Hidden backdoor API to root privileges in Apple OS X • Hacker News Board

Re: Hidden backdoor API to root privileges in Apple OS X

#141

Post by mhurron » Thu, Apr 09, 2015, 6:28 PM UTC

kpcyrd wrote: post #26

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

That's how all local exploits work.

Re: Hidden backdoor API to root privileges in Apple OS X

#142

Post by ccvannorman » Thu, Apr 09, 2015, 6:30 PM UTC

As someone who loathes Yosemite, I was hoping to find another fix for this. However, the exploit code when run in my console already returns "You need an administrator password" prompt. Huh? I'm running 10.9.5.

Re: Hidden backdoor API to root privileges in Apple OS X

#143

Post by borgia » Thu, Apr 09, 2015, 6:35 PM UTC

po1nter wrote: post #69

OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

>Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

It's dumbfounding how people here are simply shrugging this off and posting "So what? Just upgrade. Simples" type comments. This isn't acceptable. I know many people in creative industries alone who can't just upgrade immediately any time something comes out as they've to wait for their products to support the newer version. Similarly there are many who are using Macs in work whose corporate policies won't let them simply update immediately.

Then there's many who don't immediately upgrade versions as a point while bugs/other issues in that new version are found and resolved.

It's not an acceptable answer whatsoever.

Re: Hidden backdoor API to root privileges in Apple OS X

#144

Post by barrkel » Thu, Apr 09, 2015, 6:35 PM UTC

matt4077 wrote: post #121

dsjoerg wrote: post #95

Earlier quoted context omitted.

[citation needed]

80% on 10.9 or 10.10: http://www.intego.com/mac-security-blog/os-x-market-share-st... Only 50% on Windows 7 or 8: https://analytics.usa.gov Oh, wait, Windows 7 is from 2009. Only 10% use a Windows younger than two years.

A large chunk of this is due to business use of Windows.

Microsoft would not be able to get away with the shenanigans that Apple are pulling here.

Re: Hidden backdoor API to root privileges in Apple OS X

#145

Post by mattrepl » Thu, Apr 09, 2015, 6:36 PM UTC

kpcyrd wrote: post #26

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

Just to clarify, this is _not_ a remote vulnerability. If it was a means to create a remote shell, then it would be. An attacker would need to first find some way to gain remote access and then could use this bug to gain root privilege.

Re: Hidden backdoor API to root privileges in Apple OS X

#146

Post by guipsp » Thu, Apr 09, 2015, 6:37 PM UTC

JorgeGT wrote: post #114

wyager wrote: post #87

Earlier quoted context omitted.

There's a huge difference between physical access vulnerabilities (which are basically impossible to prevent) and local privesc vulnerabilities (which can be exploited in software).

To exemplify, for instance, this vulnerability could be packed in a phishing mail executable giving the remote attacker root access if the user falls for the trap, no?

Yes.

Re: Hidden backdoor API to root privileges in Apple OS X

#147

Post by fit2rule » Thu, Apr 09, 2015, 6:41 PM UTC

JorgeGT wrote: post #114

wyager wrote: post #87

Earlier quoted context omitted.

There's a huge difference between physical access vulnerabilities (which are basically impossible to prevent) and local privesc vulnerabilities (which can be exploited in software).

To exemplify, for instance, this vulnerability could be packed in a phishing mail executable giving the remote attacker root access if the user falls for the trap, no?

It could be packaged into any executable that someone might think about downloading off the Internet for some reason.

So its really, really not good. Apple need to fix this soon, or else every OSX machine out there is going to start being targeted for misuse. This is really a powerful security bug.

Re: Hidden backdoor API to root privileges in Apple OS X

#148

Post by unreal37 » Thu, Apr 09, 2015, 6:45 PM UTC

emodendroket wrote: post #53

myared wrote: post #24

Earlier quoted context omitted.

What better way to encourage people to upgrade.

There are still organizations paying huge stacks of money for Windows XP support past EOL.

I'm working on a year-long government project now to migrate a small bunch of websites from Windows Server 2003 to 2008 R2 (because extended support for 2003 ends this summer). Yes, we're upgrading to a 6 year old operating system.

Re: Hidden backdoor API to root privileges in Apple OS X

#149

Post by devy » Thu, Apr 09, 2015, 6:46 PM UTC

When Apple refuses to fix something that's good the public's interest, the best way to get Apple's attention is to make this a rootpipe gate by sending tips to all Apple focused media outlets like AppleInsider Macrumors etc. Talk about the power of press.

Case in point: Antenna gate, Bend-gate etc.

Re: Hidden backdoor API to root privileges in Apple OS X

#150

Post by jdmichal » Thu, Apr 09, 2015, 6:47 PM UTC

3JPLW wrote: post #140

jdmichal wrote: post #127

Earlier quoted context omitted.

This is a hole that exists because an Apple-written application needed a method to gain elevated access. This was done through unpublished APIs which, when used by another application in a similar way, also resulted in elevated access. So, this was clearly intentional, because it's used by Apple directly. And it allows illicit access, because any program can use it to gain access.

I'm not so sure. Unless I'm missing something, he doesn't demonstrate that this 'backdoor' is in use. It looks like they were using an escalation backdoor in `systemsetup`, but quickly patched a fix after 10.8.5. He just found a way around it. Now, the fact that 'it takes too much effort' to backport would suggest that it was still in use. I don't see any other evidence, though. I'd be interested if someone found it!

This seems to be the path followed:

systemsetup pointed to the Admin framework.

Admin framework analysis revealed use of "createFileWithContents". The function in which this use occurs is not named in the analysis.

An error message in the initial proof attempt led to "authenticateUsingAuthorization". Back to systemsetup to determine how to use "authenticateUsingAuthorization". (This is where I ended up mentally relinking the issue back to systemsetup.)

So, I concede that is is not stated where within the Admin framework this "createFileWithContents" method is invoked. However, I also agree that if that function was not used, it would be simple to remove it and the issue would be fixed.