4 ms·
To all the kernel programmers out there, can we get a HN-level ELI5 for this? It looks like a total system compromise is possible. Under what conditions? Any w
by lopatin 9y ago
To all the kernel programmers out there, can we get a HN-level ELI5 for this?
It looks like a total system compromise is possible. Under what conditions? Any ways to ensure we don't get pwned?
- Siguza 9y agoNeeds to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until the bug is patched (or, you know, ever)? Also, any decent antivirus shouldn't take long to add this to their malware definitions. Not sure if this is HN-level, but... I hope it's understandable.
- geekamongus 9y ago> Also, any decent antivirus shouldn't take long to add this to their malware definitions. Have Mac users finally started running antivirus?
- Siguza 9y agoWell, that I don't know...
- j0hnml 9y agoApple actually creates some signatures in house with “XProtect”, but I’m not sure they do the same for raw privesc exploits. I’m also not sure how thorough they are with their signature creation...
- biehl 9y agoNo
- oneplane 9y agoSome of them. But mostly of prevent forwarding windows-malware. Most corporate-managed stuff has endpoint protection, and most end-users are covered by GateKeeper, XProtect and the standard Google safe browse whatever it's called thing. And since most of the basic users simply use webmail, that vector is covered as well. It's not as bad as it once was.
- antaviana 9y agoIndeed, I always buy iMacs instead of MacBooks because I can actually pull the plug whenever something takes longer than anticipated.
- sigjuice 9y agoPulling the plug is a bit extreme. Perhaps you might consider logging on from another computer to troubleshoot?
- tomduncalf 9y agoYou can just press and hold the power button to shut a Macbook off. I assume this is a hardware level interrupt as I’ve never seen it fail. Granted not quite as satisfying as physically pulling the plug!
- bluedino 9y agoWhen they had power buttons you could
- jsmthrowaway 9y agoThey still do, it just also does Touch ID now. Source: Have one.
- zulln 9y agoIt should not be too hard to build in a hardware-switch. Sure, it would take some time but think I would prefer that over always being stationary.
- blinkingled 9y agoLooks like a Time of Check vs Time of Use (TOCTOU) type vulnerability. User controlled memory is read and used later by kernel space - time in between read and use can be used to overwrite it from user space, typically by exploiting and winning race conditions. I haven't completed reading this one thoroughly but one example like this is kernel performing access checks on user requests asking it to perform some action - user space would ask for something it is permitted to do at first, kernel would read it and proceed to perform access check. User space meanwhile writes something different to the original memory area that specified the action - this time something privileged - kernel comes back successfully performing the access check for the older action and now executes the privileged action from the overwrite. j00ru/project zero used modified Bochs (BochsPWN) to detect double memory fetch patterns to find similar vulnerabilities in the Windows kernel.
- Siguza 9y agoIt's actually neither TOCTOU nor double fetch, it's not checking anything at all, it's just write-then-fetch using shared (untrusted) memory to store trusted information. Sure similar in nature, but not really fitting any common name...
- blinkingled 9y agoI see - I will give it a full read little later - I like your writing style based on what I've glanced over so far!
- caf 9y agoTOWTTOU (with s/check/write)?