OS X sudoers exploit found in the wild • Hacker News Board

Re: OS X sudoers exploit found in the wild

#191

Post by hueving » Mon, Aug 10, 2015, 7:03 AM UTC

kordless wrote: post #167

hueving wrote: post #89

Earlier quoted context omitted.

At least read about responsible disclosure before being so flippant about things like that. Esser put people at risk. Whether or not anything happens is irrelevant. He put them at risk and we need to recognize that is the cost of full disclosure. If you're fine with that, cool, but don't pretend he didn't do anything.

> read about responsible disclosure Stop presuming I haven't. > Esser put people at risk. That's non-provable until we see it instantiated. > If you're fine with that, cool, but don't pretend he didn't do anything. Don't speak for me. I never said he did the right thing. I said stop spinning what-ifs about it, but clearly what I should have said is STFU and do something about it. People getting in each other's grill…

>> Esser put people at risk.

>That's non-provable until we see it instantiated.

That's not how risk works. I don't even know where to start. If you play a round of Russian Roulette and happen to hit an empty chamber, do you say it's impossible to prove you were at risk? Do you see now how dumb that argument is?

If he publicized a vulnerability, the risk to all of the affected systems is increased. Period.

It's the same way that EMPs are a risk to airlines. If someone releases a method to generate them very easily, they increase the risk to all airlines. You don't have to wait until an airline is brought down before you say the risk was increased.

Re: OS X sudoers exploit found in the wild

#192

Post by jakobegger » Wed, Aug 12, 2015, 7:39 AM UTC

noondip wrote: post #181

glhaynes wrote: post #172

Earlier quoted context omitted.

Ah, thanks for clarifying. I suppose it wouldn't have execute permissions if downloaded from a browser, but it could if copied with Finder from a network share (or directly accessed, of course), so that sounds like a potential vector.

It is a lot easier than you may think. Here is a simple demonstration: https://vid.me/gGQY

This is bullshit. If you actually put that disk image on a web server, and then download it, you'll get the unidentified developer warning and you can't run the script (there will be no button to open it).

Gatekeeper and code signing work hand-in-hand. You can run any unsigned code you want, as long as you didn't download it from the web. For example, gatekeeper won't prevent you from running usigned code you compiled yourself, or from running code you installed using a package manager.

OS X is smart enough to know that a shell script is equivalent to an application. You can't fool Gatekeeper quite that easily.

Re: OS X sudoers exploit found in the wild

#193

Post by jakobegger » Wed, Aug 12, 2015, 8:09 AM UTC

noondip wrote: post #147

jakobegger wrote: post #80

Earlier quoted context omitted.

Gatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.

You're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.

I think you are misunderstanding something. Shell scripts and unsigned code are treated exactly the same by Gatekeeper.

When you double click a shell script downloaded from the internet, the warning will not ask you if you want to open the file. The warning will tell you that you can't open it because it is from an unidentified developer.

Let me try to clarify this: "Quarantine" is a flag set on files downloaded from the internet. When you open a file with the quarantine flag, Gatekeeper checks the code signature. If it is valid, it asks you if you want to open this file that you downloaded from the web. If the code signature is not valid, or if the file has no code signature, you wont be able to open it.

There are several ways to execute shell scripts downloaded from the internet: 1) Check "Allow all Applications" in System Preferences 2) Right click, select open. Then the warning will have a second option to open it despite being unsigned 3) Execute it from the command line

All of these presumably require the user to know what they are doing...