8 ms·

It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely:

It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/ https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/ https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within a month of each other.

judge2020 8y ago
Not Apple related, but you could log into any linux box using a specific few versions of grub2 by hitting backspace 28 times: https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-a-linux-computer-by-hitting-the-backspace-28-timestimes/ https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-...
- codedokode 8y ago
  Also, you can bypass screen lock in Ubuntu by removing the HDD [1]. The bug still is not fixed. [1] https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415
  - laumars 8y ago
    Honestly, I wouldn’t but that in the same class if bugs as those that preceded it because if the attacker he removed the HDD he will have access to your contents anyway (unless the HDD is encrypted) and it’s not a quick and convenient process either (unlike tapping backspace multiple times). That said, I also don’t agree that this bug should never get fixed either.
    - nurettin 8y ago
      This is a very naive estimation of what might happen when someone has access to all your running software. Since it is linux, it loads executables into memory and is able to run them even when they are deleted along with runtime dependencies. Anything that caches anything to anywhere other than disk will be accessible. Your memcache, your redis, some databases, keychains, your non-userdata browser sessions.
      - laumars 8y ago
        I'm aware of that but it's a moot point because you'd be popping the storage device back in anyway. Which is why I didn't address that in my previous comment. In any case, half the examples you've provided there are server specific and you really shouldn't be allowing untrusted physical access to your servers (nor running Xorg to be honest).
        nurettin 8y ago
        While I do agree, a lot of ideas here are still laden with hindsight.
  - Jonnax 8y ago
    That's a bug in Unity. They dropped their own desktop environment in 18.04 for GNOME. So it's likely it won't ever be fixed.
- morganvachon 8y ago
  Sometimes I feel like a relic using Slackware with lilo and SysV init, then I read about exploits like that and I smile.
  - omeid2 8y ago
    I am afraid your system is _probably_ just bug ridden as any other, it is simply not popular enough to for people to find bugs.
    - morganvachon 8y ago
      It's actually the opposite situation. Slackware's policy is to stick to the original software as distributed by the author with only minimal patching where necessary, so if a particular program (say, KDE) has a big support community, Slackware benefits from all those eyes on the code. This leads to a very mature and stable system at the expense of running older versions of software (though there's always the -current branch for those wishing to live on the edge). Beyond this, the small but dedicated Slackware team is working daily to find and patch bugs when they do appear. You can look at the changelogs for examples of that workflow[1]. There's no such thing as a software project without bugs, but Slackware is consistently one of the most stable and robust OSes out there. [1] http://www.slackware.com/changelog/ http://www.slackware.com/changelog/
- biggestdecision 8y ago
  This bug only applied to grub authentication, which isn't a widely used feature. And you could achieve the same result with boot from disk/USB if that is enabled. The vuln doesn't give you access to the actual accounts on the computer.
  - seanp2k2 8y ago
    Let's not forget https://www.cvedetails.com/cve/CVE-2013-1050/ https://www.cvedetails.com/cve/CVE-2013-1050/ and https://www.cvedetails.com/cve/CVE-2015-7496/ https://www.cvedetails.com/cve/CVE-2015-7496/ and https://www.cvedetails.com/cve/CVE-2017-8900/ https://www.cvedetails.com/cve/CVE-2017-8900/ (to a lesser extent). Check out https://www.cvedetails.com/vulnerability-list.php?vendor_id=0&product_id=0&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=1&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=0&year=2018&month=0&cweid=0&order=3&trc=194&sha=05aa8f8c1263cd6dfb415503c9c247a410d9fb3a https://www.cvedetails.com/vulnerability-list.php?vendor_id=... for more fun.
    - samstave 8y ago
      http://i.imgur.com/rG0p0b2.gif http://i.imgur.com/rG0p0b2.gif
      - stiGGG 8y ago
        Oh dear, I remember something similar was possible on iOS lockscreen multiple times. What version of Windows was that?
        samstave 8y ago
        95. 98 had an even better one... just hitting cancel on some login boxes would let you in.
        cheerlessbog 8y ago
        I believe that was by design: the dialog was an opportunity to authenticate with the domain. If you just wanted local access you could hit cancel. Remember Win9x was not a secure OS itself.
tedunangst 8y ago
I find those bugs less puzzling because the timeline makes sense. You're not logged in, there's a prompt, you're logged in. Obvious bug in the prompt, but the A happens before B happens before C order is there. Call comes in, audio is recorded, call is accepted is not the expected order. I could imagine a bug where declining the call still accepts the call, because that still obeys the proper ordering, but this bug does not.
- Twisell 8y ago
  I don’t use face time often, but isn’t there a "preview" of the camera feed during the prompt? I guess so that the user can check if he’s looking decent before engaging the call. The bug could then be that the feed is sent over the call too early instead of being used solely for this local feedback.
- smelendez 8y ago
  From the details, it sounds like "adding" the caller to the call before the call recipient accepts probably puts it in a weird state. Could be some kind of off-by-one error, where for some purposes Participant 2 is the caller and for some it's the recipient.
sixothree 8y ago
I remember turning on my iPhone and briefly seeing a picture of myself from a time when I had not taken any photos of myself. In fact I had not been using the front facing camera at all. Extra creepy.
- 2stop 8y ago
  If someone facetimes you and hangs up, that can happen. (I've noticed).
  - ta10101 8y ago
    That is what happened with Signal(i was on iOS and the person i called was on android)
    - Proof 8y ago
      I think user ‘sixothree’ was stating that a picture would show after unlocking the phone, not after a call. I myself, have had it happen to me several times couple months ago and thought it was really creepy. It almost seemed as if someone was using the front camera without my knowledge. Thought it to be glitch or something at that time.
      - sixothree 8y ago
        This is what happened. And I'll be honest, this is when I started losing faith in technology.
codetrotter 8y ago
I remember some people discovered that you could kill the xscreensaver lock screen on Debian with Alt+SysRq+F some years back. Well, a decade back actually — 2009. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884
- tuxxy 8y ago
  A fee years ago, I discovered that if someone was running dual monitors and using XScreenlock, you could unplug one of the monitors and it would bypass the lock screen. I have no idea if this is still possible, I've not used XScreenlock since then.
  - jakoblorz 8y ago
    That's a feature, not a bug! ;)
  - heywire 8y ago
    On Windows 10, if you have dual screens and unplug one while the screen is locked, it will reconfigure the displays and give you a flash of what was under the lock screen. Hope you didn't leave anything sensitive on your screen!
    - spockz 8y ago
      I’ve noticed this as well on my MacBook with an external screen actually. Also sometimes when resuming from sleep..
konschubert 8y ago
Edit: Deleted my comment because I felt it wasn’t constructive.
- pilsetnieks 8y ago
  There was one guy on reddit who had a scare when his computer flashed a picture of a dead person when shutting down, and he thought his computer was haunted. It turned out to be a frame from a youtube video he was watching earlier. It may be that macOS is not that good at clearing out GPU memory sometimes.
  - ben_w 8y ago
    I have the exact opposite problem. When I reboot after system updates, half a dozen YouTube videos in Chrome tabs start playing over each other on the password screen. They get through about 20 seconds before I can stop the last of them. Audio only on the password screen, but all audible.
  - SilasX 8y ago
    I’ve long had a similar problem on iOS. Whenever I return to an app, I briefly see an image from a few minutes ago. Which can be bad if I’m showing the phone to someone that old state was exposing sensitive data.
- mcpherrinm 8y ago
  Yes, I experience this routinely. As do many other people at my company. In particular it happens when attaching external monitors while the screen is locked. There's a flash of the unlocked desktop. I am guessing this is because the screen lock is an application drawing over top of the monitor, like XScreensaver on Linux does. A more secure-by-default architecture would have screen locking built into the display server at some lower level: If the screen is not unlocked, it will not allow the data to be passed to the GPU. It's easy for me to arm-chair architect though.
- MagicPropmaker 8y ago
  Apple claims, falsely, that their Operating System is "secure by design". (See https://www.apple.com/business/resources/docs/iOS_Security_Overview.pdf https://www.apple.com/business/resources/docs/iOS_Security_O... ) This is an outright lie. However, I'm not sure a typical iOS user cares.
mtgx 8y ago
These are the sort of "bugs" that have barely enough plausible deniability as backdoors to make people believe they were "random" or "human error."

judge2020 8y ago

Not Apple related, but you could log into any linux box using a specific few versions of grub2 by hitting backspace 28 times: https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-a-linux-computer-by-hitting-the-backspace-28-timestimes/ https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-...

codedokode 8y ago
Also, you can bypass screen lock in Ubuntu by removing the HDD [1]. The bug still is not fixed. [1] https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415
- laumars 8y ago
  Honestly, I wouldn’t but that in the same class if bugs as those that preceded it because if the attacker he removed the HDD he will have access to your contents anyway (unless the HDD is encrypted) and it’s not a quick and convenient process either (unlike tapping backspace multiple times). That said, I also don’t agree that this bug should never get fixed either.
  - nurettin 8y ago
    This is a very naive estimation of what might happen when someone has access to all your running software. Since it is linux, it loads executables into memory and is able to run them even when they are deleted along with runtime dependencies. Anything that caches anything to anywhere other than disk will be accessible. Your memcache, your redis, some databases, keychains, your non-userdata browser sessions.
    - laumars 8y ago
      I'm aware of that but it's a moot point because you'd be popping the storage device back in anyway. Which is why I didn't address that in my previous comment. In any case, half the examples you've provided there are server specific and you really shouldn't be allowing untrusted physical access to your servers (nor running Xorg to be honest).
      - nurettin 8y ago
        While I do agree, a lot of ideas here are still laden with hindsight.
- Jonnax 8y ago
  That's a bug in Unity. They dropped their own desktop environment in 18.04 for GNOME. So it's likely it won't ever be fixed.
morganvachon 8y ago
Sometimes I feel like a relic using Slackware with lilo and SysV init, then I read about exploits like that and I smile.
- omeid2 8y ago
  I am afraid your system is _probably_ just bug ridden as any other, it is simply not popular enough to for people to find bugs.
  - morganvachon 8y ago
    It's actually the opposite situation. Slackware's policy is to stick to the original software as distributed by the author with only minimal patching where necessary, so if a particular program (say, KDE) has a big support community, Slackware benefits from all those eyes on the code. This leads to a very mature and stable system at the expense of running older versions of software (though there's always the -current branch for those wishing to live on the edge). Beyond this, the small but dedicated Slackware team is working daily to find and patch bugs when they do appear. You can look at the changelogs for examples of that workflow[1]. There's no such thing as a software project without bugs, but Slackware is consistently one of the most stable and robust OSes out there. [1] http://www.slackware.com/changelog/ http://www.slackware.com/changelog/
biggestdecision 8y ago
This bug only applied to grub authentication, which isn't a widely used feature. And you could achieve the same result with boot from disk/USB if that is enabled. The vuln doesn't give you access to the actual accounts on the computer.
- seanp2k2 8y ago
  Let's not forget https://www.cvedetails.com/cve/CVE-2013-1050/ https://www.cvedetails.com/cve/CVE-2013-1050/ and https://www.cvedetails.com/cve/CVE-2015-7496/ https://www.cvedetails.com/cve/CVE-2015-7496/ and https://www.cvedetails.com/cve/CVE-2017-8900/ https://www.cvedetails.com/cve/CVE-2017-8900/ (to a lesser extent). Check out https://www.cvedetails.com/vulnerability-list.php?vendor_id=0&product_id=0&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=1&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=0&year=2018&month=0&cweid=0&order=3&trc=194&sha=05aa8f8c1263cd6dfb415503c9c247a410d9fb3a https://www.cvedetails.com/vulnerability-list.php?vendor_id=... for more fun.
  - samstave 8y ago
    http://i.imgur.com/rG0p0b2.gif http://i.imgur.com/rG0p0b2.gif
    - stiGGG 8y ago
      Oh dear, I remember something similar was possible on iOS lockscreen multiple times. What version of Windows was that?
      - samstave 8y ago
        95. 98 had an even better one... just hitting cancel on some login boxes would let you in.
        cheerlessbog 8y ago
        I believe that was by design: the dialog was an opportunity to authenticate with the domain. If you just wanted local access you could hit cancel. Remember Win9x was not a secure OS itself.

tedunangst 8y ago

I find those bugs less puzzling because the timeline makes sense. You're not logged in, there's a prompt, you're logged in. Obvious bug in the prompt, but the A happens before B happens before C order is there. Call comes in, audio is recorded, call is accepted is not the expected order. I could imagine a bug where declining the call still accepts the call, because that still obeys the proper ordering, but this bug does not.

Twisell 8y ago
I don’t use face time often, but isn’t there a "preview" of the camera feed during the prompt? I guess so that the user can check if he’s looking decent before engaging the call. The bug could then be that the feed is sent over the call too early instead of being used solely for this local feedback.
smelendez 8y ago
From the details, it sounds like "adding" the caller to the call before the call recipient accepts probably puts it in a weird state. Could be some kind of off-by-one error, where for some purposes Participant 2 is the caller and for some it's the recipient.

sixothree 8y ago

I remember turning on my iPhone and briefly seeing a picture of myself from a time when I had not taken any photos of myself. In fact I had not been using the front facing camera at all. Extra creepy.

2stop 8y ago
If someone facetimes you and hangs up, that can happen. (I've noticed).
- ta10101 8y ago
  That is what happened with Signal(i was on iOS and the person i called was on android)
  - Proof 8y ago
    I think user ‘sixothree’ was stating that a picture would show after unlocking the phone, not after a call. I myself, have had it happen to me several times couple months ago and thought it was really creepy. It almost seemed as if someone was using the front camera without my knowledge. Thought it to be glitch or something at that time.
    - sixothree 8y ago
      This is what happened. And I'll be honest, this is when I started losing faith in technology.

codetrotter 8y ago

I remember some people discovered that you could kill the xscreensaver lock screen on Debian with Alt+SysRq+F some years back. Well, a decade back actually — 2009. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884

tuxxy 8y ago
A fee years ago, I discovered that if someone was running dual monitors and using XScreenlock, you could unplug one of the monitors and it would bypass the lock screen. I have no idea if this is still possible, I've not used XScreenlock since then.
- jakoblorz 8y ago
  That's a feature, not a bug! ;)
- heywire 8y ago
  On Windows 10, if you have dual screens and unplug one while the screen is locked, it will reconfigure the displays and give you a flash of what was under the lock screen. Hope you didn't leave anything sensitive on your screen!
  - spockz 8y ago
    I’ve noticed this as well on my MacBook with an external screen actually. Also sometimes when resuming from sleep..

konschubert 8y ago

Edit: Deleted my comment because I felt it wasn’t constructive.

pilsetnieks 8y ago
There was one guy on reddit who had a scare when his computer flashed a picture of a dead person when shutting down, and he thought his computer was haunted. It turned out to be a frame from a youtube video he was watching earlier. It may be that macOS is not that good at clearing out GPU memory sometimes.
- ben_w 8y ago
  I have the exact opposite problem. When I reboot after system updates, half a dozen YouTube videos in Chrome tabs start playing over each other on the password screen. They get through about 20 seconds before I can stop the last of them. Audio only on the password screen, but all audible.
- SilasX 8y ago
  I’ve long had a similar problem on iOS. Whenever I return to an app, I briefly see an image from a few minutes ago. Which can be bad if I’m showing the phone to someone that old state was exposing sensitive data.
mcpherrinm 8y ago
Yes, I experience this routinely. As do many other people at my company. In particular it happens when attaching external monitors while the screen is locked. There's a flash of the unlocked desktop. I am guessing this is because the screen lock is an application drawing over top of the monitor, like XScreensaver on Linux does. A more secure-by-default architecture would have screen locking built into the display server at some lower level: If the screen is not unlocked, it will not allow the data to be passed to the GPU. It's easy for me to arm-chair architect though.
MagicPropmaker 8y ago
Apple claims, falsely, that their Operating System is "secure by design". (See https://www.apple.com/business/resources/docs/iOS_Security_Overview.pdf https://www.apple.com/business/resources/docs/iOS_Security_O... ) This is an outright lie. However, I'm not sure a typical iOS user cares.

mtgx 8y ago

These are the sort of "bugs" that have barely enough plausible deniability as backdoors to make people believe they were "random" or "human error."