17 ms·
Not true, at least on OS X: http://www.slideshare.net/rentzsch/dynamic-overriding http://www.slideshare.net/rentzsch/dynamic-overriding https://github.com/ren
by tlrobinson 15y ago
Not true, at least on OS X:
http://www.slideshare.net/rentzsch/dynamic-overriding http://www.slideshare.net/rentzsch/dynamic-overriding
https://github.com/rentzsch/mach_star https://github.com/rentzsch/mach_star
I don't know if this is how Dropbox works, but it seems likely.
- scott_s 15y agoThe first chunk of those slides talk about library hijacking. Say, you define your own version of malloc, make sure the application links to your version of malloc, and play your tricks from there. Process isolation has not been violated. The last five slides seem to be doing this: http://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUSA09-Daizovi-AdvOSXRootkits-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUS... Slide 4 is the difference: OSX is BSD running on top of Mach. So these techniques use the Mach layer to get around basic process protection. This is terribly insecure.
- tlrobinson 15y agoYeah, the injection stuff was what I was referring to. Apple apparently changed OS X in 10.4.4 to only allow root or procmod group to do this http://guiheneuf.org/mach%20inject%20for%20intel.html http://guiheneuf.org/mach%20inject%20for%20intel.html
- ataranto 15y agoDropbox does in fact use mach_star.