OS X had a curiously similar screensaver vulnerability back in the early days. On 10.2.6 and earlier, attempting to submit a very long string (>65,537 characte

OS X had a curiously similar screensaver vulnerability back in the early days. On 10.2.6 and earlier, attempting to submit a very long string (>65,537 characters if memory serves) into the screensaver password prompt would crash the screensaver and drop to the desktop. Making exploitation much easier was how around the same time Cocoa widgets got emacs-style bindings like ctrl-k, ctrl-y, ctrl-a. Through combining these shortcuts an attacker could quickly and exponentially increase the input string length. I never saw it documented online but I remember applying this same trick to logonwindow and OS X dropping into the so-called 'secret >console mode' -- full screen terminal, Linux-style. Background: https://www.securemac.com/macosx-screensaver-security.php https://www.securemac.com/macosx-screensaver-security.php