7 ms·
Why (blank) gets you root
- unknown_apostle 9y agoI would think Apple would have released an update by now... but nothing yet. Can tell us something about the complexity of the code they need to change. Anybody an idea about how quickly they could release security updates?
- mattmanser 9y agoI know this is super-urgent to fix, but they've got to make sure the fix doesn't cause other problems. You can't do that in 20 hours. And how long did it take to go up the chain? Imagine the even bigger fallout if the fix accidentally ended up locking everyone out of the machines, essentially losing all data on anyone with an encrypted drive.
- plorkyeran 9y agohttps://support.apple.com/en-us/HT208315 https://support.apple.com/en-us/HT208315 They've now released an update.
- sigjuice 9y agoDoes installing this update bump up the macOS 10.13.x version number? I’m still on Sierra so I’m just curious. Thanks!
- votepaunchy 9y agoNot the version number (10.13.1) but the build number is updated to 17B1002. https://support.apple.com/en-us/HT208315 https://support.apple.com/en-us/HT208315
- empressplay 9y agoThis is the remnant of a previous OSX feature, that is you could go into single user mode, type passwd root, then create a password, then login with root / password. I guess there's a lesson here about complexity.
- empressplay 9y agoI should note that single user mode / passwd root thing has been around for quite some time, so remember kids, the only security is physical security...
- nixpulvis 9y agoSome mathematicians would disagree, but let's not go there.
- rjmunro 9y agoI think that if you have FileVault enabled and you shut the machine down when not in use, you are still secure, even from this attack.
- lloeki 9y agoIt is expected behaviour that on unix-like systems booting in single user mode leaves you with /bin/sh as init or something very much alike, and, obviously, being root. This is no different than booting a live{cd,usb} and at that point you're a mount/chroot/passwd away from resetting the password. Unless the disk is encrypted of course.
- rjmunro 9y agoThe article doesn't seem to say that according to my reading. The article says it is about verifying the legacy password when upgrading to a new-format password hash.
- code_duck 9y agoOn most Linux systems you can do 'sudo passwd'. But that has nothing to do with how this vuln occurs, i'm sure.
- jnsaff2 9y agoWhoever did not get the hunter2 reference: http://bash.org/?244321 http://bash.org/?244321
- Nursie 9y agoThanks for that link, it's a long time since I've looked at bash.org. Also a long time since I read the words "I put on my robe and wizard hat". LOL
- cardmagic 9y agoAnyone else getting tired of sites that are illegible on mobile?
- vardump 9y agoPersonally I'm getting tired of mobile browsers that don't have smart reflow of text on pinch-zoom. Which currently means all major brands...
- mikeash 9y agoSeriously. I could change my font size in Netscape Navigator 2.0 back in 199whatever. Why don’t mobile browsers have it? Anyway, reader mode is your friend.
- code_duck 9y agoSafari's Readability thing works well on that page.
- jacquesm 9y agoNot quite as tiring as people complaining about it. Just drop the style sheet and continue reading.
- TheRealPomax 9y agoHow does one drop a stylesheet on mobile?
- always_good 9y agoUse a browser's readability mode. If we're to expect everybody to test the reflow of text on mobile devices, why can't we expect mobile users to put in a little elbow grease themselves when reading on a comically tiny device?
- visarga 9y agoYou just ... drop it.
- teilo 9y agoIf I am understanding this correctly: Any existing but disabled account (an account with no shadow hash) will be upgraded to an account with a shadowhash. Normally this is fine, because it is an in-memory upgrade that allows the authentication code to run. And then, because of a brain-dead if check, whatever password the user attempted to use is saved as the shadowhash for that account, permanently enabling the account with the password that was being tried. In this case, that means a blank password. This allows a subsequent authentication with that same password to succeed. This accounts for the initial need to repeat the login multiple times.
- joveian 9y agoI don't think it is intended to be an in-memory upgrade but rather move the hash on disk into shadow with a new hash method. The only way to change the hash method is to create a new hash from the provided password after verifying that it matches the previous hash. The if statement seems designed to make sure that the password matches the currently stored password before doing anything, so the question is why does it not do that. Either the function returns that it does match for some reason or the return value is tested incorrectly. Currently the article doesn't say but maybe at some point the author will track that down :). Then the question is why it happened, which would be easier to speculate on knowing what precisely is wrong.
- DCKing 9y agoNot behind a Mac at the moment, but I wonder if this means you can also enable a set of other standard disabled Unix accounts on a Mac? That will worsen the impact even more, I'd say. Being able to enable disabled accounts my (locally or remotely) authenticating to a Mac system is very bad, even if those accounts are not root.
- snowwrestler 9y agoI pulled the list from /etc/passwd and have tried a bunch, but none worked. The root trick worked on this machine, so I know it's vulnerable. I have not tried them all. The vast majority of those usernames start with an underscore. Not sure if that matters. The trick didn't work for "daemon" and "nobody" either, though. I think there has to be some special weirdness about how root is disabled on Macs. It's the only account with its own "Enable.." line in the Directory Utility menu, for example. So at first blush this seems limited to root, but I'm not going to hold myself out as a macOS expert. Just someone with a Mac I don't mind trying to bork.
- SyneRyder 9y agoThere is a tweet that claims it also worked against _uucp, and (perhaps more concerningly) against _applepay: https://twitter.com/unsynchronized/status/935656609140711426 https://twitter.com/unsynchronized/status/935656609140711426
- MagerValp 9y agoYes, the exploit works (or worked, now that the patch is out) against any passwordless system account. You won’t get the same feedback as it won’t unlock the prefpane, but they will have the password set, allowing you to change the shell and log in.
- kalub92 9y agoWoah, this is nuts...
- 13of40 9y agoI haven't read through all 1000 comments on the other thread, so apologies if it's been covered somewhere else, but... Does anyone know if this can be exploited programmatically to bypass the need for 'sudo'. For example, could malware use this to elevate itself to root once it's running as a low-privileged user on the system?
- Qerub 9y agoYeah, sure. Here's a example from https://twitter.com/duo_labs/status/935607023026229249 https://twitter.com/duo_labs/status/935607023026229249 on how to escalate to root: /usr/bin/osascript -e 'do shell script "<command to be run as root>" user name "root" password "" with administrator privileges'
- 13of40 9y agoFrom the comments on that, it seems like you need to do the exploit in the UI first. According the the analysis of the bug, "Upon receiving a mach XPC message, opendirectoryd invokes..." but what happens on the client end of the XPC message isn't mentioned. I'm just wondering if a low privileged user can initiate that programmatically, and whether they could do it from code that doesn't need to be signed, like a shell script.
- dep_b 9y agoUsing a sane set of enums is just a bit more typing yet so much clearer in intent. Even if it's just Success or Failure instead of a bool or int. Still not bullet proof but seeing `return Success` where it fails and checking for `if (bla == Success)` makes it a lot easier to find the problems.
- jmah 9y agoThat could be what's happening but enum case names can't be determined from the disassembly.
- e_proxus 9y agoAfter reading this description of the problem and other users' comments about insufficient testing and how hard it would be to discover this particular case, I must say I'm baffled. As the blog post shows, the account creation is done on the first click, not the second. The second just logs you in. A trivial test in this case would have been, try to log in with a non-existing account (or an account with the wrong password) and make sure no state has changed afterwards. No new users, no changed passwords, everything as it was. Unit testing 101.
- aquamo 9y agoNice play-by-play analysis of the problem; thanks! Apple's authentication is not simple nor clearly documented (at least not where I could easily find it), I learned a lot following along.