Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

311–320 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#311

Post by aceperry »

aaronem wrote: post #293
dwyer wrote: post #266

Earlier quoted context omitted.

> maybe I should go back to Snow Leopard; I can't think of a single valuable change to OS X since then... I wish I had that option, but I'm an iOS developer, so I upgrade when Apple forces me to, and right now their forcing Mavericks and up. > Linux is only free if you don't value your time. Amazing how the largest server farms on earth are all run by administrators who don't value their time...

The largest server farms on earth are all run by administrators who are extremely well paid for their time. Linux isn't free for the companies who hire them.

"Linux isn't free for the companies who hire them"

Actually, Windows isn't free for the companies who hire them. And you need to hire a lot more Windows admins than Linux admins if you want to keep your server farm running. But Windows admins are cheaper than Linux/Unix admins, so the phb can crow about that.

Re: Hidden backdoor API to root privileges in Apple OS X

#312

Post by kpcyrd »

mattrepl wrote: post #145
kpcyrd wrote: post #26

Earlier quoted context omitted.

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

Just to clarify, this is _not_ a remote vulnerability. If it was a means to create a remote shell, then it would be. An attacker would need to first find some way to gain remote access and then could use this bug to gain root privilege.

The parent comment and some of the child comments are implying you need to be physically near the system, which doesn't seem to be true.

You still need to find a way to execute code on the target system (also called "getting a shell"), but this can be done over the wire, too.

Re: Hidden backdoor API to root privileges in Apple OS X

#313

Post by kpcyrd »

endtime wrote: post #284
ekianjo wrote: post #252

Earlier quoted context omitted.

> Yep. JWZ used to say that Linux is only free if you don't value your time. Yeah, like installing drivers for all your peripherals on Windows never takes time, right?

I don't think I've ever had to install a driver manually on Windows 7.

Windows is able to get drivers itself over the network. Unless the ethernet driver is missing to, which happens most of the time.

Re: Hidden backdoor API to root privileges in Apple OS X

#314

Post by 72deluxe »

wwweston wrote: post #232
JustSomeNobody wrote: post #54

Earlier quoted context omitted.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

Yep. JWZ used to say that Linux is only free if you don't value your time. OS X has many merits on this front, but since 10.3 I've found that the first few dot releases of OS X have the same caveats often enough (both in terms of bugs/hazards and in terms of gratuitous UI "progress") that it usually seems better to wait past .x.4/5. Now there's this, of course. Since the problem showed up in 2011, maybe I should go b…

I agree with the UI "progress". Lion and Mountain Lion were the biggest changes for me; Mavericks and Yosemite are alright to my eyes (although they took some getting used to).

I have a USB disk with Snow Leopard on it that I can boot on my work's 2008 Mac Pro but that kernel panics on my 2012 MacBook Pro due to the i7 "from the future" according to Snow Leopard. It's a pity because it'd make a really great test system (I would like to check that my software runs on 10.6 OK).

Does anyone know of a way of booting Snow Leopard from disk inside a VM without many kernel kext kerfuffles? Parallels tells me that I stink if I try and install OSX inside it (I have the regular DVD, not the server edition)

Re: Hidden backdoor API to root privileges in Apple OS X

#315

Post by sneak »

nothrabannosir wrote: post #25
KuchenKerze wrote: post #15

Earlier quoted context omitted.

Not possible if full disk encryption is enabled. And that is a default since a year or so.

full disk encryption only protects you from passive snooping. If someone has physical access between two of your subsequent uses, no amount of any type of encryption will save you. Except maybe some entangled quantum bit collapsing mechanism. Maybe. Think hardware keyloggers, fake MBRs, &c. OP's trick won't work, but that's an "implementation detail;" there are plenty others that will. EDIT: to clarify; that's not wh…

There's have to be a hardware mod if a firmware password is enabled. It prevents booting from any other media or partition without a password.

Re: Hidden backdoor API to root privileges in Apple OS X

#316

Post by 72deluxe »

utbabya wrote: post #303
Tiksi wrote: post #302

Earlier quoted context omitted.

That's funny, because I haven't managed to find a desktop OS that is up to par with Linux for me. Preferences may vary, but second rate in your book is the only viable contender in mine. Also turns out that Linux does in fact have corporate sponsors, like oracle, red hat, etc. so I'm not sure I follow. Is closed source software top notch without corporate sponsorship? The sad truth is that most software sucks, regard…

I'm probably biased. After a year I find the only advantage of OSX are browser with touchpad gesture experience and windows edge handling. Haven't tried any distro ever since switching to MBP, wayland might have a better chance of replicating the experience. Hoping for the camera driver to be done. In Linux everything else is better, fuller implementation of base tools, customizability, no crap like /var/folders..

"In Linux everything else is better"

This is entirely subjective; it is not a wise comment to make because it is better FOR YOU, not for everyone. For me, I liked the configurability in Linux desktop land but there comes a time when you want to sit in your office and get stuff done instead of spending all the time moving the furniture around and decorating; OSX doesn't let you do any decorating or move the furniture, so you're forced to do work (to some extent).

I daily use Linux, yet my day-job is to write software on OSX and Windows, so I get to use every system every day. They're all pretty much a muchness.

Re: Hidden backdoor API to root privileges in Apple OS X

#317

Post by 72deluxe »

atomicfiredoll wrote: post #253
Alleluja wrote: post #203

Earlier quoted context omitted.

My Dad got himself a brand new laptop (i7, 8gb ram, ssd, etc). And a brand new printer HP OfficeJet (big black shiny machine with all the bells and whistles). He couldn't print his stuff for work. He called me up. After over an hour I gave up. Windows 8 couldn't figure out which drivers to use. The CDs attached with printer didn't help too. I mean the installation went smoothly, but then nothing was printed. Check yo…

And on our network the Windows PC prints fine, but the Macs have no idea what's going on. TL;DR: Printers still suck.

If only there was some sort of Printer Command Language that would negate the need for these issues.....?

Or perhaps some form of scripting language that you could post, perhaps they could even call it PostScript?

Re: Hidden backdoor API to root privileges in Apple OS X

#318

Post by 72deluxe »

marssaxman wrote: post #299
JustSomeNobody wrote: post #54

Earlier quoted context omitted.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

I miss 10.6.8.

That's why I Carbon Copy Cloner'd my Snow Leopard partition to a USB HDD!

Pity I can't actually boot it on my 2012 i7 (kernel panics ahoy).

If anyone knows how to get around this, I would appreciate it as it would be truly marvellous to be able to test software that I've written under it.

Re: Hidden backdoor API to root privileges in Apple OS X

#319

Post by 72deluxe »

tjr wrote: post #82
matt4077 wrote: post #38

Earlier quoted context omitted.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

I have a lot of music production software on my Mac, which doesn't all necessarily get updated to work with the latest OS X right away. Upgrading the operating system tends to be a maze of determining what works and what doesn't, possibly including paying for updates of software besides the OS. I generally put off doing a major Mac OS update for as long as possible.

It's even worse that every update makes you wonder if your FireWire interface and control software will ever work or run again, even though you're running on THE SAME HARDWARE as before; the OS update typically breaks it.

Re: Hidden backdoor API to root privileges in Apple OS X

#320

Post by [deleted] »

endtime wrote: post #284
ekianjo wrote: post #252

Earlier quoted context omitted.

> Yep. JWZ used to say that Linux is only free if you don't value your time. Yeah, like installing drivers for all your peripherals on Windows never takes time, right?

I don't think I've ever had to install a driver manually on Windows 7.

[deleted]
Post reply on HN