11 ms·
Cracking OSX Lion passwords
- KonradKlause 15y agoTL;DR: There is no need to crack the password. You (as non-root user) can just reset the currently logged in user's password by calling: dscl localhost -passwd /Search/Users/bob
- scott_s 15y agoNot any, but the currently logged-in user.
- KonradKlause 15y agoThanks for the clarification!
- itg 15y agoHas anyone tried this yet? One of the comments on that blog mention you still have to enter to old password in order to reset. $ dscl localhost -passwd /Search/Users/bob New Password: * Permission denied. Please enter user's old password:
- delinka 15y agoIf you are currently logged in as alice, this is correct. However, if you are logged in as bob, you are not prompted for the old password.
- drivebyacct2 15y agoI suppose it's different if an unauthenticated user can perform a password change with the system powered on, but similar things can be done with Windows and a Linux live cd with some tools, and Linux passwords can be changed in "single user" mode.
- maximilian 15y agoYou can also just pop in the OS X cd and change the password at boot.
- moe 15y agoYou can not decrypt Filevault that way, though.
- SoftwareMaven 15y agoDoes this problem allow file vault access? Unless I read it wrong (totally reasonable in my jet lagged state), this won't reset your keychain either.
- hmottestad 15y agoI'm wondering the same thing. I use filevault, but I don't feel like messing it up by changing the password this way. I wonder if you can reset the password and use that password to simply disable the filevault. Btw. My five cents. Write a script to: 1. change current users password to X 2. sudo "something really bad" 3. use password X And there is a virus that can do anything on a mac. If you can change the password of the current user and he/she is an administrator, then any application can escalate to SU.
- simcop2387 15y agoYea with this I'd be worried about something doing that, making a new hidden user and then setting the password on the original account back leaving no immediately visible signs that anything is wrong.
- alttag 15y agoReverting the pw assumes you knew it in the first place, and thus didn't need to change/reset it.
- maximilian 15y agoIn the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)
- RyanKearney 15y agoBecause it just works.
- num1 15y agoYou're using an apple product. When did they ever claim to be secure? Your life is easier, more magical, full of glass, and very fast! Security is... a little bit of whipped cream on top. So enjoy your gestures on that magic touchpad, don't worry about being safe. (Sorry, I couldn't resist)
- tiles 15y agoApple doesn't ignore security, they advertise security enhancements in their products: "Address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack." "Application sandboxing protects the system by limiting the kinds of operations an application can perform, such as opening documents or accessing the network. Sandboxing makes it more difficult for a security threat to take advantage of an issue in a specific application to affect the greater system." Part of OS X Lion's new features: http://www.apple.com/macosx/whats-new/features.html#security http://www.apple.com/macosx/whats-new/features.html#security
- num1 15y agoErm... I forgot I was in a place where preemptively apologizing for making a joke isn't enough for people to think you're joking. I would like to point out though, that the text you just copied are pretty much apple's only words on the topic. To further my joke even more: Google search for "easy" on apple.com [1] returns 3.3 million results. Google search for "secure" on apple.com [2] returns .5 million results. On the internet easy returns 3.6 billion results, and secure 1.25 billion. So on the apple site, you would expect easy to show up 3 times as much as secure. In fact, easy shows up over 6 times as much as secure. This definitely proves apple cares about security only half as much as the rest of the internet does!
- dotBen 15y agoThis feels a little bit like a naughtily published zero-day exploit. I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.
- scott_s 15y agoNot really. There's no privilege escalation. You can only change user's password if you're already logged-in as user. That's bad, but it's only going to happen if you literally walk away from a terminal and someone else sits down.
- jessedhillon 15y agoOr run a malicious script?
- scott_s 15y agoThere are far more damaging "malicious scripts" one could trick someone into running, such as "cd; rm -rf *". Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege. I like Raymond Chen's take on the topic: http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/592350.aspx http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...
- bigiain 15y ago"Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege." Doesn't the end of the article suggest that without admin access, you could just reset the password for any admin user, then be able to log in as them? Sounds like priv escalation to me. Edit: Actually, reading further comments, it seems you can only reset the password of the currently logged in user without reauthentication, so you can only get admin privs if you've already got a console with admin privs. I'm wrong.
- 15y ago
- kulpreet 15y agoYou can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
- lawnchair_larry 15y agoThat risk level is not at all on par with this though. That won't help with filevault turned on, and it requires both a reboot and a physical presence at the machine. This can be done remotely with shell access, and discloses hashes from other accounts.
- knux 15y agoUnless the Mac has a firmware password. You could just remove that by resetting the PRAM, unless you wanted to go undetected. In that case, you could remove the hard drive, mount it elsewhere, and change the password hash. Is FileVault plus a firmware password the only safe way to keep your Mac?
- ryannielsen 15y agoFileVault by itself is sufficient, at least with Lion. Even if you're able to boot the machine or mount the HD, you'll need the user's original password to decrypt the data. The Password Reset app is useless until you first unlock the encrypted drive. (I'm pretty sure that pre-Lion's FileVault is in the same case, where you'll still need the user's old password to decrypt their home directory's encrypted dmg, but I'm not 100% certain.)
- alwillis 15y ago
- emehrkay 15y agoI know this isn't the same, but I feel like mission control set to a hot corner bypasses the password screen from time to time. I never really notice it though
- jballanc 15y agoTwo points: 1. When it comes to security, from the point of view of an OS vendor, if you have gained unauthorized access to an interactive shell on a target machine it's already "game over, man". You cannot protect against physical access, and you can pretty much assume that there are a plethora of unknown privilege escalation bugs so that any account is effectively a root account. Every company has limited security resources, and at some point there are trade-offs between usability and security. This is why efforts are typically focused on keeping the baddies out. Once the bad guy gets in, you can only mitigate potential harm. This is the goal of things like File Vault (which will still protect your stollen laptop, assuming you put on a screensaver password). This is also why merely being able to change a password is not nearly as bad as... 2. Being able to recover the plain text of a user's password. I'm not going to discuss how or why, but this was possible on earlier versions of OS X and fixed only in Lion. In this regard, "cracking" passwords is much harder on Lion than it was on Snow Leopard and earlier. Of course, that sort of level-headed approach to this kind of topic seems to be rarer and rarer on HN these days...unfortunately...
- keypusher 15y agoany account is effectively a root account I'm no security expert, but that doesn't seem right to me.
- merijnv 15y agoHe means "any account with local access" is effectively a root account, which is true. Resetting passwords is trivial when you can reboot and have an install disk.
- jballanc 15y agoThink of any system as a castle. Having access to an interactive shell is like standing outside the King's bedroom. Sure, you might not have the keys to the bedroom door, but you've already made it past the archers, the moat, the drawbridge, the boiling oil, and the King's personal body guards. You don't put a 3 ton door on the King's bedroom and say, "Well, that should keep the invading army out!" No, you strengthen all of the defenses leading up to the door so you never have to worry about just how strong that door is. That's not to mention that the King probably doesn't appreciate having to swing a 3 ton door every time he wants to go to sleep. Same idea with computer security. Only give accounts to trusted individuals. Assume anyone with an interactive shell can quickly gain root access. Physical access is even worse. If you can sit at the keyboard, then you control everything. This is why most banks have key servers locked in real physical vaults with 3 ton doors. Honestly, I'm a little surprised. This is all "Computer Security 101" level stuff here. Getting worked up about "cracking" passwords given local access is akin to worrying about someone spying on you when you visit this site: http://www.josephcrawford.com/2006/11/11/scary-isight-trick/ http://www.josephcrawford.com/2006/11/11/scary-isight-trick/ . If you want some real security research meat to sink your teeth into, the pwn2own contests are always pretty good, especially the most recent one (http://arstechnica.com/security/news/2011/03/pwn2own-day-one-safari-ie8-fall-chrome-unchallenged.ars http://arstechnica.com/security/news/2011/03/pwn2own-day-one...). You might notice, if you read about the pwn2own contest, that the contest is over as soon as the exploit runs arbitrary code on the local machine and successfully breaks out of the application sandbox. At that point, you're knocking on the door...