Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

21–30 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#21

Post by Vexs »

Archio wrote: post #18
moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Isn't the idea though that with physical access, the game is already over anyway? If an intruder has physical access to your machine they will eventually be able to get to anything they want. If someone really wants to protect their data, they have to count physical access as a possibility and rely on encryption and/or remote wiping - the operating system login isn't going to do much anyway.

Yep, physical access is total access. However, this trick falls under cool-at-school-tech-labs, I'd hope enterprise systems would do something to prevent this kind of low-level shenanigans.

Re: Hidden backdoor API to root privileges in Apple OS X

#22

Post by danielweber »

diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

Re: Hidden backdoor API to root privileges in Apple OS X

#23

Post by praseodym »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Even easier is running 'resetpassword' from Terminal in Recovery mode (boot with ⌘-R). This gets you a nice GUI tool where you can reset any account passwords.

But yes, this is not possible with a firmware password or with disk encryption (FileVault) enabled.

Re: Hidden backdoor API to root privileges in Apple OS X

#24

Post by myared »

diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

What better way to encourage people to upgrade.

Re: Hidden backdoor API to root privileges in Apple OS X

#25

Post by nothrabannosir »

KuchenKerze wrote: post #15
moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

Not possible if full disk encryption is enabled. And that is a default since a year or so.

full disk encryption only protects you from passive snooping. If someone has physical access between two of your subsequent uses, no amount of any type of encryption will save you. Except maybe some entangled quantum bit collapsing mechanism. Maybe.

Think hardware keyloggers, fake MBRs, &c.

OP's trick won't work, but that's an "implementation detail;" there are plenty others that will.

EDIT: to clarify; that's not what you said, it's just a common enough misconception that it's worth being explicit about, here.

Re: Hidden backdoor API to root privileges in Apple OS X

#26

Post by kpcyrd »

moey wrote: post #11

With physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount…

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

Re: Hidden backdoor API to root privileges in Apple OS X

#28

Post by hrayr »

myared wrote: post #24
diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

What better way to encourage people to upgrade.

or to abandon your product

Re: Hidden backdoor API to root privileges in Apple OS X

#30

Post by larrys »

myared wrote: post #24
diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

What better way to encourage people to upgrade.

"What better way to encourage people to upgrade."

The majority of their user base doesn't know and wouldn't care about this type of thing even if they did.

Post reply on HN