Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

Post reply on HN
Print view View original

201–210 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#201

Post by FooBarWidget »

kenferry wrote: post #184
floatboth wrote: post #158

Of course this exploits XPC. I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.

Hm? This wouldn't have been any better if implemented using sockets.

Indeed, it wouldn't. It's just another typical example of someone who doesn't understand why a complicated IPC system exists, and thus blames all possible problems on its mere existence.

It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.

Re: Hidden backdoor API to root privileges in Apple OS X

#202

Post by thebouv »

EC1 wrote: post #105
thebouv wrote: post #90

Earlier quoted context omitted.

I'm with you on this; I can't leave Mavericks just yet. Every colleague I have that's moved on has had numerous issues with their machine. And now this crap. Ugh.

What kind of issues? I've literally noticed no differences besides UI.

Generally much slower response, Final Cut breaking, trouble with hanging apps needing force quits, and it goes on. Minor by themselves; scary when it all seemed to happen after each person upgraded.

Maybe I've waited long enough before moving. Especially now that this vuln is known about.

Re: Hidden backdoor API to root privileges in Apple OS X

#203

Post by Alleluja »

mattdotc wrote: post #182
PopsiclePete wrote: post #168

Earlier quoted context omitted.

FWIW, 10.10.0 for me was perfect. 10.10.1 broke my wifi. Anytime the computer woke up from sleep, I'd have to reset the wifi card so it could find my access point. After 10.10.2 came out, I got my second-ever full computer lock-up. I've had the same OS image since 10.5 (migrated and upgraded multiple time, obviously) and this was the second time my computer required a hard reboot. And this was while watching a video…

>Windows is out of the question after seeing what a factory OEM image comes with nowadays. Fair play. Research the manufacturer's policy if you're buying pre-built. If you build your own desktops, this is not an issue. >I'm not giving them money and spending 2 days formatting/reinstalling/seeking out drivers on slow Taiwanese servers just to make a half-usable computer. When's the last time you actually installed dri…

My Dad got himself a brand new laptop (i7, 8gb ram, ssd, etc). And a brand new printer HP OfficeJet (big black shiny machine with all the bells and whistles).

He couldn't print his stuff for work. He called me up. After over an hour I gave up. Windows 8 couldn't figure out which drivers to use. The CDs attached with printer didn't help too. I mean the installation went smoothly, but then nothing was printed. Check your cables, etc. messages like we are still in 1996.

I don't have time for this BS. Drove back home, got my macbook pro. Came back to my Dad's home and did THIS: 1. connect printer to the mac 2. driver installs after clicking 'OK' or 'install', dont even remember at this point 3. print

that's it! Welcome back to 2015!

Re: Hidden backdoor API to root privileges in Apple OS X

#204

Post by enlightenedfool »

JustSomeNobody wrote: post #54
matt4077 wrote: post #38

Earlier quoted context omitted.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks. Just because something is free doesn't make it better.

My 2009 imac took 3 sec to respond to each click with Yosemite. Got frustrated and installed Mint and it works great!

Re: Hidden backdoor API to root privileges in Apple OS X

#205

Post by kazinator »

mikeash wrote: post #98
raldi wrote: post #52

Earlier quoted context omitted.

In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.

What do you call something that grants root access without authentication, but wasn't intended to let arbitrary people or programs use it? "Backdoor" isn't quite right, since that implies that the intent was to allow unauthorized use. "Security vulnerability" isn't quite right either , since that usually implies getting code to exhibit some sort of behavior it was never supposed to have. I can't think of any other te…

There is no jargon for "obscure, deliberately implemented security hole which supports system functionality", because nobody does that.

(For values of 'nobody' which are not members of a set that includes such as Apple, obviously.)

Jargon and slang is needed for shortening the names of everyday things that people do, use or encounter.

If Apple has started a trend, we might need a new term, like "root kludge". A deliberate solution with negative attributes is a kludge (that much we have slang for, because we encounter such things with reasonable frequency). This type of kludge gets us root. So ...

Wait, if Apple starts a trend with this, then it will be cool, and have some name that begins with 'i'.

How about "iHole".

"An iHole was discovered in my wi-fi router's firmware".

Hmmm ...

Re: Hidden backdoor API to root privileges in Apple OS X

#206

Post by 1amzave »

hrayr wrote: post #28
myared wrote: post #24

Earlier quoted context omitted.

What better way to encourage people to upgrade.

or to abandon your product

After getting more and more tired of Apple's generally obnoxious behavior over the last few years I'm wondering which straw will be the last for me before doing exactly that. I'm pretty seriously considering wiping OSX off my MBP and running some variety of Linux on it at this point, though regrettably I might still be forced to consider them for future hardware purchases on account of the fact that I don't think I've ever encountered a non-Apple laptop that seemed worthwhile (in terms of general construction and build quality).

Re: Hidden backdoor API to root privileges in Apple OS X

#207

Post by vacri »

matt4077 wrote: post #38
danielweber wrote: post #22

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

usually run well even on 5+ years old hardware

At my last office we had older macs, a mix of laptops and desktops. They all ran slow, with one user's mac pro using all 4GB RAM on a fresh boot with nothing loaded. These folks were normal users, not power users. When a new OSX release would come out, a few people would upgrade, have a ton of problems, and warn everyone else.

I ran linux myself, and was occasionally called over to help with an OSX problem, and I could never understand how my colleagues could stand to work on such slow computers. In my experience, older macs do not usually run well on newer OSX.

Re: Hidden backdoor API to root privileges in Apple OS X

#208

Post by jdmichal »

glhaynes wrote: post #152
mike_hearn wrote: post #68

Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.

I'm kind of surprised there's not a means (to my knowledge, at least) to crash/throw an exception upon sending a message to nil for people who want to better ensure their code doesn't have lurking issues like this. I suppose it'd have to be smart enough to filter out system frameworks to be useful, but I'd imagine that to be do-able.

Why not just some old-fashioned input guarding?

    if (input == nil)
        haltAndCatchFire();
Or whatever the Objective-C syntax for that is.

Re: Hidden backdoor API to root privileges in Apple OS X

#209

Post by cmurf »

PopsiclePete wrote: post #168
EC1 wrote: post #105

Earlier quoted context omitted.

What kind of issues? I've literally noticed no differences besides UI.

FWIW, 10.10.0 for me was perfect. 10.10.1 broke my wifi. Anytime the computer woke up from sleep, I'd have to reset the wifi card so it could find my access point. After 10.10.2 came out, I got my second-ever full computer lock-up. I've had the same OS image since 10.5 (migrated and upgraded multiple time, obviously) and this was the second time my computer required a hard reboot. And this was while watching a video…

Instead of OEM Windows image, use this tool to get rid of the crapware (malware in some cases): http://windows.microsoft.com/en-us/windows-8/create-reset-re... Windows Update is terrible. OS X has that beat. But Windows is ~5 years mainstream support, ~ 10 years extended. With OS X, you don't know. It might be 18 months, it might be 3 years.

Re: Hidden backdoor API to root privileges in Apple OS X

#210

Post by renaudg »

mattdotc wrote: post #182
PopsiclePete wrote: post #168

Earlier quoted context omitted.

FWIW, 10.10.0 for me was perfect. 10.10.1 broke my wifi. Anytime the computer woke up from sleep, I'd have to reset the wifi card so it could find my access point. After 10.10.2 came out, I got my second-ever full computer lock-up. I've had the same OS image since 10.5 (migrated and upgraded multiple time, obviously) and this was the second time my computer required a hard reboot. And this was while watching a video…

>Windows is out of the question after seeing what a factory OEM image comes with nowadays. Fair play. Research the manufacturer's policy if you're buying pre-built. If you build your own desktops, this is not an issue. >I'm not giving them money and spending 2 days formatting/reinstalling/seeking out drivers on slow Taiwanese servers just to make a half-usable computer. When's the last time you actually installed dri…

>If you absolutely need to read a PDF, Foxit Reader is free, as in beer.

You're actually proving his point : on Windows something as basic as reading PDFs (yes you "absolutely" need that in 2015) requires specific knowledge of obscure names like "Foxit Reader".

I'm not even going into annotating that PDF or adding your signature to it then.

The same goes for : an office suite, a file manager with decent previewing+smart search capabilities, something that quickly resizes/converts your pictures, great photo editing/cataloging software, video editing software, music editing software, e-mail client, a comprehensive development environment (1)

All of the above, which covers almost all areas of what people actually use computers for, comes as standard on OS X

(1) Pages/Numbers/Keynote, Finder+Spotlight, Preview (also your answer for annotating PDFs btw), iPhoto/Photos, iMovie, Garageband, Mail, Unix CLI/XCode

> Yes, you'll have to uncheck some boxes to avoid their bundled software. Big deal.

Hate to say it in troll-ish way but : everyone but lifelong Windows users has higher standards than this.

Post reply on HN