
baldfat wrote: post #131

Earlier quoted context omitted.

> Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility. > To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version. > While this is a sign…

Most of those are people giving fairly reasonable benefit of the doubt, no apologism. But I suspect you're probably about as biased against Apple as the people you're assuming are biased towards Apple.

Oh your really off base.. I am MUCH MORE biased against Apple. You know those Linux users who hate on Microsoft? I am the Linux user who HATES Apple since I was first lied to by Apple in 1983 (Color Mac coming in the next year, wasn't till March 1987) (Color Mac will destroy Amiga 1000 in 1985)

I have never seen Apple as being honest or making products for me as a nerd. So I live mostly in Linux nowadays.

Re: Hidden backdoor API to root privileges in Apple OS X

#154

Post by baldfat »

jotux wrote: post #134
baldfat wrote: post #131

Earlier quoted context omitted.

> Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility. > To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version. > While this is a sign…

Do you legitimately see these comments are being apologetic towards apple?

> To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

Re: Hidden backdoor API to root privileges in Apple OS X

#155

Post by pcwalton »

MichaelGG wrote: post #118
pcwalton wrote: post #81

Earlier quoted context omitted.

To be fair, calling a virtual method on a null receiver is undefined behavior (not necessarily a segfault!) in C++ too. The compiler is free to replicate Objective-C's behavior if it wants to. (Of course, no compilers actually do precisely that, but it is possible for compilers to delete virtual method calls entirely if it can prove the receiver had to be null...)

Why is that undefined? Seems like it should obviously cause a fault...

C and C++ need to be usable in systems without memory protection, so they don't guarantee any faults for operations like method calls. (There are some standard-guaranteed exceptions, for example std::bad_alloc, but those are only on relatively expensive operations.) Compilers then take advantage of these undefined behaviors to optimize even on systems that do have memory protection.

Re: Hidden backdoor API to root privileges in Apple OS X

#156

Post by evilduck »

baldfat wrote: post #153
evilduck wrote: post #138

Earlier quoted context omitted.

Most of those are people giving fairly reasonable benefit of the doubt, no apologism. But I suspect you're probably about as biased against Apple as the people you're assuming are biased towards Apple.

Oh your really off base.. I am MUCH MORE biased against Apple. You know those Linux users who hate on Microsoft? I am the Linux user who HATES Apple since I was first lied to by Apple in 1983 (Color Mac coming in the next year, wasn't till March 1987) (Color Mac will destroy Amiga 1000 in 1985) I have never seen Apple as being honest or making products for me as a nerd. So I live mostly in Linux nowadays.

Alrighty.... I can't think of a better way to undermine your credibility, so I think we're done here.

Re: Hidden backdoor API to root privileges in Apple OS X

#157

Post by [deleted] »

baldfat wrote: post #153
evilduck wrote: post #138

Earlier quoted context omitted.

Most of those are people giving fairly reasonable benefit of the doubt, no apologism. But I suspect you're probably about as biased against Apple as the people you're assuming are biased towards Apple.

Oh your really off base.. I am MUCH MORE biased against Apple. You know those Linux users who hate on Microsoft? I am the Linux user who HATES Apple since I was first lied to by Apple in 1983 (Color Mac coming in the next year, wasn't till March 1987) (Color Mac will destroy Amiga 1000 in 1985) I have never seen Apple as being honest or making products for me as a nerd. So I live mostly in Linux nowadays.

[deleted]

Re: Hidden backdoor API to root privileges in Apple OS X

#158

Post by floatboth »

Of course this exploits XPC.

I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS.

If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.

Re: Hidden backdoor API to root privileges in Apple OS X

#159

Post by cozzyd »

bdcravens wrote: post #151
cozzyd wrote: post #135

Earlier quoted context omitted.

He discovered it 6 months ago. Maybe he gave Apple 6 months to fix it before disclosing?

I get that, but surely you have to provide a reasonable amount of time for patches to be installed. Perhaps a 2-part blog entry, where he gives general details (to instill urgency) and then release exploit code a month later?

If he published because Apple just patched, then I agree. If he published because he said he was going to disclose it at a certain time, then I think it's Apple's fault for dragging their feet. 6 months is an eternity.

Re: Hidden backdoor API to root privileges in Apple OS X

#160

Post by s_q_b »

barrkel wrote: post #144
matt4077 wrote: post #121

Earlier quoted context omitted.

80% on 10.9 or 10.10: http://www.intego.com/mac-security-blog/os-x-market-share-st... Only 50% on Windows 7 or 8: https://analytics.usa.gov Oh, wait, Windows 7 is from 2009. Only 10% use a Windows younger than two years.

A large chunk of this is due to business use of Windows. Microsoft would not be able to get away with the shenanigans that Apple are pulling here.

Don't worry, my company uses plenty of Macs, and they're plenty upset. As does the U.S. government. I wouldn't count on this "oh, we're just not going to backport the update" sticking around. Unless they want to loose all of their government and commercial sales.
Post reply on HN